Posts by doublelayer

User found the perfect formula to make Excel misbehave

Re: Maths

"musical notation was probably one of the oldest programming languages"

We'd need a clear definition that distinguishes programming languages from languages in general. It's definitely a language that expresses something, but it lacks many of the aspects that a programming language probably should include like any kind of branching*, since there aren't inputs.

* It does, sort of, have reuse because chunks can be repeated without copying all the notation by referring back to them. However, that doesn't count, at least to me, as branching, only compression.

Re: Had something like this once with a client

True, but I'd have thought even those advising mixing metric and one of the others would have the small amount of wisdom necessary not to recommend mixing imperial and US customary. Two systems with the same names for most of the units, some but not all of which are different, is a recipe for even more disaster than mixing grams and ounces. Grams, ounces, and centi-adult-badgers I can manage if the reasons are good enough.

Re: 75 to 100 is 25%.

I think one confusion people tend to have is that many percentages are reported without being entirely clear on what number the percentage is taken from. When someone reports a 20% increase in the past month, the most natural assumption is that it went from 1x a month ago to 1.2x now, but they might have also calculated it as 1y now and 0.8y then, which in the previous system would be a 25% increase. Both things can be clearly stated: "The number increased by 20% compared to a month ago" or "20% of the increase in the current number occurred in the past month", but I've grown to know that when someone just says "20% increase", it could end up being either of those.

Re: Had something like this once with a client

The person who knows whether to do something can be smarter than the person who can and does without considering that. I can use both systems. I can use a third system if you just make it up. But I will ask for reasons, and unless you can provide some good ones, I won't because there are many downsides.

Re: decimal system

A great demonstration; let's stop using grams. You could of course solve this one problem for me:

You have a balance with two pans which will tell you when the amount on each pan is the same. You have 1 ton (either of them) of something. I'd like 100 pounds of that.

As with any other balance, you could manage that. People did. It's not as simple as you pretend it is because only the pound is a power of 2 in that system. The ton, the stone, the hundredweight (112 pounds UK, 100 pounds US) are all not powers of two. You picked the only one in that system which fits your argument and hold it up as if we'd not know about all the rest of them. Even if we accepted that our units of weight still had to be based on simple balance scales that we've improved many times centuries ago, you would still be wrong because we'd have to invent a system of weights that actually did that.

Re: decimal system

The only thing it makes easier is not having to track the size of arbitrary units, most of which were not defined by people interested in what you're pretending they're interested in. It's not that decimal is the best base; there's basically nothing about it that makes it better than any other base and, compared to 12 or 16, you could argue it's worse. However, since we have all decided to use it for most of our numbers, it makes sense to continue using it rather than make people work in other bases, because the same people who explain how great feet are for measuring things because what if you have a thing that's exactly one foot long and need to cut it into thirds (you don't need to, and if it's a meter, you can still do it) would complain vociferously if we accepted that and also informed them that all other numbers were going to get reported in base 12 too.

As for degrees on a compass, there's a factor that probably should be in whatever divisor you use for that: 4, so you can still have due north, east, south, and west. Other than that, you can divide it in any way you like. Whether that's 100 decgrees, and if you need something more precise you divide those in tenths, or 360 degrees, or 400 gradians, or 144 dozendegrees, it will work. For most purposes, the difference between 77 and 78 degrees east-northeast doesn't matter, and when it does, nothing says an integer number of 1/360 off your reference is going to include the right value.

Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays down

DDoS attackers usually have access, either what they built or something they bought*, to a bunch of machines that aren't theirs. Otherwise, attacks are too easy to defend against. It's probably not even mostly coming from Iraq.

* The most common is buying the access from people smarter than them because most people who use DDoS attacks are pretty stupid as online attackers go. The attacks aren't very effective and burn lots of resources, so they're frequently run by people who don't have the skill to do anything else, and that often includes building the botnets needed to run the attack in the first place.

Re: Would it not be a plan to have spare domains?

"I was talking loosely."

Were you really? Because if that's actually what you were doing, this might be a useful lesson in talking specifically enough that you don't appear to be talking about something else plausible but completely different. I did not downvote either of your comments, but don't be surprised when people interpret "spare domain" as another domain and explain why that wouldn't work.

And, unless you're still talking loosely and mean something other than what you say, it still wouldn't help. There are a few ways to do that, most of which they already did. Backup servers on a backup domain would be easily located, requiring a one-line change to their attack software. Since it's in a public operating system, they could easily find it before starting so they didn't even have to do that. There would be no improvement other than the extra servers, and since you could just have taken some of the ones being attacked and moved them to your backup system, you wouldn't even need those. That would be very easy to build but very ineffective.

The next suggestion is lending space to others. They've got that, it's called mirrors. There are a lot of those. That's one reason the archives weren't down very long compared to the rest of the systems, because it was easier for people to take load off them by switching to mirrors outside the usual ones used and because Ubuntu already distributes load across quite a few of them.

Re: Would it not be a plan to have spare domains?

It wouldn't make a difference. They're not attacking resolution of a domain. They're attacking the multiple servers serving that domain, including some targeted subdomains. The solution is more servers, and you could easily have those serving one domain anyway, but more servers is expensive and Canonical wants to be efficient.

Nearly half of UK businesses pwned last year as phishing keeps doing the job like it's 2005

Re: Real problem is staff clicking on dodgy emails ?

Could you describe an OS that would prevent, say, a phishing site which says "Enter your credit card number here"? Or one that can tell software that's going to cause damage apart from software that won't when someone with the privileges to run software executes it? What magic computer do you think would fix this problem?

Re: Go back to text based email

"Disagree with framing it as a choice though, given all the research done into habituation effects"

I think it's valid given how many trainings I've seen or, in one case, written telling people to do it. We can and should improve the processes, but people not doing what they were told aren't going to magically start doing so when the information they're supposed to read is buried in a bunch of text they get used to scrolling past. We should make it easier for people to get the information, but we will still need them to take that extra bit of effort to check.

Some of the suggestions for sending warnings are good, and I've seen a few of them implemented. Many servers now tag any address outside the organization which makes impersonation attacks harder. Some warn about links or attachments. I expect these to have made some improvements, and we can probably target them more. These are worth adding and will probably have more effect than plain text will.

Re: Go back to text based email

I doubt it in both cases. It's quite easy to see the from address in pretty much every email client. People who don't choose to look at it can ignore it just as well when it's in the longish blob of server logs they don't understand as when it's the only thing in the from box.

As for URLs, people can easily see the URLs and we show them how. I'd agree with you if I thought the tiny extra step to view that information was the problem, but all the evidence I've seen suggests it's really not. For example, on the most recent phishing message I had to clean up from, the senders included a shortened URL* but, I suppose in case someone reported it which is what I did, they also included the destination URL in plain text which went to [random letters].digital/[more random letters]. Neither of these struck the user as suspicious and they cheerfully loaded the site. Seeing where they were going was not enough to stop them in that case, and those who pay enough attention to that to check the URL can also remember to hover over a link to see it.

* One other downside with making mail plain text is the boost to shortened URLs it's going to cause. Many sites are set up such that they have very long URLs. Pasting such things into mails when they'll wrap onto multiple lines will be ugly, so people are going to shorten them so it's less so. Some will make their own link shortener which still indicates where they're going, but many will not be competent enough to do this and will use whatever shows up first in the search results. When everyone does that, it will be a lot more annoying to find out where the average URL goes because, instead of hovering over the link, you have to figure out how to expand the short URL from whichever service was popular this week.

Bot her emails: most modern phishing campaigns are AI-enabled

Re: Heavy M$ component

Neither of those things are about Microsoft. Teams phishing isn't any different from Slack phishing or any other internal messaging system. Calendar invitations are the same whether they're going to Outlook or something else, and they work as long as the email-to-calendar connection is automatic* which is very common in business because manually managing all the invitations virtually guarantees that something will get missed unless you're lucky enough to have a job where events don't get created all the time by many different people.

* The systems I'm aware of tend to mark calendar invitations that came from external addresses and warn about them, but they still appear on the calendar unless you delete them.

That old phone in the kitchen drawer could save an industry

Re: Market for devices past firmware EOL date?

That's kind of true in the narrowest of senses for "true" but completely irrelevant. If you have the power to install a custom ROM, you've got all the power that rooting provides, both over the original software and over the new version you have installed instead. That's true whether or not you choose to root the result and make that power easier to use from the system after you've written it. I think that this power is one any owner of a phone should have if they want it, so I don't mind, but if someone considers rooting to be a risk, then pointing out that you didn't technically root makes no difference when the thing that wasn't rooting was more powerful than rooting would be and could do all the same things.

Re: Market for devices past firmware EOL date?

It would depend how trustworthy the installer was. If the installer was me and the user was my friend, I think they would be fine with that. Therefore, if there was a place that specialized in doing this which we had a reason to trust, that would make sense. Now if you tell me it's an unknown distributor on an online marketplace or an unknown person who operates out of their car, not so much.

ICANN opens applications for new generic top-level domains for the first time since 2012

Re: Are TLDs still relevant?

ICANN gets that small per-domain fee, but they also get nearly a quarter of a million from each place that wants to have one and $24k yearly to keep it. That is quite a lot of money, especially for an organization that doesn't do very much. Many of the created TLDs turn out to be ones that some speculator thought would be successful but nobody buys them. Registries aren't innocent either, but I think ICANN is getting more money and is a bigger culprit than you're giving them credit for.

Re: Are TLDs still relevant?

I think they can still be relevant, but the new ones tend not to be. .com was never intended to be US-only, so I don't think it's a problem that you can get one, and nor do I think you should need to prove connection to a country to be able to register a domain there unless that country specifically wants that. Most of them didn't. People didn't tend to register a .nl unless they had a reason, and the reason was usually that they had or wanted to have a connection with the Netherlands, but I don't object if you think it looks cool so did so anyway. Similarly with .ai and .tv, which both belong to countries that can easily carve out some third-level domains for their tiny populations and prove residency or interest but earn money from the people who like the second-level.

The only utility the new TLDs from 2012 or the more new ones we're undoubtedly going to end up with so ICANN can get more money for... I don't know is that people can have domain names that look more normal until the TLD which looks abnormal. Given the low usage of most of these, I don't think that will be very useful.

Re: I don't think I've ever seen one...

I've seen them a few times. Several of those have been phishing sites. A few ones have been legitimate. For example, the Framework computer company probably couldn't get framework.[something normal], so they went with frame.work. I know a few places which created .dev or .app websites for software, especially open source software. These aren't the most common, but they do exist.

Databricks can't seem to shake authors' copyright claim that could result in 'extraordinary' damages

You're building an argument by considering only one definition, among the multiple ones in common use, for the word "compensation". This is not a way to build any useful argument. Even if you think you're correct, which you're still not, substitute "payment" for "compensation" in their comment and read again because everyone else knows what they were saying, and you do too. Arguing against something they didn't mean doesn't convince us they're wrong.

NASA boss: make Pluto a planet again

Re: exoplanets

The definitions aren't permanently set in stone. They can change. The advantages of having one that covers most of this is that you can better communicate about what you find, and that applies equally well to the Arctic residents reporting back about what they found near the equator. If they have to later adjust a rule about motion to clarify that carnivorous plants that have some limited motion are still plants, that's a far less confusing change to make than if one person is writing about plants and the other animals but they're talking about the same thing because they haven't defined them enough that they agree which is which.

Re: Cleared orbit

No problem, we'll just apply the same logic to geology. Why talk about shale versus schist. That's just called rock, along with all the rest of the hard stuff on the ground.

Australia threatens tech companies with 2.25 percent tax if they don’t pay publishers

Re: Meta packed up its toys and went home

I'm afraid you're once again mistaken about how this worked and appear to have decided based on a preference what the law says and whether it's justified. We'll start with the simple problem. The money for publishers does not go through the Australian government. The law specifically asks social media to make direct deals to pay money from them directly to publishers, punishing them with a tax if and only if they do not do so. With that structure, which was present in the earlier law and remains so here, the claims of "hypothecation" (I don't think that's a word) do not apply.

And since it's structured that way, you are not correct that this does anything about or is intended to do anything about tax avoidance. In my opinion, this is also an inappropriate way to deal with avoided tax. If companies are breaking tax laws, investigate and punish them. If they are following tax law and paying less tax than you think they should, fix the tax law. If you specifically tax companies only in a certain, narrow and poorly-defined industry and leave them a loophole if they sign up to a deal with another company, you have made the tax avoidance problem worse by introducing yet another easily gamed system instead of doing the proper job and defining the tax properly. Do that enough and I start to lose sympathy for the claims of avoiding tax when politicians had the opportunity to fix that and chose not to bother.

Re: Meta packed up its toys and went home

No, it isn't. If that was it, they'd keep the tax. They said the payments were earmarked for media as compensation for the copyright abuses, and they actually did direct payments that way. Even with this one, they're still letting companies opt out of the tax by paying media. This is not about taxation, and they don't claim it is. It is about redirecting funds from social media to news organizations, just as they claim, except they are no longer using the copyright abuses story because last time, Facebook actually stopped them instead of paying and they would have preferred the abuses continued.

Re: Meta packed up its toys and went home

The Australian government considered this a bad thing because they didn't want social media to follow the law they wrote. They wanted to pass the law they now appear to have done, one that boils down to "We're taking money from you because we don't like you [for the avoidance of doubt, I don't like social media companies either], and we're giving it to them because we like them". Facebook refusing to publish news was theoretically one of the options the law gave them, but it was an option legislators really didn't want because it didn't help the media companies, in fact the removal of links probably was a mild downside for them. That's why the results of the laws in Australia and Canada, though they're exactly what the politicians wrote the law to do, are not ones those politicians are pleased with.

Re: State sanctioned robbery

That was the story last time. It is a real problem, but instead of solving that by putting restrictions on how much of an article social media companies could copy, Australia's and Canada's laws went far further by requiring them to not even link to news publishers unless they paid, and Facebook chose the "no quoting or linking to covered organizations" option. Once that happened, the harms you're describing were removed, along with plenty of helpful links, and therefore no longer work as justifications for new laws. The problem faced by both countries was that the thing they enacted wasn't what they actually wanted.

South Africa yanks AI policy after AI-assisted drafting invents citations

Re: fictional citations

I think it's somewhere between the two options. Most LLMs are not trying to do that, and some parts of the process should be very easy, but neither is it as simple as you describe. Even checking the existence of a reference requires figuring out wherever they've stored the paper and whether you can easily just go read it. Do you need a membership to some journal or library which has a copy? Did you not have that but email for a PDF? Was it available to the public but someone reorganized the web server and you don't have a working link anymore? Normal LLMs don't have magic access to those things, even when someone did shovel a copy into the training data.

Checking that the reference says what you say it does is harder. It's less hard when someone's doing the paper correctly; they figured out what the paper did when they cited it the first time and wrote their summary or expansion after reading it. When an LLM does it, it's made a probabilistic guess, and that means one problem for anyone, human or LLM reviewing it and a bonus one for the LLM. The one that applies to everyone is that they now have to read the whole paper, or at least the complete relevant section, to know all the things it said. Finding a paragraph that seems to be in line with the information from the paper is no good if it's preceded by the sentence "We did notice one anomaly with 2% of the input data". If this paper is the kind written by someone who thinks, or whose employer/advisor/reviewer thinks, that long words and jargon makes the paper look more impressive, that process takes even longer. With an LLM checking, you end up making two probabilistic guesses which can both be wrong, allowing an invalid citation to persist, or only one of them is wrong, in which case it's difficult to fix the paper without having started the right way and including citations for a reason.

Re: Checking AI Output

It is. They call it "human in the loop". The way it works is that someone gets the job of reviewing everything the LLM wants to do. Doing this correctly would, in most cases, take about as long as doing it manually, but skimming three paragraphs and clicking approve on each of them takes much less time so that's about as fast as the human will be expected to go. When it finally goes wrong, not only do you have your scapegoat who was supposed to prevent the problem but didn't, you have permission to treat that person in any way you like. Bonus, to anyone not entirely convinced that LLMs are the best, you look cautious because you're not accepting their output without reading it.

So far, it's usually the AI fans who get to decide who has to be and what happens to the human in the loop.

Brussels orders Google to share Android's AI sandbox with the other kids

Re: Apple

I'm not sure Apple has that level of access for anything, so probably not. Under the law, if they also had a control interface for their AI model, they'd probably be asked to open it as well.

Re: Portabililty Between Models

It would be very difficult to get anything like that because there's no defined set of functionality from model to model. That's the whole point; you can ask it to do literally anything and it will parse your request, run something, and give you a result that might have done what you wanted or might have destroyed anything it had access to. You can't standardize the inputs to that when the inputs are theoretically unlimited, and you can't restrict the outputs when nobody's found ways to keep them from going wrong on simple prompts every time, just most of the time.

Locked, stocked, and losing budget: AI vendor lock-in bites back

Re: As AI consultant Haroon Choudery pointed out

Maybe, but that's also a relatively common thing for humans to say, which is one reason LLMs picked it up, and most of the times I've seen it from an LLM, it was used as an intensifier rather than a contradiction like this is. Perhaps we should stop ourselves from taking something as simple as "not just" and jumping to conclusions like bad models do.

SUSE's sovereignty pitch meets an inconvenient $6 billion question

Re: Pan-nationalisation

"I don't know why governmental distros are not a thing."

Because most of the work required to run a distro isn't different for a government, so why should they, and if they change it too much, it's not useful for anyone else so they end up with the maintenance burden alone. What you'd end up with is either something almost the same as another distro or something so different that it gets out of date. The more users a distro has, the more people the cost of maintenance is spread between, and there's usually nothing secret in them so that sharing works fine between governments, businesses, individuals, and other organizations.

AI's not going to kill open source code security

Re: How do they know?

"what fraction of global software doesn't see external users?"

Not only is there a ton of internal code running every company and industry, but even if we don't consider any of that, we have a definitional question, namely when we speak of X% of code, how can we count that? Do we count by lines (impossible for commercial software where source is not public)? Do we count by users (unavailable for many commercial and open source things that don't collect or at least don't report that value)? Do we count by projects, in which case you're going to get far more open source by counting every similar GitHub fork than one product.

The creators of that report have not obtained copies of every commercial piece of software and run tools against it to find open source components. They're using vague numbers based on cursory searches. That isn't a problem as it's true that most of that software does include open source components, but to put a number on it, they'd have to have better answers and more thorough methods than they have. From a user's perspective, it also doesn't matter, because a bunch of programs that are all proprietary but use the same open source compiler would easily count as having an open source component but don't result in any more open source code for the public, and I think that's the perspective that started this thread.

Re: Some is an understatement

That report, and the sources behind it, have poor sourcing for the statistics they provide and those statistics don't represent the claim from the article. When they say that 96% of commercial code includes open source components, they have no way of knowing how many code bases exist and would almost certainly fail to consider many of those that don't include open source components because they couldn't know about them. Not that the number is wrong. While it's probably lower than that, it's still going to be a very large percentage because libraries and dev tools are the most likely things to be open with many companies releasing or contributing to those. That's because those things aren't the thing those companies are selling. The product code that they make their money from is far less likely to be open source.

Pass the key, passwords have passed their sell-by date

Re: Great!

"I doubt that's the case for many banks."

You doubt, or you have any reason whatsoever to think your approaches actually get implemented? The code that would implement them is sent to your browser before you log in, can you find me a single example of a page that does that? One reason you'll have trouble finding that is that the approaches you recommend don't do what you think they do:

"a bank can certainly hash the password on the user's end of the internet": In this case, anyone who has the hashes can log into any account, defeating the original purpose of the hashes which required them to be individually broken.

"and/or send down a bespoke public key for the submission.": Anyone intercepting that communication could replace it with their public key. In effect, that's what TLS does already, and the discussion was partially about what happens if TLS is defeated.

Re: Great!

You are mistaken. The hash is computed on the destination, not the source. One reason is that, if the hashes from the destination were compromised, computing them on the source means an attacker can instantly log into every account by sending the pre-stored hashes. The transmit password, compute hash on destination flow is what is done in almost all flows, from HTTP logins to SSH, and you can verify this very easily by looking at the traffic sent and watching the cleartext password zoom by.

Encryption on that channel means this is often not a big problem, but that and machine authentication of the destination are the advantages of passkeys. Only by knowing the real differences between the methods can you decide whether you think one is better. If you assume that passwords do something they don't, you'll have an incorrect basis for comparison.

Re: Great!

Ah, I see what's happening here. This is a test to see how much a relatively unimportant comment board can stress out people who know what they're doing. We appear to have quite a few people who don't understand what hashing passwords protects you from (recovery of the passwords from the data on the remote service) and what it doesn't (retrieval and replay of the passwords from the ephemeral communication between an authorized user and the remote service) and that there are places that don't hash passwords even though they definitely need to, and all on a place where the readers are generally expected to be knowledgeable about IT. This is one of the main reasons we have security problems: smug people who think "hash" is a magic word meaning nothing bad can happen with passwords if you use it making the same mistakes over and over, whether about passwords or something else. If you don't care about this, that might be sufficient justification, but if you think hashing the password means it can't be seen during communication, then you are wrong and you will be wrong until you learn how it works.

Re: Great!

You know you can generate passkeys yourself, no corporation involved? A service can choose not to support them the same way they can choose not to support any passkeys at all, but the structure does not require any third party at all, let alone whichever corporation you think is mandated. There are a lot of annoyances with passkeys, but there are a ton of people here who seem to think they're something completely different than they actually are.

Re: Great!

How do you think passwords are verified? The hash is what is stored at the remote end, if they're doing it right. Even then, we frequently find that services store passwords in plain text or encrypted but not hashed, you know, services with only a few users and no technical staff like Facebook. But how does the service verify the password when you log in? It still involves the user sending a string for verification on the remote system. Encryption in transit makes interception harder, but not impossible. I'm holding out hope that I'm misunderstanding what you're saying, but it's looking like one of those people who heard about hashing passwords and doesn't know how that works and what it does.

Re: Great!

A passkey can be synced with equal ease as a password and doesn't require any specific service. They are long enough that, unlike most passwords, you are unlikely to be able to memorize them. If you're using a password manager already and relying on passwords you don't have memorized, you are no more independent with your approach than you would be using passkeys.

Cybersec is a thankless job: expanding workload and shrinking pay packet

Re: I beg to differ

Consider that part of the problem might be local effectiveness. If one company has not experienced any incidents, they may not be too worried about someone else that has unless someone comes along to scare them. Corporate leadership don't tend to spend much time reading about security incidents that happened to someone else, especially when compared to IT people who read IT news, so they no little about those incidents, and if they do, they probably assume there's a reason why those companies were attacked and their one wasn't, a reason other than scale and luck. Security teams usually don't think they need to bring scare stories to management because they have the same context as you do and assume management is aware of that. In my experience, it's also seen as unethical to exaggerate threats or speculate about what an attack on this company might look like, the approaches most likely to increase support for adding resources to security.

In the beginning was the Bork: 'Heart of the Earth' exhibit reveals Raspberry Pi in existential crisis

Re: CIRCUITPY

I had the same theory. CircuitPython would make sense for that. In my experience, it can sometimes reboot itself a couple times on connection which rapidly disconnects and reconnects that drive. The interface code tends not to care about this too much, though if it's a serial connection there's more work to handle it than if it's sending HID events. The OS that is trying to mount and unmount things often likes it less.

BOFH: Arrr, I smell piracy ... and it's comin' from a machine with executive privileges

Re: Torrent backups / replication

I think a lot of network admins, at least many I've met, don't care, especially on a guest network. As long as you're not attacking their infrastructure and not degrading their network, a lot of them are content to ignore you. Security cares more when someone does it from the non-guest networks because they have to tell whether it's malware or not, so they're more likely to stop such activity, but usually more to eliminate the possibility of risk than because they consider it a problem worth caring about.

Re: I think most people who torrent use

I've occasionally needed to VPN out of my company's network, albeit into other company or partner networks. You could detect which VPN I've connected to and identify whether it's a trusted one relatively easily, but it's more complex than all VPNs being unexpected.

Dev targeted by sophisticated job scam: 'I let my guard down, and ran the freaking code'

Re: Why would anyone run a "coding test" on their own desktop?

In hindsight I'm sure he's asking the same question. That's why it's relevant to consider the approach, what was done to put him at his ease, and how to be more wary if it happened to you.

There's a lot of friction with VMs. It's not a simple or fast process to spin one up with all the tools you need and keep it around. You have the choice of taking a few hours to install and configure the software you already have on the base machine inside the VM or keeping gigabytes of VM disk images around for next time, the latter more annoying on a laptop and a Mac where upgrading internal storage is difficult or impossible. If you do it lots of times, you may have base images that speed up some of this, but it's still an annoying process that even those knowledgeable don't frequently do unless they think they need to. That doesn't lessen the need for doing it, but I hope we can be honest with ourselves about how often we incur this pain; do you go through this every time you run any open source code?

The benefit of a story like this is as a reminder that preparing a VM for situations like this could be useful and as a warning about how far scammers can be willing to go. Neither the article nor the victim claimed this was impossible to prevent or detect.

Trump to UK: Stop taxing our big beautiful tech corps or face tariff tsunami

Re: Honestly, fuckit

The UK already taxes that. This is a special tax for tech companies above existing ones for any international company operating in the UK. It mostly exists because those large tech companies have a lot of accountants and lawyers specializing in finding every way to legally not pay tax, and possibly some illegal ones but it has not been proven. They have an easier time of that because many of their products are intangible, which makes it easier to define value in ways that mean they're not taxable in the UK.

I still think this tax is a blunt tool which doesn't really fix the problem. The inclusion criteria are too arbitrary and basically just names a couple large companies as the only ones covered, making it quite easy to slip out of this tax for everyone else. It seems that the better approach, identifying the loopholes that are successfully used to avoid taxes but shouldn't be and then removing them, is too much work for politicians. The blanket tax also has international trade problems since it is specifically targeting specific companies from one country, which when others do it is considered a violation of trade treaties. With the US, that's not a major problem as they have already violated every trade treaty in existence so can't hope to get remedies in the WTO when they've broken the rules far more actively and substantially.

Re: Threatening tariffs eh?

Not quite, so far only the first method, the most theoretically powerful one, was ruled illegal. He has a whole catalog of other ways he thinks he's allowed to set tariffs, the second of which is currently in place. That is why there are still tariffs on current trade with the U.S. even as they're trying to figure out what to do about the last round of illegal ones and why there are more court proceedings about attempt number 2, and if those are struck down then they'll move on to law number 3 that looks like it gives some power over this.

Betting shop bug ends in kidnap plot as staff turn ransom artists

Re: whut?

You have some of the details confused. The 90 minutes wasn't from software bug to kidnapping, it was from kidnapping to the police ending the kidnapping. The police report doesn't specify how long between bets unpaid and kidnap, but it does call it "days".

If malware via monitor cables is a matter of national security, this might be the gadget for you

The sales promises add credence to this possibility. They can't tell us what can actually be done over an HDMI cable, but they can promise that their device blocks all the threats. Given the complexity of HDMI as an interface, I can believe that there are problems in HDMI stacks which could be exploited, and if you knew about them, then a device that looks for them and blocks them would guard against those threats although one that looks for them and sounds an alarm would be more useful. But that wouldn't be threat-agnostic unless it simply blocked some channels, and those channels presumably have a point or you could block them yourself. Maybe it's as simple as disconnecting some things that they assume people buying this, who are probably using monitors in an office environment, probably aren't using, assuming that those pathways could be abused somehow.

Thunderbird in hand worth 2 Outlooks as fresh FOSS fave and Firefox arrive

Re: Dark mode

It sounds like they've got a Mac in dark mode but want Thunderbird to be an exception without changing everything. I'm not sure whether that's possible to configure. While in principle there's no reason you shouldn't have that desire and it could be implemented with a follow-system/light/dark setting, they're still taking the complaining too far.

Linux may get a hall pass from one state age-check bill, but Congress plays hall monitor

Re: Putting social networks out of business

Well, I got a surprise today. I wouldn't have thought you would support this or express any of the very bad arguments you've just used. You'd think that someone who covers open source and participates actively in the comments section here where people use pseudonyms almost all the time would understand how many people do not want everything they've ever said tied permanently to their identity and how there are websites that benefit from having comments.