Posts by doublelayer

North Korea using freelance techies to fund missiles and nukes

Oops, someone's missed how they've been focusing on technology as a weapon for over a decade, how two of their top universities are almost entirely technology-focused, how they have acted when they want certain skills (you wouldn't think such an education system would produce people capable of making a nuclear arsenal either, because you forgot that they study physics there as well), and how, a few years ago when they were trying to look more open, there were companies explicitly outsourcing technical work to North Korean companies.

Your summary is accurate for a lot of people, because they don't focus on giving good educations to people they won't trust and they have a large list of people who are to be denied trust, but when someone is found in the trusted group who demonstrates skill with computers, which they have imported and set up in many schools, that person gets doomed to a life of technology-themed slavery instead of the farming or construction-themed slavery a lot of others find themselves in. The country doesn't have millions of skilled IT people, but thousands of people skilled enough to pass an interview and start collecting paychecks, some of whom are actually capable of doing the job, that they have.

A dip in Alder Lake with an HP Elitebook is spoiled by avoidable mistakes

Re: Another another bad point

What's wrong with those? I've got that, the port works with all cables without an adapter, it allows the computer to be a little thinner in case that's important, and the only downside I can think of is that it feels about the size of a USB port and could lead to someone plugging a cable in there if they didn't notice the cut-out on one side. If that's a way to get RJ-45 ports onto laptops that's more widely adopted, it works fine for me.

Re: Photos

"I'd also prefer it if the bloody function keys' primary function was the function key,"

There's almost always a key command you can use to make that happen. Try fn+esc or fn+shift in my experience. They probably do it by default because every manufacturer has removed dedicated volume buttons in favor of fn commands, and those are two keys people are likely to use somewhat frequently. The fact that the other ten consist of maybe three that are sometimes activated and seven that are never used except by mistake doesn't come across.

Re: Bother

Define "better". Both companies have chips that exceed the M1 and variants in benchmarks. AMD has chips that exceed the M1 in benchmark performance per TDP watt*. Both companies have chips for situations where less compute than an M1 is needed and the user values decreased power usage. So do any of these count as better than the M1? I'm guessing you will say they don't, but what is the objective challenge that could be met in order for you to agree that you're willing to accept them?

* That's only one way to calculate performance divided by power, and there aren't great numbers on, for example, sometimes idle and sometimes stressed power consumption for standardized workloads on all chips.

Raspberry Pi hires former spy gadget-maker who baked devices into surveillance ops

Re: Whats the point

Has the news of blocked supply chains not gotten to you yet? They're in high demand and a lot of people have precedence over them when it comes to getting components or manufacturing capacity. I have not purchased a new one in three years due to this shortage, but nevertheless I have a few hanging around. One of them is a 4 (with 2 GB RAM), but all the others are less powerful. I'm not the reason you can't get one, nor really are the foundation that would probably be happy to produce more if it was feasible.

San Francisco terminates explosive killer cop bots

The comic is clearly referring to those laws, including the firm order as set forth in the stories. I don't remember the stories showing what happens in the preserve robot > preserve humans scenario, perhaps because the answer is so obviously bad for humans that it's not worth investigating. Many of the stories also called attention to the weakness of the laws, one which becomes all the more obvious when dealing with either human-like AIs or something with limitations (either technical or artificial) as would be seen if we built robots today. I don't feel XKCD's quick joke either mistreats the original stories or is even all that redundant to them.

It's still there, we're just testing whether XKCD was right about the order mattering so much.

Re: 17 robots unemployed because cops replace them.

"And never, ever would there be 17 such cases on the same day. So what are those robots for?"

Well, not that it's a good idea, but if you decided that bomb-carrying robots were necessary, you'd want some spares because I'm not sure exactly what state one would be in after it detonates its payload. I'm guessing it requires some significant repair if it's not scrapped outright, so the latency between using one and having it repaired or replaced could be a while. Again, not saying this justifies having them, but just as we keep some extra laptops around just in case one breaks and we want to get up and running faster, if you're going to have one robot bomber, you'd probably have some backups for that as well.

Europe's USB-C deadline: Lightning must be struck from iPhone by December, 2024

It depends what chain of adapters you've got, but either it will all support the PD signals and negotiate voltage, or some link will not support them and it will be restricted to 5V with the maximum power output determined by the source device and the actual used current determined by physics. An adapter can prevent charging if it doesn't support it, but it can't choose to overvolt unless someone's deliberately made it to ignore the standard (in which case that's a problem you could have with anything).

Longstanding bug in Linux kernel floppy handling fixed

"It would also mean that the disks would be the same dimensions as regular disks which was handy for storing them."

I really hope they were still easily distinguished, because otherwise that sounds like a recipe for getting confused why this floppy doesn't work in that older standard-only drive. It reminds me of a time when someone mixed a stack of blank CDs with some ones that had been written to, requiring me to insert each one to find the ones with actual data on them. Although I arrived too late to prevent that, I did get there in time to prevent them mixing in the blank DVDs too.

They'll keep making those external drives for a while, I'm sure. I value not having to carry it around or integrated into every machine, though. While they still make laptops with optical drives, every model ends up being a lot bigger and heavier than one that ditches it. I don't use the media enough that going to my closet and retrieving the USB one is a problem.

North Korea hits new low by using Seoul Halloween tragedy to exploit Internet Explorer zero-day

Re: Groundhog day

"Say what you like about DOS, the small size of the attack surface made it much more auditable, and it persists in embedded for this reason. I'm sure I'm not alone in appreciating the benefits of a generic and very compact OS for certain applications."

Well, I have a lot I'd like to say, so I'll get started.

"the small size of the attack surface": No. The attack surface was small because basically every possible attack was accepted. The OS has no privilege system and lets any program that runs on it do whatever it wants. That's not having a small attack surface. That's having no defenses and pretending they're the same. They're not and nobody knowledgeable would equate the two.

"it persists in embedded for this reason": You don't work in embedded, do you? It does not persist in embedded. It exists in legacy hardware all over the place, but it's not used in new embedded hardware. There are a lot of small embedded OSes. Many are RTOSes which DOS isn't. There are several with security features baked in, and some with a DOS-like no limits systems because they only run the one program. Those things are also both smaller and more auditable (and actively audited) than DOS was. If you scale up, there's embedded Linuxes, some use of BSD, and you sometimes see Windows CE or the later Windows 10 Embedded. The only time you see DOS on a new build is if it has to interact with something old that nobody's going to replace, and such things are expensive and very custom-made.

North Korea has hit a new low

If this counts as a new low, you have some weird scales going on. Given the amount of stuff North Korea has done (assassinations with hundreds of civilian casualties and/or biological weapons, one of the largest sets of concentration camps with slavery that's even worse than the normal slavery everyone else has to go through, repeated theft from developing countries that suffer large economic consequences as a result, citizens forced into criminal activity with threats to their families, really boring propaganda that only tells us where King Kim Idiot was last week), it's hard to know what would really lower the bar.

KmsdBot botnet is down after operator sends typo in command

Re: re: Agile development.

Does waterfall exist? As far as I can tell, waterfall is a word meaning "Something the Agile people don't want to be associated with Agile". In fairness to Agile, I'm not sure it exists either. I think most places that claim to use Agile do whatever they want with some of the words used. Still, it's weird to see so many people arguing how great Agile is while telling me that everyone I've seen calling themselves Agile while getting bad results is not actually doing it and defending any part of the manifesto that suggests negative things as not meaning what it says.

Re: Don't work have you turn it on and off?

I would think so, but as it was attacking Linux boxes, probably many of them are servers that people don't reboot very often unless they're broken. The authors of the bot don't get to reboot them themselves, so they'd have to hope that operators will coincidentally reboot sometime soon unless they're willing to be active and go re-infect each one.

Re: No Go

It's not about types. Unless you strong type to the extent that array types have their length hardcoded, you can have an out of range error, and even if you do, you can still have the parse error that led to the problem in the first place. No compiler can fix "There were fewer spaces in this string than I expected", but an if statement can.

I'm sure they will, but they'll need to go back to the old infection vectors and there may have been many different ones used which they'll have to disentangle from logs (probably there are logs, but not necessarily in a convenient place). Also, any infected machine that hardened their SSH config or passwords but didn't scan for infection may not be infectable using the old methods. Not perfect, but it is a setback.

Women sue Apple claiming AirTags helped their stalkers

The cost probably doesn't, but you can put on a module to connect to a phone network and send the data in SMS or use the existing WiFi in the mentioned chips. The mobile system will cost more including service for it, but battery life won't be increased much if the data is stored and the device briefly enabled to send it in a batch.

Also, it's worth considering that the anecdotes we've seen haven't involved someone being stalked for months on end. A lot of the stuff that's come out has been short-term stalking over hours or days, for which month-long battery life is less important.

Re: What's that?

How far does that need to go? The AirTag has been in existence for a year and nine months by this point, and its release and the controversy about misuse has been extensively covered here and elsewhere throughout that time. At what point does a fact become covered enough that summarizing it becomes redundant? If the article also paused to explain what an iPhone is, I would be bored with the unnecessary information.

Also, I note that the article did briefly explain what they were. For example, the third sentence contains this phrase: "concerns surfaced about how the coin-sized tracking devices could be abused". That's not a detailed review, but it should at least answer the question "What is an AirTag?". The article also links to three earlier El Reg articles covering the controversy and points mentioned, any of which would give useful background to the uninformed reader. Why are these things not enough?

Re: What's that?

I'll answer your question, but if you want to know what an AirTag is and haven't heard of it, you could always read the Wikipedia summary of it.

An AirTag is Apple's version of a Bluetooth tracker, similar to Tile or Samsung tags if you are familiar with those. You attach the small unit to something you want to know the location of. If it's nearby, your device interacts with the tag to give you location information such as making it beep or showing you a map. Because they're using Bluetooth, they also have a feature that uses other people's phones to look out for a tag that's not connected to your device, such as on something you've left elsewhere. The other person's phone reads an ID number from the tag and reports its location, so you can get a report of where the tag and hopefully the item you connected to it is now even though you are not nearby.

Since it can report the location of something you're not near, that could also be something that doesn't belong to you, like somebody else's car. The concern is that someone who wants to stalk a person could use this device to report on their location via iPhones around them. Apple has put in some safeguards to make this harder, but they're not about to make it impossible because that would break the product idea. That should bring you up to the stuff in the article, although if you want more details, there's more in the second part you didn't read and some older articles about the issue would be relevant as well.

Re: No iPhome ==No stalking

"Am I correct in my understanding that the tag initiates a Bluetooth connection with a device that I might own and creates a channel through my device without my instigation or permission?"

Basically, yes. It's not a direct connection since it's sending out a beacon, but the phone would see that and act on it automatically.

"Isn't behaviour like that covered under various computer misuse statues?"

Not if you agree to it in the EULA, and you can be assured their lawyers put something in. It only runs on iPhones, and iPhones only run if you agree to the license. I'm unaware of any related laws that require more specific consent for such things, but you'd need one in order for the process to be illegal.

"Can it be turned off?"

Yes. On IOS devices: Settings -> Apple ID -> Find My -> Find My iPhone -> turn Find My Network to off.

If you're willing to spend money on the problem, there are devices designed to get around those obstacles. Devices which can be attached to a car and draw power from it, devices designed to run intermittently to extend running time, particularly efficient devices that run for longer than consumer-grade navigation chips do, etc. Not that you can get something standalone as efficient as an AirTag, but they're not as limited as you might hope.

Washington DC drags Amazon to court for 'yoinking' driver tips

Re: Tips?

As far as I can tell, the tipping system works as follows: someone decides to hire people but pay well below what they otherwise should, and they label this with a tip box on the interface that people correctly translate to "You wouldn't want the person doing the work here to be paid almost nothing, but unless you give money here, they will". Then that box never moves, even when things change such as wages increasing or the company deciding it will make the part they pay dependent on how much tip there is. In the end, the user has no clue how much the person will get paid if they don't tip.

On a side note, I ordered some electronic components from a small site about three years ago. After selecting my components and paying for rather expensive shipping given this was before the COVID-snarled transportation times, I was brought to a page asking if I wanted to tip. I don't know who would have been paid if I selected to do so. I wonder how much free money they got by putting that option into their otherwise completely standard online checkout process.

Apple brings DIY fix-it store to Europe, UK – with gritted teeth

Re: "the cult of HIS HOLY STEVE"

No, it's multiple independent religions with crazy adherents, but this time the lawyers forgot to include the "Thou shalt have no other gods" clause so some people subscribe to both. Still worth pointing out that some people might use the products of one without believing that the company can do no wrong and often aren't forced into changing that view; work that into the analogy if you can.

You get the internet you deserve

The junk can stick around a long time depending on what it is. Search for any reasonably common technical issue and you'll find lots of articles that are years old and weren't very useful at any time but are still in the search results and have ads on them. That page has a long lifetime. Other farms might opt for something that lasts a shorter period but attracts a wider set of people, but there will be plenty of people who will put up with the long game of finding something people will always search for and publishing as many keyword-filled posts of dubious usefulness about it.

Re: Natural born citizen

Yes, the U.S. and many other countries in the Americas have birthright citizenship, and such people would be eligible to be president. The restriction basically translates to "You have to have been a citizen of the U.S. from the time of your birth. If you were naturalized, go away". Being born outside the country but to parents who bestow U.S. citizenship also qualifies someone under the restriction.

Neuralink reportedly under investigation by Uncle Sam for 'animal welfare violations'

Re: In memoriam, Michael Crichton

"When does the report come out that the sole human test subject was given a nuclear battery to power his implant?"

In fairness, that wasn't a sign of cutting corners in the research. At the time the book was written, plutonium power systems for pacemakers were being used in some patients because it decreased the need for surgeries to replace dying batteries. Neither batteries nor surgeries were as good in 1971 as they are today. The researchers in the book did a lot of things wrong, but the nuclear battery wasn't one of them.

Get ready for $10,000 apps in Apple's software souk

Re: Why have a $10,000 limit at all?

If such software is made, it won't be sold in the App Store. One of three things will happen:

1. It's sideloaded through a corporate certificate requiring a profile to be installed, based on a corporate license. It won't be listed on the store at all. Any price can be charged for the company to set up the profiles.

2. A free client app will be listed on the store, and it won't do anything unless it verifies that the user is licensed through an external mechanism. Any price can be charged for that external license as long as the user can't buy a license inside the app. If they're paying over $10k for it, they can buy a license with a browser or likely something even more complex and activate it inside the app.

3. The app is actually free because it's only useful with the purchase of some expensive equipment, desktop or server software, or continuing service, for which the developer charges whatever they want.

Stack Overflow bans ChatGPT as 'substantially harmful' for coding issues

The AI is only as useful as people find its results. If people start valuing art generated by AIs over that generated by humans, then things don't look good for artists. If AI starts generating code that solves real problems for businesses, not great news for developers. Neither has really happened yet; AI art looks cool and has been used, but people still value the work of human artists, and code produced by this tool correctly answers some basic tests but it hasn't spat out any of the tools companies hire programmers to make. If it gets to that point, the situation will change whether we want it to or not, but the fact that it's proven incorrect enough to need a ban from a site where wrong answers are already common indicates it's not happening just yet.

Re: re. How is a resource that frequently provides wrong answers useful?

"1. if a (relatively small) number of randomly pulled answers is wrong, how many more, %-wise, do you need to verify, to label all (?) of it 'useless'?"

To label all of it wrong, you need to prove all the answers, 100%, wrong. To label it useless is subjective and that's your next question anyway. Something can be sometimes right but still useless, such as flipping a coin to decide whether it will be sunny or rainy tomorrow. It will sometimes be correct, but that's not worth keeping.

"2. what % of 100% verified answers must be wrong, to decide the whole 'thing' that generated them is 'useless'?"

It depends on your tolerance for confusing the people getting answers, but my bar would be very high. If 80% of the answers are correct, that still leaves one in five answered inaccurately which means that the average user who asks a few questions will get a junk answer pretty soon. If you expect users who get unreliable answers to leave and not return to provide their own answers, that is harmful. If the wrong answers are coming in fast, this also prevents someone from getting to and removing or correcting all the wrong answers, meaning that fewer people would come to the site looking for answers because they expect them to be possibly wrong and may not have the skills to know automatically whether they are or not. 80% is too low for a correct threshold. For something automated like this, probably it has to be in the high 90s. Maybe 95% is acceptable, but maybe it has to be higher. I wouldn't try lower.

"3. who decides this %?"

I'd say the operators of the site, based on the moderators they need to keep things functioning. They are the ones who are responsible for it working and will suffer monetarily and by reputation if it doesn't.

"4. on what basis?"

They get to the decide on the basis of "It's my site you're using" and make their choice on the basis of "What do I think best serves the users of the site or my reasons for running it".

Meta threatens to stop sharing news in USA to protest publisher payment plan

I agree with you that a strong independent media sector is important, but I'm not as convinced that this law does anything about it. I hate Facebook a lot, and if we just decided we'll take their money and give it to someone more deserving, it sounds great. That's not how laws should work though. The major question is what Facebook is doing that they shouldn't be. If that's quoting snippets of articles, then let the law forbid or regulate that, but in that case, Facebook responding by no longer quoting news stories should also be an acceptable result.

As I see it, the law currently has the problem that it also includes linking, not just quoting. It's structured as if to say "linking and quoting is wrong and you should pay if you do it". However, if Facebook responds by no longer doing what the law says is wrong, that's not the answer people hope for because they no longer link to news stories. The law could be changed to only include quoting, and that would probably lead to a better result (Facebook no longer allows quotes but still links people to news sites which can then collect advertising), but the writers of the law don't appear to want to go that way. When Facebook responded by blocking news in Australia, the politicians who passed the law that made that necessary protested that Facebook stopped doing the harmful thing they were just complaining about. If this law is intended to punish, it should be specific about what things are being punished, and no longer doing those things should be as good an outcome as paying money while continuing to do them.

TSA to expand facial recognition across America

Data will not be kept except always

By their own admission, they plan to send the data they collect to somewhere else in the DHS system for unspecified purposes. The only step necessary to do this perpetually is to not end the "evaluation" period that allows them to do it. I doubt they're currently planning anything particularly nefarious with it, which doesn't matter because as soon as someone comes up with a way to use the collected data, it will all be right there. Facial recognition has proven in many tests, conducted in a lot of countries and a wide range of environments, to be crap at getting useful results and great at creating privacy violations, overreach, and artificial discrimination. It is not needed here and is likely to cause significant harm.

Telecoms networks could provide next-gen GPS services without the need for satellites

Re: increased positioning accuracy is deemed to be worth the cost

You're right about that, but the OS could be designed with more granularity to prevent abuses. The problem is that an app given fine control of Bluetooth hardware can, in some but not all cases, determine location. Here are some options to help with this:

1. Provide more options for apps to do something with Bluetooth that don't require full control. For example, if they're going to connect to a single device, have the OS do the connection and just give the app the one connection to work with. That app will not have the ability to scan around for beacons and therefore couldn't track location.

2. Split the permission. Just because an app really needs full control of Bluetooth doesn't mean it should automatically have access to satellite navigation receivers too. One permission could be "Fine Bluetooth WARNING may leak your location", with the other permission separated. If I allow an app to use my Bluetooth hardware but I have no beacons in range, it won't know where I am. If I'm forced to let it have all location access, it will get that data no matter where I am.

Just because full control of Bluetooth hardware can leak location data doesn't mean we can't improve the situation.

Programming error created billion-dollar mistake that made the coder ... a hero?

Re: it was impossible for anyone to track down the idiot responsible

If you're not sure why it's there but there might be a reason, find the person and ask. If you are sure it is not necessary, no need to find them just to blame them for having it. Unless it looked like deliberate sabotage, it was likely a mistake and their response about it will either be "I don't remember it" or "I don't remember it, but you're right it needs to be taken out".

Re: touch-typing vs high-speed hunt-and-peck

I don't know about your experiences, but I do know it's impossible to know exactly what happened just by knowing what keys you pressed. You can't be 100.0000% sure that the keyboard didn't accidentally swallow your key press (I have one where the S key doesn't always work unless you press it straight on, for example, and probably requires a cleaning). Or you could have a laptop with that annoying trackpoint in the middle of the keyboard (I know some of you like it, but I don't) or a trackpad that interpreted your palms as fingers and moved your focus. This doesn't mean you have to look at the screen, but it means that typos will remain a possibility either way.

Re: Pages and pages of old code commented out

In which case they go to the version control, rewind until the comments come back, copy them into the specifically-named files they always should have been in, and give a lecture about how to organize code that runs into files that compile and are labeled for what they do. For the same reason that printing out a copy of the code and putting it on your desk doesn't count as having it available for use, storing necessary code in comments that won't ever run unless an undocumented manual procedure is followed is also not the way to do it.

Re: Worst code I ever saw...

This is good as long as you're careful always to make it look different from a real line that's been commented out when debugging. Lines like that lead a later viewer (it's always future me if I've done it) to think either that the code should be running, or more likely that it failed and was replaced, so it should be stripped out to avoid confusing future future me.

# Repeat: this means that a equalled b eighty lines ago and still should

is better than a line that might look like code.

Re: Worst code I ever saw...

"Gone are the short 1-2 letter variable names, and hello lots of commenting. It'll help down the line"

Have an upvote just for the elimination of short variable names. That's one of the ways of making code illegible that I hate most. I remember one occasion vividly where this was a problem. I generally like Python as a language if performance isn't critical because it is often readable, or at least I think it is when I'm writing it. However, they have one syntactic mechanism I'd like to see stripped out. When importing things from other modules, you can rename it to something shorter. I had the misfortune to find a codebase where they decided to rename every external resource with a two-character name and then use more two-character names for all their variables, leading to lines like this:

if not (ri.open(fx, fn, enc(lt[xu:xv]), os.path.join(cd, n)):

This code wasn't even a normal program or script, but was operating some hardware over a serial link to a microcontroller that had a restricted set of communications. Instead of writing something to handle that protocol abstractly, they built error checking into everything they ran based on the serial error codes which were sometimes based on the command you just sent and sometimes not. Making any productive changes to this took a lot longer than other projects I had.

Windows 11 still not winning the OS popularity contest

"my bigger concern is that a hacker remoting-in can disable the TPM as I did: it's just a regular setting which may have the effect of disabling or even doing a reset of the hardware sync that allows everything in Windows 11 (and possibly win 10 on a shared platform) to function."

If they're trying to do a lot of damage, they have other ways to mess with the user than trying to turn off the TPM. It looks like you need local admin or BIOS access to turn that off, so at that point you could trash the registry, the boot sector, or just run pre-built ransomware. The latter has the advantage of a possible payment to the attacker even if their main intent was causing damage. Those methods would probably be more reliable at causing damage to an individual machine, and if they want widespread damage, it makes more sense for them to do nothing to the machine while using it as a beachhead for spreading to other targets on the network.

I concur with your assessment. It's incorrect to describe 11 as particularly bad. In many ways, it works the same as 10 did. It has some new features, and for me none of these are at all important. The main reasons it hasn't been adopted is that perfectly functional equipment can't have it, so most companies don't necessarily need to roll out an update that won't cover all of the devices they manage. And that there isn't anything really gained by doing it. Maybe 2025 will bring changes, but given that Windows 7 is still represented, maybe that won't do much either.

Working Apple-1 'Byte Shop' computer expected to fetch $375k+

Re: A "clean and unused" prototype Apple-1 that actually works

I stand corrected. I missed that somehow in my first reading. I'm still not sure how they could be certain it was unused before it was restored, but they can know it's running (for now, but I wouldn't hold out a lot of hope for it having an enduring continuing run). I doubt that will matter though, as it's still unlikely that someone will buy this in order to turn it on.

Re: A "clean and unused" prototype Apple-1 that actually works

They're playing the odds that nobody who is willing to pay that much for one would ever plug it in. If they do and it lets out the magic smoke, then they can blame the damage on the buyer. My guess is that "working" translates to "there's no obvious reason on visual inspection why it shouldn't be working".

Mozilla, Microsoft drop TrustCor as root certificate authority

Re: Trust and CA's

"Who are *paid a lot more* and sit in suitable governmental position. Like a subcontractor to DoD, like in this case."

Please reparse the original statement. Who are the "people who know a lot more"? It's not the issuing CA. It's the browsermakers or OS cert providers. The people who knew enough to detect dodginess, were paying attention to figure it out when I and I'm pretty confident in saying you, were not diving into this company's actions, and the people who took the action to block it. Even though I work in security and I'm guessing you have a technical background, I have not studied the administrative background of CAs, which these people are doing. Yes, they know a lot more than a lot of people, including us.

Re: Trust and CA's

"Universally trusted and known" in reality boils down to "trusted by Google and Microsoft and Apple (and some IT security experts)".

Well, yes. The problem with certificate trust is that the average person or even the generally technical person doesn't automatically know what's trustworthy, so people who know a lot more about that provide a prebuilt mechanism that answers that question completely and can be changed to fit the desires of any user who wants to do that.

Just as we assign the job of deciding whether medicines are safe to people trained in pharmacology and statistics, and in most cases take their word for it, the decision over certificate trust can be made by experts. People are free to do something either set of experts hasn't reviewed or approved, and sometimes it will be fine, but sometimes it won't be. If those experts have gone far enough to recommend against something, they probably know what they're talking about.

Re: Trust and CA's

"I have exactly *five* CAs enabled in my browsers. Save for a US government website a few weeks ago, it's been more than five years since I needed to enable a CA."

So you've had to enable one five times. You know what you're doing when you do that, but most users do not. If they have to do something five times (per device and browser), it becomes a thing they expect. Not to mention that some people use a lot more of the internet. I routinely visit sites hosted in a lot of countries, usually small personal sites by people running technical projects. As geographic and linguistic diversity also brings CA diversity.

There is no harm in you disabling all the CAs. There is some in doing that to people who won't know what that means and might be trained to bypass certificate warnings by doing so. Browsermakers are better at judging certificate trustworthiness than a child who only understands "If I press this button, the site loads" or adults who in my experience manage to understand even less and damage more.

"I can't be bothered to look now but there is, in Firefox's certificate store, a CA cert from some sort of Turkish bank. Take a look under "T"."

Challenge accepted. I think I found it:

Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK

I don't speak Turkish, so this looks like a lot of scary words. Let's see what it translates to:

Scientific and Technological Research Council of Turkey

That doesn't look like a bank, but maybe it's a front for one. Let's see who runs it: www.tubitak.gov.tr. So not a bank. A part of the Turkish government. Now maybe we don't trust the Turkish government, but there is a difference between that, a bank, or every bank out there. Incidentally, that is not the only one run by a government entity of some sort.

‘Mother of Internet’ Radia Perlman argues for centralized infrastructure

Re: Broken? No thanks.

"I'm 99.9% certain that I can speak for us on this matter, especially seeing as TINU."

Well, apart from my not having a clue what "TINU" means (I doubt it's Tubulointerstitial Nephritis, and the only relevant acronym I could find online was "totally incompetent, not useful" which doesn't really fit either), I don't consider you to have that right. You're a pseudonymous person online. I only have your word for it that you were around for early experiments with the internet, and since I don't know your identity, I also don't know what your role was. If you had a minor part which allowed you to see the early experiment, then I wouldn't assume you know the views of all the groundbreakers. Let's assume that you had a central part. I still wouldn't assume your opinion is held by everyone else who could have expressed such a view a lot more strongly had they wanted to.

If you really did design the internet, thank you for it. It's not perfect and it never will be, but I doubt a redesign would really fix the issues that we face with it anyway, since many of those are political or economic rather than technical. Like all of human invention, it will be a mess of different standards, attached together with tape, with bits falling off from time to time, and still providing more by its chaotic availability than it would being stuck in a quest for unachievable perfection. Although if you have an internet 2.0 plan lying around, maybe we can consider spinning up an experiment of that one for a possible replacement or at least some cross-pollination.

Re: So this is a political site now?

Not only that, but they're attributing the views of the speakers to the views of the author who covered them. Two people spoke in opposition to blockchain in some ways, ways that I note aren't entirely compatible with one another, and therefore they think the author must agree. They have weird ideas of politics and journalism.

Domain aging gang CashRewindo picks vintage sites to push malvertising

Perhaps, but how many people set it on an autorenew? This came up when someone suggested Twitter would lose the person whose job it is to renew theirs (it expires in January) and El Reg's expires in four months. Still, I doubt anyone has to manually renew either, so probably many people have set theirs just to automatically renew each year and doesn't need a ten-year buffer.

Re: I wonder.....

It still redirects here and will at least until March. Given the low cost of .uk domains, I wouldn't expect them to let it lapse any time soon.

Re: There is a simple way to stop malvertising forever

"There is a simple way to stop malvertising forever: disallow javascript and tracking in ads."

Sorry, that helps with a lot of stuff, but it doesn't stop malvertising entirely. You can still have malicious ads that are static. The ones I hate most are the ads with fake download links because they're the only one I've ever seen working. I was instructing a family member to download some software from a link I sent them, so I knew the landing page was safe, but I didn't know that it had Google ads on it and this family member wasn't blocking them. They clicked on the ad's download link instead of the real one, got an executable, and installed it. Fortunately, it was just a different company's commercial product they hoped he'd buy, but if it was malware, he would have been infected. No scripts were required to deliver that, which is why all ad servers remain blocked.