Posts by doublelayer

LockBit suspect cuffed after ransomware forces emergency services to use pen and paper

Only if the system is written to associate names with photos. This system, on the other hand, appears to do it the other way around, so posting photos of other faces with your name attached won't prevent them from connecting two photos of your real face and correctly naming you if there's enough data. Their database would just think there are a lot of others sharing your name who look different. Theoretically, you could upload a ton of photos of you each connected to fake identities, but that requires giving them a lot of data and the creation of the fake identities isn't as easily automated.

Go ahead, be rude. You don't know it now, but it will cost you $350,000

No, it means the code was probably written wrong without having to store it in cleartext. The following workflow would accomplish this bug without storing a cleartext password:

Enter old password

Enter new password

If old password doesn't match hash, report error.

If old password doesn't match rules, report error.

If new password doesn't match rules, report error.

Hash new password and store it in database.

It just has to run the rules against the user-entered string, which it already has because it will check it against the hash. For all we know, the coding error could be even more basic. My version has a statement run twice when it's only needed once, but it could also be that it was only being run once but on the old password instead of the new because someone mistyped a variable name. That version could in turn be changed into my version when the "Isn't checking new password against rules" bug was fixed by a lazy developer who put in the necessary statement without removing the erroneous one.

You're right, I did that wrong. Still, with 350 machines instead, it's still not a number where finding another supplier if your other accepted one couldn't would be difficult. If you were refreshing thousands of machines at once, it might be a bit harder to do at short notice.

I could see it happening for a few reasons.

First, it wasn't "just because of a personal disagreement", though that definitely didn't help. If the change needed to be sold to someone else, it could be done as "failure to make repairs specified in the contract, necessary to continued functioning of the equipment, and after repeated requests". That sounds a bit worse and can get others to accept it.

Second, it's a big figure, but that's about 35 laptops. We're not talking a massive company here. The person doing this could already have been at a high enough position that cancelling the contract could be in their authority. If they couldn't find anyone else to provide replacement laptops at a comparable price, there could be problems, but they're often interchangeable and with multiple available suppliers. They may already have planned for multiple suppliers and the change just involved switching some orders from approved supplier 1 to approved supplier 2, which would likely have gone through without issue.

Twitter, Musk, and a week of bad decisions

Re: caused Musk to ban "impersonators."

It usually involves choosing a username that looks like it might be correct but isn't, such as replacing characters with ones that look similar or padding it with something that would be logical, then relying on people who previously associated the check symbol with the account having been verified as correctly representing the person or organization it claimed to.

Re: I really don't understand the 50% workforce, 80 hour week thing...

That stuff has been decentralized. You can set up lots of turnkey open source services that do those things. Take Zoom, for instance. I have a server running Jitsi, an open source videoconferencing system. Mostly because when I set it up for 2020, I never shut it down, but it does still work. That's not the only option for that service. All you have to do is use one of those instead of using the free services that have some degree of support, don't require technical people to set up, and don't charge you for bandwidth. Is it that surprising that the average person isn't rushing out to copy my Jitsi server? When there is a person who wants decentralization, the software is often there for them to use.

Also, do you really think Musk has the knowledge to write an RFC and protocol at all, let alone one that is designed well and scales correctly? I wouldn't count on it.

Re: Publicity isn't always good

"Content producers using twitter to reach customers would find $8 a month to be a huge bargain to promote themselves."

You appear not to understand what the $8 is for. They already have a program doing what you suggest. It's called advertising and it costs a lot more with more controls. This program doesn't do the same things and does not offer the possible benefits that posting ads does.

Musk tells of risk of Twitter bankruptcy as tweeters trash brands

It can be done legally, both in the U.S. and elsewhere, but generally with a lot of agreement. You can't legally require someone to work that many hours, but you can require them to do enough stuff that they would have to and specifically indicate that they're earning a salary and it's not about hours worked. If they didn't know that was coming, don't expect them to put up with it for too long, especially if the law specifically says they can quit with no notice at all.

As for advantages, there are no advantages. Two people working normally accomplish a lot more because they don't spend a quarter of the time looking at the clock and thinking about how much they hate the person who hired them, then burn out in a few months. The only time where it helps to have one person paid really highly for really long hours is when they have especially rare and needed skills and you can't find a second person who knows what they're doing or if you do, it would take too long for them to ramp up on things. That's not Twitter's situation, so they're just going to get a slight performance increase for about three days before their engineers start slowing down for survival and to make time for the many interviews they're undoubtedly on.

Re: Let this sink in

You're going to need to better define what losing means. Since Twitter's now his, the only ways he couldn't survive at Twitter is if he sells it (good luck finding anyone who wants to buy it now), gets it taken off him in legal charges (not likely and they would take forever), or dissolves it (which also takes a while). However, he could easily destroy it within a Truss. He'd still be the owner and operator of a thing called Twitter, but depending on how badly he manages to screw this up, it could be unrecognizable. I wouldn't have expected it to be that fast, but the number of things he's broken in a couple weeks suggests I gave him more credit than he deserves.

World Cup apps pose a data security and privacy nightmare

Re: How is it going to get your contacts, location, etc.

"Does the app refuse to operate if it can't grab your contact list?"

That'd be an easy way to do it. Anyone who installs this in the first place is willing to accept dodgy software in return for getting into the events, so how many will cheerfully install and activate the app but balk when it demands access and won't work without it? They might not even know about that until they install it in preparation, having already paid for their Qatari lodging and whatever tickets you need to attend.

You're correct about it continuing to spy on you, although I'll point out that you wouldn't need a full rootkit unless the user did a factory reset of their device and a lower-level exploit that doesn't change the system partition would withstand an app uninstall. I don't think they will use either, though. Still, they will be able to collect a significant amount of information while it's running, so even without a beachhead on the device, there's information about you which can be used to drive further attacks if they're motivated to do so. If I scrape your device's common storage and any data I can get by making the user accept permission requests, that's useful in targeting users later or selling to interested parties. I'm not really sure what Qatar would actually do with it, but it's not likely to be good.

Re: Nokia rules!

It sounds like they would not let him into events without the apps to serve as tickets, but he would probably be freer when traveling around the country in general. However, IMEI and IMSI numbers could still be logged and shared, so freer doesn't mean invulnerable.

GitHub's Copilot flies into its first open source copyright lawsuit

I think Microsoft should and probably will lose this fight as well, but some of your accusations are a bit weak.

"At least now we know it [the acquisition of GitHub] was simply to make the theft of all those resources easier for them..."

Come on. It's publicly available. I can clone all of that. It doesn't take an expensive ownership and operation to point a downloader bot at the site and start cloning all the repos meeting some criteria. If that was their reason, not only did they start their evil plan years before they started using it, but they've come up with the least efficient heist ever. This suggests their reasons were probably unrelated, given that they can and did get training data for copilot from locations they don't own.

BOFH: Don't be nervous, Mr Consultant. Come right this way …

Re: should we call time on the BoFH?

Why, though? I think it's aged well, with modern articles still being relevant and enjoyable. If you don't like it, I'm curious what you see as changed since you appear to have been a fan for quite a while. The most logical complaint I can guess is that it got repetitive, but I find that the articles are a lot less repetitive than certain comments advocate (those people who think someone needs to be killed in every episode, for example). I could see some ways it could be taken in a bad direction, but I don't think those have happened or are likely to as long as Simon remains in control. Your question implies that you have critiques, and I'd be interested to hear your views.

Re: the other side

The solution to this is to have the tech people from both sides do a preliminary examination of what will be needed. Don't let sales just write a contract without knowing what work needs to be done or what money needs to be paid.

It's an issue in either direction, although the example in the article is usually worse because it indicates that the business is one of those whose business plan is hiding charges from customers until it's too late to change course, which is justifiably hated. I presume there are contractors who use that as their business model (I've not had to run a transfer like this, fortunately for me), but I've certainly seen other businesses who take advantage of this tactic. The ones who quote you a price, and you find it acceptable, and the legal paperwork that you get to see doesn't mention other costs, but when you're just about done with that, they bring out the other fees.

NTT claims it can stop the noise leaking from annoying people's headphones

Re: Communicate with people around you?

That is probably more common than not, but I am a fan of open-ear designs for some cases. When traveling outdoors, I prefer not to obstruct my hearing when it could be important for safety. When working closely with a small group together, I like being able to hear if a discussion starts so I can take part (although this is less common than working next to people who I don't want to hear). There are also other occasions where having the ability to hear the world around me and the feed from my device simultaneously can be important or just desirable.

Re: Can they also stop ...

I imagine the loud music does get people to drink more given that all chance of useful conversation is annihilated, but in my experience, it also deters repeat visits as conversation is one of the nice parts about going somewhere with friends or colleagues. If I'm enjoying myself, I'm more likely to want to stay and keep ordering things.

Theranos founder Elizabeth Holmes's arguments for new trial deemed spurious – just like her tech

Re: Jailbirthing

They're not likely to leave the baby in there after it's born, you know. As for the mother, it is a place for them if they're convicted criminals, and she is. Pregnancy isn't an escape mechanism. If the prisons don't have the ability to look after someone with those medical needs, then they're either not intended to and she'd be sent to one that has the required facilities, or the prison isn't fit for purpose, but in both cases, that's a possible problem with a particular prison, not a reason she should be exempt from anything.

Re: She better be careful

You won't get any arguments from me about the people who gave her money being dumb; there's a reason she got no investors who knew anything about the industry. The rest of your claims, however, are complete rubbish.

She was a student when she recognized the existence of a problem. She didn't have any knowledge of how to accomplish what she wanted. It's like me saying "I've discovered that it takes a while to fly on planes and faster ones are really expensive. I know, let's build a cheap faster plane". That's all well and good, but I don't know how to build a cheap faster plane and she didn't know how to build a blood testing machine that worked on smaller samples. After trying to build one and recognizing that she didn't have a clue what she was doing, she started lying about it and submitting fraudulent documents to investors to steal their money, knowing the goal was not being achieved. Until that started, she was just stupid, not a criminal, but it only took a few months to make the switch.

Re: Jailbirthing

I'm not sure what your point is, but I hope that this both stops in those facilities that weren't meeting these basic standards and that the facility she goes to already meets those standards. It doesn't change the fact that she deserves to go to jail.

Instagram star gets 11 years for $300m email scam plot

Re: Fraud - Not just BEC

It's kind of hard to find a scammer who isn't hurting anybody. Usually, when someone says that, they mean "isn't hurting anybody I care about", and the statement says more about their lack of caring than about the scammers lack of harming.

Swiss Re wants government bail out as cybercrime insurance costs spike

"Cybercrime losses are exploding because of the ease of transmitting ransom payments across borders."

This is your problem. You see cyber insurance as paying ransoms, which sometimes happens, but that's not what it's mainly for and that's not what causes most losses. That insurance pays for a lot of things other than ransom payments, and some policies have been sane enough to prohibit paying those at all. They pay for recovery from damage. They pay for investigation of an incident. They pay for losses like having to pay for credit protection or liability for people whose data was stolen (theoretically). These things will not be stopped or shrunk meaningfully by stopping ransomware, and banning Bitcoin also won't prevent the most damaging ransomware either. You are looking only at one aspect of the problem and come to inaccurate conclusions on your limited understanding.

Not exactly, though there are parallels. As the comment was written, it was a "we should ban assault rifles and there will be no more violence" argument. That is false, and using a lie to make an otherwise functional point harms an argument very badly.

I'm not going to argue a position on guns, as it's not relevant to this conversation, but the point with guns is that there are uses for them other than committing murder, and one has to balance those uses against the benefits from banning them. That can result in "no guns at all", "all guns at all times", or somewhere in between with specific types allowed and others not. The same applies to cryptocurrencies or anything else you name, since every item will create harm to somebody in some way. The general point is not viable (we could prevent the need for cyber insurance much more effectively by banning computer networks, but if I argued that we should, you'd reject it as the unworkable plan it is).

The argument was based on a fallacious statement, suggested a plan that is not viable, and did not attempt to address the ramifications the plan would have if implemented. I contend that it is simplistic to the point of incorrectness.

Re: It's not the insurance industry

I disagree. They definitely need to mature. Insurance has to calculate risk. That means that, for example, many insurance companies won't insure a property that's been smashed by the same natural disaster several times, is at high risk for another one, and has no precautions taken for when that happens. They've calculated that they're likely to have to pay for a very expensive repair and that nobody will pay a premium that would pay for a new house every three years. This doesn't please the owners of that property, but the insurance companies can decide whether they're willing to take the risk. They need to apply similar logic to whom they'll insure for cyber risk and what they'll do for them.

The most famous occasions have been ransomware, so I'll use that as an example. If the insurance company plans to insure a place for ransomware damage, they should probably check whether there are backups isolated from potential attacks, what restoration would look like, and the likelihood of damage that the backups won't handle. That makes a major difference to how much recovery is going to cost. They also have to look at the attack surface and internal security standards to at least estimate the risk of a successful attack getting started and spreading. Maybe they can also consider that paying a ransom is a bad idea which only increases the risk and stop doing it. This is how you do insurance-companying, and if cyberinsurance can't do the calculations that most other companies have, they deserve nothing from the rest of us when their acceptance of stupid risks lands them in bankruptcy.

Yes, if only we knew that doing that would prevent any kind of cyber incident back in 2009, we could have stopped it in its tracks. After all, there was no computer-based crime in 2008. Criminals also have no way of exchanging money except for cryptocurrency, so that's another ill of society that didn't exist back in 2008. I'm glad you're here to tell us the easy answers.

Cyber insurance covers (or claims to cover) a lot of things. Eliminating cryptocurrency wouldn't even stamp out ransomware, but if it did, there would still be problems.

Feds find Silk Road thief's $1b+ Bitcoin stash in popcorn tin, hidden safe

Re: wire fraud

You misinterpret the law. Sending stolen money over a wire isn't wire fraud. It is theft. Wire fraud is transmitting messages related to a scheme to defraud someone, whether successful or not, and other crimes may be in play if you successfully get something from them. The wire fraud charges are related to using false pretenses to get a system to send money you aren't entitled to, and they would apply even if the system didn't send it, for example if a manual review caught it.

Re: I hide my Bitcoin stash on a single board PC as well.

Usually, they mean that all the interfaces are on the one board. Even if you don't have a graphics card sticking up from your motherboard and you're using only a M.2 disk that's mounted directly, you probably have an external power supply needed to convert voltage for the system and at least some of your ports are external to the board. If I'm being particularly picky, your RAM also probably runs perpendicular to the device and those look like boards too. The SBC label is less "there is no second board" and more "everything is on this one board".

Re: I Don't Get It...

"That much cash will buy you many, many, new friends."

That's probably true, but I don't think I would want many of the people who would participate to be my friends.

"And how many of your family would visit you in jail anyway?"

Well I was thinking that the alternative was to not steal the money or to do a better job of laundering it where you want to live, so I wasn't suggesting a life hiding from extradition is worse than imprisonment. There are a lot of cases where the restricted but luxurious life would be better than the expected alternative, but I imagine the restrictions to be annoying enough that people don't want to jump to it as their first plan.

Re: I Don't Get It...

But do you really want that life? Yes, you can afford a life of comfort and luxuries in the place you found, but you can't go back to where your friends and family live. You can't go to many countries because they could extradite you. You are limiting yourself to a few countries, and you don't even tend to have the freedom to travel between them because they're spread out. Many such countries tend to be unpleasant (sure, Russia is a place where you can probably hang out without extradition, but your ability to buy all the stuff you wanted wouldn't have worked out too well as sanctions were applied and Russia started limiting transfers across borders).

Oh, look: More malware in the Google Play store

Re: I bet you can't even list apps by publisher

I'm curious why you think downvoting a post about Google Play's organization has anything to do with Microsoft. The correction was accurate about what could be done, although not very useful to the greater point about removing malware that Google didn't bother to do proactively, but whether you think Google is terrible about malware or the best source of software is independent of your views about Microsoft.

Intel plans to cut products — we guess where they’ll happen

Re: NUCs

Intel is pushing you to other vendors exactly how? The article suggested cutting NUCs, but Intel didn't say anything of the kind, so if it's about wanting future supplies, you have no reason to think you won't be able to get more. In addition, the benefit of using a NUC-style device using X86 is that, if they did cancel them tomorrow, you only have ten other companies making small devices that can boot the same OSes and run the same programs.

You also suggest that you don't have much experience with alternatives. For example, considering Raspberry Pis for, in your words, "running VMware and any other Hypervisor solutions". That's not a workload for which the Pi's going to shine. And that's if I'm charitable and assume that the VMs you want are light on resources and don't have any CPU emulation required.

Qualcomm: Arm threatens to end CPU licensing, charge device makers instead

Re: Put an End to the Shenanigans

You can think that, but it won't be right. Contracts are complex things. Signing a contract that has a non-transferable clause means that, if you want to transfer it, you're going to pay some more. Double payment isn't in the law as forbidden, especially as any lawyer could easily argue that it's not double payment, Nuvia paid for the restricted license and Qualcomm has to pay to remove those restrictions. Similarly, if the judge decides that ARM's in the wrong, the judgement would be that Qualcomm gets to use their license and likely that ARM has to pay for Qualcomm's legal bills, not that ARM's IP is stripped from them and their business model is now effectively illegal. Courts and contract law don't work like that and they never will, no matter how much you might like the outcomes if they were.

Re: Cause for concern

"Qualcomm are alleging that Arm are intending to change the way they do business. That's got to have been a decision made by Rene Haas. Why would that be a difficult thing to admit or deny?"

Maybe because they're big complex contracts tailored to the specific parties each time. They probably change them often in negotiations whenever they expire or need adjustment because a signatory wants to do something the contract didn't cover. If ARM made a statement like "Yes, we are going to change the contracts, but not like this", someone would be there to argue that they're clearly planning to do exactly that. If they say "No, we're not going to modify the contracts in that way", then when they make some other alteration, people would accuse them of the same thing. They have to respond quite specifically to the things they're accused of, and since their response is to a document submitted as part of a legal case they're in, they're not likely to be quick and careless with that response.

Re: ARM isn't the only game in town

The ESP32 is a SoC, not an architecture. Even if you meant Tensilica Xtensa, the architecture used in that SoC's CPU, it's not in the same realm as ARM or RISC-V. It's also not trying to be. Xtensa is designed for microcontrollers, especially DSP units, and it does very well there. It could attack the ARM or RISC-V microcontrollers used in embedded systems or as components in hardware, and there are certain types of chips where Xtensa is already commonly used.

As the main processor for phones or computers, though, not happening. The architecture is from 2004 and limited to 32-bit instructions. There's a reason all the main ISAs used for central processors are 64-bit now, and people aren't likely to go back to something restricted. RISC-V already supports that, but Xtensa would need a seventh release to add it, and that would be an ISA redesign. Since they haven't released a redesign in eighteen years and they would have to make other changes to switch from something optimized for signal processing to something designed for fast general computing, it's unlikely they will want to give up their market in a speculative attempt to enter one with entrenched competitors and where even the nascent RISC-V would have an advantage on them.

Re: Non-transferable license ?

That's part of the problem. Qualcomm didn't isolate Nuvia as a subsidiary but integrated them into the rest of Qualcomm's design business, trying to apply their license to the larger organization or to apply their existing license to the Nuvia designs. That does count as a transfer, so if the license requires negotiation, ARM has a chance of winning that case. I don't know the contracts, so a judge will eventually make the final decision. Qualcomm might have escaped such a requirement if they kept Nuvia as a separate entity which didn't share licenses or designs, but that's not efficient when you already have designs going on elsewhere which could benefit from cross-pollination.

Watchdog urged to sniff out any collusion, deception in rent-setting algorithms

Re: Let's think out side the algorithm....

I like the idea, but the risk is that people start trying to claim that reward for things that don't deserve it. These incentives have gone wrong before, so you have to have a measured and well-tested approach before you do it. Also, you need to assess enough fines that there is something to reward them with.

For an example of the way this ends badly, several religious trial systems, where people weren't guilty of any real provable crimes (witchcraft, a religion the government didn't approve of, etc.) were run on the basis that the accuser would get some of the property of the victim if they were proven guilty. Since such trials were performed using the "torture them until they confess or die" tactic, they got a lot of guilty verdicts which meant that accusing someone who didn't have an unusual way to hit back at you was likely to earn you a chunk of their property after they'd been tortured. When this incentive was removed, there were a lot fewer accusations. I don't expect governments to run reports of criminal activity like that, but still where there is an incentive, someone will try to get it without having the requirements and the system will have to plan for them.

Why I love my Chromebook: Reason 1, it's a Linux desktop

Re: “Cloud” means “somebody else’s computer”

I'll bite.

"It's not 'spyware', they're completely open about their data gathering."

No, they're not. They're completely open that they collect data, but what and how and what you get a choice about, they're not clear at all. They've gone to lengths to hide their data collection and circumvent or ignore methods users use to block them, including methods Google put in. For example, the fact that they included switches for location tracking to imply you could turn it off but only respected them if you turned off all the ones in different places.

"And, obviously, there's nothing wrong with giving them the data that means you get a much better experience."

What better experience? I don't get more useful search results. I do get ads tailored to something they think I want, which just means that I get the same unwanted advert instead of different ones. The only thing I can claim to get is free or cheaper software, and I don't buy that in many cases, such as when they put Android on phones and get paid well by the manufacturer for their API licenses.

"What on earth is the downside?"

The downside is that I don't want them to have and sell it and I don't want others to. These are separate issues. If they have it, there is the possibility for them to get breached and then others have data I didn't want to have. Not giving it to them prevents that option. I also don't appreciate information about me being sold to other companies who might have other motives for having it, and none of which I agreed to. Even if they don't use it at all, I just don't want them to have all this information they don't need, for the same reason that you'd probably get a bit annoyed if I stood in front of your house filming it and taking pictures of you every time you left the front door. Sure, it's not doing any harm as far as you know, but it's creepy.

"It's a bit like complaining about your accountant wanting all the details of your earnings and expenses: they can't do the job you employ them for without it."

No, because as you pointed out, they need that to do what I asked them to do. Google does not need my browsing history to perform searches and show me ads, but nevertheless they will collect it if I let them. Since I don't even use Google search, they don't need my data for anything, but nevertheless they try to collect it.

Re: Windows machines lifespan

I didn't vote on your comment, and your approach is valid for work machines in many cases, but I don't think your comment makes a valid response for two reasons. The first is that they were talking about other users' machines, with the heavy implication that they were in fact home machines. You already mentioned in your comment that home machines would be an exception to your policy, so since that's what they were talking about, it sounds like you already agree.

On another note, not every company does everything on a nicely synced roaming profile, and some people store information on their local disk. That may not be anyone who works with you, in which case it's fine, but I'd generally check first. For example, in my job as a programmer, I have a bunch of data on my local disk that's not synced. The important stuff (the code, mostly) is in version control and I have it set up so that, if my disk fails, I won't have lost anything important. Still, I have bunches of temporary or test data there for caching. I don't put it on network drives as it's gigabytes of junk that most people don't need, and I can recreate it in a few hours if I need to, but if I have a choice, I'd rather not rebuild. If IT wiped my disk when they didn't have to, it would be a little annoying.

"You should check the security of Chromebooks. You just can't have that with Windows. Chromebooks' security goes down to the hardware."

You are exactly right. Chromebooks' security goes down to the hardware in the sense that, if the hardware's past its expiration date, you don't have security. You can't get that with Windows (yet, but that may change in 2025).

"Plus, Windows can't synchronize sh*t. When you have two Chromebooks you can logout from one, login to the other and continue working there. Then you can go back to the first one."

If you're using only online services, yes. And if you're only using online services, you can do that on any machine using any browser. You just have to have logged into the same things on both machines, and since so many things use a Google account, that works on anything. Windows, Linux, Mac OS, Chrome OS, you get the same restrictions and the same continuity. The only difference is that three of those can do other things as well. If, on the other hand, you store some data offline on Chrome OS outside the specific Google services, it doesn't autosync.

"Windows don't do that. You're mixing backups with true synchronization."

Yes, it actually does. I don't suggest using it, but I don't suggest using Chromebooks either. They have integrated synchronization into a lot of their applications and parts of their OS. I know this because, when you don't want it, having that option defaulted everywhere can be annoying and you notice it a lot.

War declared on bosses using 'omnipresent surveillance' tools to quash union efforts

Re: NLRB one more reason voters in Muruca will crack down on UNION JOE

"Right to work" in the US is a legal phrase that actually means "right to fire you"

For example, Florida is a "right to work" state as well, meaning they can pretty much fire you at a whim, except for narrowly protected things like age/race/gender discrimination.

I think your mixing up two terms. Your definition applies to "at will employment", which means that there are fewer restrictions on why an employment contract can be terminated. "Right to work" isn't the same, and generally means that a company cannot require its employees to be members of or financially contribute to a union, as opposed to states where employees can choose not to participate in union activities but are still required to pay for union representation if they are employed at a unionized location. You can have one of these without the other, so it's useful to know where one ends and another begins.

China promises its digital currency will offer 'controllable anonymity'

Re: Use before date

The UK did not expire the money. They expired the banknotes. This is a critical difference, as anyone can take as many of the old banknotes as they have and convert them into valid banknotes. In India's case, this process was strictly time limited with a cap on quantity. In North Korea's case, it was similar but had more restrictions and a lot more surveillance. I could store my entire life savings in expired pound notes and not have lost anything (with some added inconvenience for getting them swapped out), something I would not have had if money expiration was in place.

Re: Use before date

I'm not sure how they implement it, but it might not be that easy to sell currency and buy it back somehow. You could probably buy items with currency and sell the items for new currency, but that has risks. The same applies to buying securities and immediately selling them. In either case, you could lose value or have trouble selling what you bought, and if they really wanted expiration, they could prohibit the activities or monitor for them and give you a shorter expiration time rather than fresh money with the original expiration.

All that said, I wouldn't expect anyone to implement money expiration like that, even them. It's happened before, for instance when India canceled out some of their banknotes and had a cap on how much cash people could deposit before it became worthless, but that was a more limited expiration, had an excuse for doing it, and still led to a lot of displeasure. Doing that on a larger scale is dangerous, and the only country I can think of that did such a thing was North Korea, but they're in a position where they can pretty much do whatever they like to their citizens whereas China is trying to run a country where their citizens occasionally do things without state micromanagement.

Is it any surprise that 'permacrisis' is the word of the year?

Re: Why do tax cuts have to be funded?

They could cut costs, but generally, they don't want to or they pick something you don't want them to. They could probably make some improvements that wouldn't harm the people they're serving, but that doesn't happen very often. Austerity policies don't always focus on the money that's most wasted, and there are a lot of government-funded things which someone will miss if they get cut.

As to why tax cuts have to be funded, they don't if you're willing to borrow or print money to make up the shortfall. Printing the money ends badly, and many countries have, either by legislation or by custom, prohibited or at least limited using that for the budget and delegated the authority to some other group. Borrowing it can work, but depending on what country it is and how the people with the money are feeling, it can cause a lack of confidence in the nation's economy which, if not corrected quickly, can be an enduring problem.

I've heard "splooting" a few times, but mostly because a friend has a dog that always does it. She also has a few other names for the position which usually replace "dog" with "frog". The others you've never heard I haven't either. I can also add "warm bank" to the list of terms I learned today.

Re: You know where you are with an omnishambles

"it's oxymoronic to be permanently in a crisis."

Sadly, it's not oxymoronic to be permanently in a state where, when one crisis stops being a crisis, we get another one. Not that we can do much about it, but the crises we've seen over the past haven't stayed crises for long, just upgraded themselves to enduring problems, thereby leaving room for another crisis to turn up for its chance to shine.

Unofficial fix emerges for Windows bug abused to infect home PCs with ransomware

Re: Assession VB code

At least it was explicitly set in VB so you knew whether to have hope. I had similar problems when reading C code, but it only became clear after reading a chunk to see if this was the kind of user who checked whether the return codes for system calls were valid or just put in the calls and trusted that it would all be fine. Unfortunately, even when a user tended to do that, they could still miss one by mistake and end up having a bug related to missing a necessary error check. There's something to be said for exceptions that require an interruption. Although a poor coder can still silently catch and drop them, this is easier to spot.

German cops arrest student suspected of running infamous dark-web souk

Re: Registered users?

How did you expect it to work? Somehow, you have to identify yourself to the site so that you can post adverts for illegal stuff and people can send money to you to receive them. A site could be set up where people contact you directly, but that wouldn't make the admins any money so they are unlikely to do it and just because you're selling drugs doesn't mean you know how to correctly organize your own anonymous communication and payment systems.

It doesn't mean they gave the site a lot of useful information, but they would have had to set up an account of some kind to sell things.

Russia says Starlink satellites could become military targets

Re: Russia is bluffing

Yes, unless they can unmythify the communication between satellites for more remote ones, they'll still need local uplinks. If you wanted to take out Ukraine's ability to use Starlink, it would be easier to attack those uplinks which don't move than satellites which not only are moving but have replacements earlier in the orbit. Unfortunately for Russia, the uplinks they'd need to go after are in some cases on the soil of NATO members and bombing things there can be dangerous.

The boss worked in a fishbowl, so office tricks were a treat

Re: Pranks and things

Some people may not appreciate some of this stuff. I would have taken a few of these, but for others, I'd have been quite unhappy to have them done to me. For instance, this one:

"At uni we blew flour under another students door and coated everything in there white."

That could damage things and would require a serious amount of cleaning depending on how vigorously they propelled it in there. I'm not sure if this predated computers, but if it didn't, blowing flour into a room with a computer that was turned on would at best require completely stripping down the machine to clean it and at worst could cause a fire (flour is more combustible than it looks). Although the risk is lower, it could even do that with electrical sockets meaning you have to be careful when cleaning those afterward. If someone did this to me, I wouldn't be viewing it as "you got me". My thoughts would be a bit more angry.

No, I will not pay the bill. Why? Because we pay you to fix things, not break them

I'll admit it's not as clear as my initial comment suggests, but your examples demonstrate part of the confusion. One of the problems is that there is no good adjective in English, so they do use "American". some of your examples do not include America as a noun but American as an adjective. I see why someone would see "American" used and assume that "America" must be the appropriate noun. When it is used as a noun, it's usually in colloquial or abbreviated speech, meaning you're a lot more likely to see it in a slogan or lyric than in general conversation, and more likely in general conversation than anything formal.

Having watched a lot of people from both places talking about their countries, I'd compare this to the use of the terms UK, Britain, and England. British is the general adjective I've seen most often, but Britain isn't generally considered the name of the country. Still, it's used often when a shortened name is wanted. While I have seen some British people refer to their country as England, however, I don't think that's generally accepted and probably annoys people from the other parts of the UK. Inside the U.S., using "America" is like using "Britain" I.E. it's a shortened form that is understood, although I'd say it's less common. Outside the U.S., especially in other countries in the Americas, it's like using "England" in that it's considered inaccurate and mildly annoying.

I don't get either Guy Fawkes or Halloween off of work, if that's what you meant, but they're both holidays in the sense that people treat them as special and celebrate them. If you don't think one is, I'm curious why you think the other is. If you don't think either is, then we fall back to the holidays we can agree on that I do get off work, Christmas and New Year's Day, each of which gets its special holiday capitalization. I'm not sure why people object to the existence of multiple holidays and treats it as insulting the one they care most about.