Posts by doublelayer

Do we really need another non-open source available license?

Re: "proprietary gatekeeping wrapped in open washed clothing"

"Nobody paying attention will run along with this. This is just Big Capital pulling the wool over the unwary."

The concern is that it will spread. When someone announces something open source, there's no way of knowing whether it's about to change license or not. If there's any corporate structure, then someone could buy or otherwise gain control of it and completely change the terms. If people start to avoid anything that looks too much like a company making open source software, you run the risk that larger open source projects get fewer users and developers. While it's always been possible for open source software to die, it usually happened by a slow loss in continued updates rather than an overnight switch to proprietary.

Author hopes to throw the book at OpenAI, Microsoft with copyright class action

Re: So what about all the students reading books to write papers?

The argument is that reading a book as a human and processing the book in a process called "training" aren't the same thing. Thus, just because one is acceptable doesn't mean the other is. It gets philosophical when we start to ask what the model is really doing with the text it is ingesting, but it should be clear that I can't use whatever copyrighted information I want just by calling whatever my program is doing training.

Remembering the time Windows accidentally sent Poland to the bottom of the sea

I think you need to look at a time zone map.

"Most of Spain is West of the Meridian."

True, and some parts use UTC+0, but most of it uses UTC+1.

"Portugal is the same longitude as Dublin."

And it uses the same time zone as Dublin. WET, UTC+00:00 during standard time. Exactly what you'd expect it to use.

"Greece, Romainia, Bulgaria are really in +2."

Oh, I should call them and tell them they have to stay there, then, because all three of those countries are already in +2.

In trying to prove a point that the EU insists on a single time zone, which it doesn't, you missed that all but one, if we're being charitable, of your examples are simply wrong.

Re: Rome or Vatican?

Of those states, one of them is not just a city, but a city and surrounding area including several islands without urbanization yet. It is a state that only has one real city in it, but not a state that's entirely enclosed in a city. Another is a state that is entirely enclosed in a city, but that city is not enclosed in another city, which is what they were talking about. So there is only one state that fulfills their criteria.

Your password hygiene remains atrocious, says NordPass

This was their method of advertising their services. They find some data about how bad passwords are, which is basically the same data as last time an article was written about it, but this time they get to have their name as the password manager company that suggested it. That's all they did in this case.

Re: For best results, use a password generator that can give you a long, random string"

"The most fundamental rule that is not being imparted is:

a password is not to give you access -- it's to deny access to others, so don't make it obvious.

But I've never seen that stated plainly in any password policy I've seen over two decades of consulting."

I didn't think we had to, since that seems rather intrinsic in a definition of a password. I think users know what a password is for. They either don't care as much about the desire to make it secure or don't understand how password security works, and the latter is a point on which we can help, but I think they understand why they've got one.

And you assume that they're providing their customers' passwords why? Did you read that in the article? Did you read that in their statement? Does it make any sense whatsoever, given how password managers work?

They didn't.

Re: What about sites that force you to make it easier?

I usually assume the worst with sites like this. One reason this could happen is that someone copied and pasted some validity checking code for no reason, but the most plausible reason I can come up with is that the password is stored raw in a database and they're worried that some characters will mess up an SQL statement, meaning the service is vulnerable to SQL injection and has my passwords in plain text. Maybe that's not true, but if I see those requirements, I assume that they hold and act accordingly.

Re: Streaming Passwords

This is true in my case. If I expect that I will have to enter a password on something with an annoying input device, the password is likely to look something like hzycdkbkfamxptdjdl. Length makes it secure, but by having no characters that aren't on the lowercase keyboard, I don't have to keep switching layers to enter it. This is, of course, if I have the luxury of encrypting it and looking it up only when needed. I imagine that people who have to enter it frequently or share it with others don't bother with that either.

LockBit redraws negotiation tactics after affiliates fail to squeeze victims

Re: You write this as if

"personally I don't think we should blame the victims for making sensible business decisions."

This is where we diverge. I have a problem when people blame the victim for their misfortune, but that's not the same as making a decision not to do something that harms them. If they decided not to install fire suppression equipment in their room full of flammable stuff, then I won't have sympathy for them if it burns down, and I think it is their fault. It doesn't matter that they thought it made economic sense not to have that stuff set up.

I don't blame the companies for having ransomware installed. Theoretically, they could have taken some other step to prevent it, but they're fighting against an active adversary who is trying to get around that, so their failure isn't automatically their fault. I don't blame them if their backups were lost because the ransomware operators were diligent about finding them; while I'd like if everyone had so many backups that it would be impossible to do that, not everyone will. I do blame them if they knew about the benefits of backups and decided not to bother having them. Not that I suggest doing anything based on that blame, but if the question is whether I feel sympathy for their plight, the chances are much lower if they knew the risks and chose to ignore them.

I'm not sure it's as simple as email addresses rather than an internal communication system, but either way, that's a good target for investigators to go after.

Re: You write this as if

They are a business in most respects, other than having a corporate entity that pays tax, but nearly everything else they do is done like a business. That doesn't prevent them being scum, and they certainly are.

HP sued over use of forfeited 401(k) retirement contributions

Re: Who benefits if this changes

"So a 401K account is a pension scheme with only one member/beneficiary…"

Pretty much. There's more self-direction involved as well, as the single beneficiary gets to decide what they invest it in and how much they take out, subject to a variety of restrictions. As I understand all the options, I think it's comparable to the UK's SIPP accounts with an employer connection or Australia's Super funds.

Re: Who benefits if this changes

I don't think it works that way because 401K accounts aren't a pension which pays out specific amounts. They are tax-advantaged individual investment accounts. An employee who contributes a certain amount can invest and withdraw from that money subject to certain legal requirements, and someone who put less into it simply has less to work with. Since there is no common pot, the forfeited funds can't be put in one unless they stop using 401K accounts altogether.

Who benefits if this changes

As far as I can tell, nobody stands to gain if this case decides that the forfeited amounts can't be used the way HP was using them. HP loses, because it needs to leave that money locked in the account until it finds something else it was allowed to spend it on, but just because HP has to leave the money there doesn't mean that anyone else could get it. This raises two questions in my mind. The first is why the people suing HP here are doing it, because presumably they wouldn't gain from having the rule changed. The second one is whether that will make it more difficult for them to prove that they were harmed, which is often a requirement to pursue a case.

The best answer I have to this question is that, if HP was not allowed to use the forfeited money for most things, maybe they'd change the plan to avoid forfeiting it and people employed at that time would benefit from the new plan. While possible, this doesn't make much sense to me as HP would end up spending exactly the same amount of money if they lock it away or give it to employees, so nothing says that they have to stop using a vesting schedule if they lose this case. Maybe I'm missing something simple here.

To pay or not to pay for AI's creative 'borrowing' – that is the question

Re: Two questions for the price of one

This is all true, but if you train a 5 GB model on 1 GB of training data, those weights would end up including a great deal of the training data. Not so much if your 5 GB model was trained on 1 TB of data, though some of it could be. How large is GPT4 again? We have no idea, because they didn't tell us. This means that it's difficult to know how likely it is to contain certain chunks of the source material. Without knowing that, we have to start relying on less reliable measures such as whether it quotes large chunks, and it really isn't as difficult as you state to make it do so to the extent that OpenAI had to implement extra guard rails to reject any question that explicitly asks it to quote something copyrighted. If it didn't have that information in there, they would not have had to do anything, as the model would consistently fail. They added it because it was not consistently failing.

Re: Two questions for the price of one

Just because something's been reorganized and turned into floats doesn't mean the original data is not there. If things were that simple, I could eliminate piracy and copyright in one plan by making a suitably annoying obfuscation system. The way you can determine that the data is still there is when models like that start to reiterate the training data verbatim. They have been known to do so, sometimes on their own and more often when prompted with a starting point. They have to do some calculations to reconstitute the original work, but it's in there.

"Isn't the copyright holder reimbursed when the trainer buys the book in the first place?"

So far, no, because they didn't buy the book. They found illegal copies online and used those for free.

Even if they started buying individual copies, buying a copy of the book doesn't necessarily let you do whatever you want with it. For a very simple example, if I buy a copy of a book, I don't get to start printing and selling my own copies and saying that the author got their compensation when I bought the first copy. There are limitations on the use of the content of the books, and it is not clear whether AI training qualifies. I think it should not, but the law doesn't clearly answer either way.

Re: Is it legal? Who cares. *Should* it be legal is the question to debate

True, we should be discussing that, but it's likely not to happen until some court has decided what the current law says. Once a decision has been made, lobbyists for AI companies and publishers will start to try to change the law to better serve their companies, and we can start having that conversation, not that our views will be at all important to the politicians making the final decision.

In the spirit of having that conversation, I'm on the side of copyright here. I don't think the benefits of more articulate programs outweigh the costs of effectively telling anyone that, if their program is large enough, they can use anyone's copyrighted information in any way they please. We all know that this power would only be available to companies that are large enough; if I ran a copy of the Windows source code through as training data, Microsoft would not agree that it's acceptable, even as their friends at OpenAI effectively do the same to lots of others.

Re: Two questions for the price of one

That's not the argument at all. This is not about temporarily copying the text into buffers during processing. It's about two other copies:

1. The copy in the training data, which is not temporary because it's kept around for months to train models on, if not forever so it's available for subsequent models.

2. The storage of the processed work, which in many cases includes most or all of the work, just sliced into pieces, in the final model.

The copyright holders are claiming that point 1 is a violation of their rights because the companies did not get permission to obtain the work at all, and that point 2 is also a violation because it involves the storage and reproduction of their work. There are arguments that the second is not a violation which I don't find convincing, but either of those can be a problem for those who use copyrighted material as training data.

Re: IP is an industry

Whether it is valuable is not important. It could be valuable, and thus we find it useful to protect it. If it's crap, then nobody will buy it and its protected value will still be low. If it is not, the people who put in the effort which resulted in it not being crap deserve to benefit from that effort.

And yes, there will be an IP litigation industry, just as there is an industry for any profession, including ones that rely on negative aspects of our world. There is a toxic waste disposal industry, a fraud prevention industry, a repair of electronics after their manufacturer has dropped support industry, and an IP litigation industry. If we had less toxic waste, fraud, premature obsolescence, and copyright and patent violations, then we would need less of those things.

Re: Two questions for the price of one

"If it were instead a breach of contract with such a stiff penalty, that would seem to open the door for very onerous EULAs."

I don't see that as any stronger than an open source license. It's still based on the copyright rights to the content, and rather than applying a license to modifications you make, it limits your ability to store it on a different system. Not to mention that most of the ways you could store it on a system that would actually incur their investigations would themselves be copyright infringement, and they would go after that instead. While their term technically means that scanning it is not allowed, they're unlikely to do anything to someone who did for their own use unless that person also published, sold, or made a commercial derived work from those scans.

Qualcomm promises 'premium performance' in Gen 3 Snapdragon 7 phone chips

Re: Cue lukewarm applause

While I'm mostly in the low-priced camp, how about some of these? I've had to guess on some things, like what is required for a camera to be "very good" (I've limited it to 30 megapixels or higher). You can customize these, but there seem to be quite a few options there.

IBM pauses advertising on X after ads show up next to antisemitic content

Re: That's rich.

That episode is why IBM in particular is rather touchy about Nazis. We can analyze the events of the 1940s in a variety of ways to try to answer questions like how much did the IBM headquarters know about the particular use their machines were being put to. There are various levels of responsibility there, as the Nazis didn't exactly send a message to New York saying "we want to build a genocide database, please", but neither did they build the entire system themselves on IBM hardware. No matter where we fall on IBM's culpability, the current leadership of IBM wasn't around for it and they tend to make sharp turns any time their company and Nazism get too close to each other.

Lawyer guilty of arrogance after ignoring tech support

Re: clicking on the screenshot

This happens to me on occasion. I run make, it fails, I see the compiler error and fix it, run make, it fails, check that I saved the file after I edited it, run make, it fails, delete all the binary files in case they somehow got stuck, run make, it takes a lot longer but still fails, close and reopen the editor in case it got stuck, make still fails. Then, I realize that the code I'm building and the code I'm editing are in different directories. Maybe I fixed a problem in one file but a similar error was detected in another one. Maybe these are two different copies of the source, since I often have parallel copies for adding unrelated features. Either way, the editor and the terminal both print the directory I'm in, and if I was just paying attention to those, I'd have noticed that they weren't the same.

Meta's fix for teen online mental health? Hold Apple and Google responsible

Re: Support for a federal law? Eh? It already exists.

"If the device doesn't have a comprehensive set of parental controls and parental controls apps are imperfect and easily worked around, how do you expect parents to actually parent?"

The way they have for a long time: instead of finding a magical way to make it impossible for their child to do something they don't want them to do, taking reasonable steps to make it difficult and explaining to the child why they should not attempt to bypass those measures. It's not perfect, but nothing is. Depending on your tolerance for your children doing things, you are free to find a parental control application that does block ADB registration, and I know this is possible. Other parents, in my experience a majority, won't install any such app at all. I'm not convinced that you will get better results with your stringent measures than they will. I am not responsible for ensuring the tools you want to exist really exist. Nor are device manufacturers.

"Are you under the impression kids don't talk to each other and "Install Platform Tools, connect to phone, open a terminal, type this" is too complicated for them?"

In my experience, yes, it is too complicated for quite a lot of them. However, I know some will learn to do that. If they do, I expect that they won't have much trouble finding other paths around software restrictions, even if the ADB method is blocked, and therefore I think they must be handled differently. At some point, technical restrictions become ineffective and something else must be used. You are free to keep relying on technical solutions, but since they will always be somewhat imperfect, there may be better ways than a technical arms race.

Re: Support for a federal law? Eh? It already exists.

If a child learns enough to use ADB to disable that overlay, they're likely to know plenty of other ways to do whatever they want on that or other computers. ADB use is not that common for kids, or for that matter adults, and if they're going to do it, it requires another computer on which they could probably do whatever the phone is blocked from doing. This is really not a realistic concern for how such a feature could be disabled, and if this is really concerning to you, you might suggest that the provider of the overlay blocks the ability to change developer settings, therefore preventing the child from authorizing a computer for ADB control in the first place.

This is not a convincing argument for why the device needs to have special software baked in for parenting reasons. No desktop computer has it either. Even if you're the kind of parent who builds a customized Linux image that has very specific permissions set up, it wouldn't prevent some child from theoretically finding an exploit that allows them to escalate their permissions and disable your work, but that this is possible doesn't justify requiring someone else to write it for you.

Right-to-repair fight going national as FTC asked to lay down the law

Re: So whats the balance?

I know. I was explaining why they don't have to do that for any security purpose, as they and their fans like to claim. If they didn't do any of that, their devices would be equally secure, but they'd have less revenue from repairs and unnecessary sales of new devices.

Re: So whats the balance?

"I can no longer trust that a lost iPhone is secure cos somebody can replace the magic-security-pixie / fingerprint reader"

That's not how that works. Here's what would happen:

1. You lose your phone or I steal it from you.

2. I take it apart to replace the fingerprint reader with one that I've designed at great expense to work the same way the Apple-developed one does but always accept my fingerprint. Somehow I manage this even though the part is not open and so making that would require difficult and expensive reverse-engineering.

3. I put the phone back together, never having turned it off.

4. I scan my fingerprint on my compromised reader. Nothing happens, because the reader is not hot-swap capable. The phone won't read from it unless the sensor is present at boot.

5. I restart the phone to pick up the new reader. The phone restarts and demands the passcode, since without an active session, biometrics can't decrypt the phone. My reader won't be able to get through that.

In short, your scare story is completely invalid. Not to mention that there are several other ways to design a phone that would prevent a sensor swap from breaking encryption. For example, you could put the encryption key in the sensor, and then swapping the sensor locks the data away since it doesn't have the key. Users who need to replace the sensor can decrypt with their code before swapping in another sensor and re-encrypting with that. There are lots of options other than preventing the sensors from working.

Rivian bricks infotainment systems in 'fat finger' fiasco

Re: Wrong security certificate?

Here's my guess: the image they sent was correctly signed with their certificate, but they have some component which must receive firmware signed with a different one, either for license checks or for more levels of firmware security. They signed that with a certificate that worked for some models, I'm imagining two components that do the same job and every unit has one of them, but didn't work on another one. That would explain why some people are affected, not everybody. It would also make more sense why they didn't spot it in testing, as I think they would have noticed if literally every unit was disabled when they did the update. Of course, that guess could easily be wrong.

As the Top500 celebrates its 30th year, with a $5 VM you too can get into the top 10 ... of 1993

Re: Stupid question

Probably not, although it depends on how expensive power is where you are. For example, the current price in the UK appears to be £0.270/kWh, so £5.00 should be able to buy you 18.52 kWh. If you use the same amount of power consistently through the month, that allows for an average power consumption level of 25.7 W. That level of power consumption won't be sufficient for a desktop, but you have two ways to make it work. The first is to create an optimized system for getting as much computing as you can from that power limit. You can get some pretty good CPUs in that power limit, along with some SSDs for low-power data storage. The other way is to share hardware with someone else who is paying for their computing needs. Either way, if you do one of those, your power bill will likely be lower than the rental cost for this machine. Of course, you wouldn't necessarily need to run either the rented machine or your own machine at all hours, in which case both bills would decrease.

All supercomputers these days are clusters. This means that Moore's considerations don't really apply to how high the benchmark numbers can go. If you want to have a more powerful supercomputer than the top ones, you could just add more nodes to one of them. While it's not completely simple and linear, you are not limited to the performance of a single system. While that has always been possible, the software for treating a cluster as one machine has been improving a lot faster nowadays than it did in the 1990s.

Beijing reportedly asked Hikvision to identify fasting students in Muslim-majority province

Re: A big budget for injustice

I suppose that's what they might want. I read it as just wanting to check who went in and out of dining facilities, which would be an easier facial recognition task. I wonder if they have sufficient camera coverage to monitor everyone who could be eating or not, since it's usually not that easy to cover a room full of eating students with a few centrally-located devices.

A big budget for injustice

Not that this isn't evil, as it clearly is, but I'm still a bit jealous that the budget for detecting fasters is so high. Calculating a likelihood that someone is fasting when you have their dining records is maybe ten if statements at most, and providing a yes or no is just establishing a threshold. How does that require millions? For that, I'd expect that they'd also be expected to provide robots to automatically hunt down and arrest those students as well.

Want a Cybertruck? You're stuck with it for a year, says Tesla

Re: What about the free market?

I don't know about this particular clause, but it's common for contracts to want to remove a right that you have and for laws to be written so that they can't. The tricky part comes when you try to list those rights you are allowed to sign away and ones where, no matter what the contract says, it's still illegal. The specific list is usually very dependent on your location, including local law in federal countries.

If everything could be removed by putting a clause in a contract, then every manufacturer would simply require every customer to opt out of consumer protection law, but they aren't able to do that to the extent they'd like. I'm not convinced that this would automatically extend to other similar regulations, but it might in some places.

BOFH: Monitor mount moans end in Beancounter beatdown

The PFY has tried taking the BOFH's job through attempted murder. He's smart enough to know that, if the BOFH didn't agree with every part of it, he's in for a terrible time. He's definitely smart enough not to ally with the finance department over the BOFH.

By the way, the BOFH is well over forty now. As I recall, the first BOFH articles were posted in 1992, so his career has been going on for at least 31 years. I don't know how young we think he was at that point, but I'd say the chances are high that he's well into his 50s.

Google, Amazon among big names in tech axing jobs this week

Re: Hmm.

admittedly, this is mostly massive tech companies who decided during the pandemic to just hire everybody they possibly could, without thinking about why they needed that. Other companies still want people with technical skills. While some of them clearly want people with technical skills who are happy being paid a lot less than others, they still want the skills and some are willing to pay what is needed to get them. Just because the big tech companies are cutting back on hiring doesn't mean the entire profession is in a poor job market. It's calmed down from the craziness it once had, but the skills are still necessary and in demand.

Canonical shows how to use Snaps without the Snap Store

"My computing resources are not theirs to waste."

Your computing resources are used for whatever you tell them to. By writing my software less efficiently than could theoretically happen, I'm not wasting your resources; you're making the choice to run it and are free to choose otherwise. For example, you never have to use Snap and can build everything that would have used it from source if you want. Thus, having the Snap option is not putting any requirements on you. Don't play the victim because you have software someone else wrote and are running it.

Every decision involves tradeoffs between the resources it will use. Packaging systems that bring along dependencies makes the decision that users may be willing to use more disk space in order to have faster access to updates without spending as much of a distro maintainer's time. The alternatives can make more efficient use of disk space at a cost of more maintainer effort required. If you don't like the decision made by your local maintainer, you can find another, and if you don't like the decisions being made in general by all maintainers, you can be your own. Either way, the tradeoffs will always be there and your preferences aren't necessarily the same as everyone else's.

Re: Snaps are good for Enterprise

It's not about .deb and .rpm and the other ones, since those are not the only archives for Linux package managers out there. It's about what's in them. Here's a simple answer: I'll build a piece of software on my local box which has updated dependencies, and put the binaries in a .deb and .rpm file for you. You can just install that. If your system is like mine, it will work. If it's not but all the packages are new, you're probably going to be fine. If it's older, it will fail to install or run depending on your package manager and the flags you gave it when it decides that the version of your libraries is wrong for the software. Maybe those older libraries could run it, but my binary doesn't properly find them. Maybe they're actually lacking features that I made use of. Either way, it won't run.

Bringing your dependencies with your binary is a pretty old concept, and these packaging tools exist to make that work like traditional package managers have, without requiring package managers to manage the isolation.

Re: You can't use gzip/tar?

I have experienced the problem of binaries refusing to run because I don't have a version of Glibc new enough for their tastes. I've experienced sites where there are eight different Linux packages for the same program for different distros, which is fine when I'm using something common, but not too helpful otherwise. I have experienced the problem of recompiling my software on something old so that it won't have that problem when someone who is still using an older distro tries to run it. This may not be a problem you've ever had, but it is a problem that shows up from time to time. If we want desktop Linux to appeal to other users, it is helpful for us to try to solve it, because it makes it much easier for software to exist for all of Linux, not just the developer's favorite distro and anyone else who wants to build it themselves (I don't mind that, but a normal user would).

"My distro(s) already have a package manager(s). So why do I need(?) another one?"

The reason these tools have been developed isn't hard to understand: distros that don't update every package immediately versus software that does update its dependencies immediately, but you want to run the latest version of that program on your older distro. If you don't want to do that, because you either have a distro that updates every package every time a new version comes out or you are comfortable using the old version of something that updates frequently, then you can cheerfully ignore this tool. Otherwise, that's why a second way of distributing the software makes this possible.

I wouldn't pretend that this is the best solution to the problem, but if anyone has a better one, people are here to listen. Most better options are better for some use case and either painful or completely broken for others. The benefit of Snap or things like it is that they can work for a number of generic situations, rather than just one.

Google dragged to UK watchdog over Chrome's upcoming IP address cloaking

Of course you have that right, and nothing about Google's response to the marketers would deny your ability to do exactly that. I will end up doing the same. While I don't agree with blocking entire blocks, I do automatically block abusive users, and it won't be long until some abusive bots start to use that proxy system. For the same reason, although I have not explicitly blocked Tor exit nodes, many of them can be found in my temporary blocklist based on someone using them to try something that my server saw as dangerous.

Re: B0ll0cks!

The sites don't need to know the country, and existing VPNs that redirect traffic through a different country are perfectly legal. Sites sometimes make decisions on what to show based on the country the IP address is in, but nothing makes it illegal to lie to them about it.

Poloniex crypto-exchange offers 5% cut to thieves if they return that $120M they nicked

Re: Simplify, Simplify...

Yes, that's basically what they're asking for. Admittedly, it worked at least once, possibly because someone figured out how to steal tokens then freaked out when thinking about how they were going to cash out millions without getting caught. However, it has been tried before with no results, so no guarantees that it will get anywhere.

Apple exec defends 8GB $1,599 MacBook Pro, claims it's like 16GB in a PC

Re: Built in Landfill ability

Not only is the SSD soldered, but it is used in such a way that if the SSD fails, the computer dies. The bootloader needs to access data on the SSD to run, which means if the SSD isn't working, you are also unable to boot to external media. This means that, even if you have access to the tools needed to remove an SSD from the board and put in another one, you probably can't do it and have the computer still work because you need to somehow prepopulate the chips with the code for the bootloader. Since the computer can't do it itself, you'd have to create a board to accept the chips, solder them to that, write the code, remove them from that board, and resolder them to the Mac.

Re: I was gonna say...

Outsourcing doesn't just mean to another company. In my comment, it meant running the software on a different machine, which might be rented from a cloud provider or owned by the same company. If you meant your comment apply to using the cloud provider's server, it's not the same as outsourcing since you can easily reserve capacity from a cloud provider to guarantee its availability and, if you're using it for temporarily using a more powerful computer than you want to buy, it's quite easy to move that task to any other provider of big computers or your own. This is compared to the difficulty moving things from a cloud provider if you've put publicly-accessible resources there, which is much harder.

Re: Insult to injury

Not a good person to buy from then. I don't recycle electronics professionally, but I do and have handled them for quite a few people. If they're trying to get rid of Apple equipment, I have them reset it beforehand. Whether I'm selling them or more likely giving them away, that is my responsibility to do to make sure they work. If someone is not bothering to do it, it suggests that they're treating their eventual customers quite badly by giving them equipment that might or might not be effectively broken, and if they're doing other checks, it suggests that they might be accepting stolen equipment. Either way, find a better supplier.

Re: Insult to injury

Or a different option: they planned to erase it and sell it themselves, earning the money he ended up with. Without context, we don't know this, and I mean that in both directions. This easily could have been theft, but it could equally likely have been that they wanted the equipment disposed of and didn't mind that he took it. I've gotten plenty of hardware by being willing to take it away when the former owner wanted it out of this closet today, please, and I don't care what happens after that. Don't jump to the conclusion that this machine was stolen, nor the conclusion that he did the former owners a favor. Both are possible, and a few intermediate options are as well.

The problem with that is that most of that is caching of some sort or another. If you have a lot of memory, Windows and applications will preload stuff to make things faster. If you start using more, you'll quickly see many of those processes and the system use evicting it to leave more room for your work. Mac OS does the same thing. This means that merely looking at Task Manager or Activity Monitor doesn't give you a great picture of how much RAM is necessary to do a task, since much extra space is and should be used by caches, only some of which is shown to you as caches. The only way to know your memory needs at the moment is to start paging before you're comfortable with it or go through a more laborious profiling of each of your typical tasks.