There should be some "friction" in accessing records more than a year or two old.

Whether that friction involves putting the older data in "nearline" storage requiring a robot to mount a disk or tape to access it, or whether it stays online but there's only a "skinny pipe" between it an the internet, an adversary shouldn't be able to transfer the entire database in less than a few weeks, more than long enough for tripwires to activate and a human to investigate.

Show your cards. Show the world the source code and related information needed so independent experts can tell the lay public what is really going on.

Yes, you may have to reveal trade secrets, but that is the price you have to pay when your product looks like it is up to no good.

I thought they were all independent contractors!!!

Assume there's a legitimate company out there that will verify driver's licenses. Do they really need to store everything "online"? No, they do not.

They can store it "offline" with a 1- or 2- minute delay to access the data, caching it in "online" systems for maybe 15 minutes.

This, plus alarms when large amounts of data is being moved from "offline" to "online" in a short period of time, would've either made this leak slower than it was or, more likely, led to this year-long leak being discovered and plugged long ago.

Is this inconvenient? Sure, but it's not a practical impediment for "batch jobs" like employment identity verification.

For "real time" things like renting a car, the vendors will have to begin the verification process, do things to "kill time" like review the auto-rental contract or go with the sales clerk to inspect the car, then tell the customer "you are good to go" or "we need more information to verify your identity."

For situations like a bank where you can't "fill the time," the bank can set up a highly-secure on-premises id-verification computer that can act as a long-term cache. Everyone whose ID isn't locally cached will need to "step aside" for a minute while their ID is verified. Or better yet, they can start the ID-verification process before getting to the front of the line.

Every time people hear what it actually involves is outrage and opposition, at least all the way back to when Intel first announced that they wanted to hardcode identity numbers inside CPUs in 1999. But the corporations involved have been relentless, and have sunk countless billions of dollars steadily forcing it forwards, and building front organizations to obfuscate and whitewash it.

With Windows 11, Microsoft was finally able to FORCE Trusted computing hardware into every new computer. Not just every new Windows computer, but every computer.

Every new Intel PC CPU has built in Trusted Computing enforcement hardware. Every new AMD PC CPU has built in Trusted Computing enforcement hardware. Every new ARM PC CPU has built in Trusted Computing enforcement hardware. The only processor lines that DON'T have it are the microcontrollers.

There are some unlocked smartphones available, but as far as I can determine it's literally impossible to buy a smartphone that doesn't have hardware trusted computing built in.

I specified that enforcing Trusted Computing at the internet access level is still a long term goal, they couldn't get away with it today. However they are well on the way to success. Virtually all new hardware supporting trusted computing, all the front groups rolling out standards and systems, and as it gets incorporated into things everyone is going to increasingly running into situations where they get locked out of stuff if they're not Trusted Computing compliant. Streaming already restricts you to the worst quality if you're not compliant, and it's only going to get worse as pre-Win11 computers fade out and as more things require it.

I think AT&T (pre-1984) and the "Baby Bells" (1984 on) stopped putting lead shielding around copper cables in the 1970s or the early 1980s.

Legacy Lead-Sheathed Telecommunications Cables: Status and Issues for Congress is a report from 2023 that says

The report is light on details though. It's also not clear what part of the modern AT&T overlaps with the pre-1984-breakup version of AT&T.

I'd hardly call exact date of birth "low information content".

And yes this does reveal exact date of birth, regardless of the bullshit obfuscation that it supposedly only reports age range. The server simply tracks the reported result every time the user connects, and on some specific day the result CHANGES to announce their date of birth.

-

This is based on SLSA (Supply-chain Levels for Software Artifacts), brought to you by the same fuckers making Trusted Computing and the TMP (Trusted Platform Module). It's part of the same shitstack to prohibit you from altering your software and to lock you out of your own files, and to send spy reports out over the internet so you can be cut off if you "fail" the Trusted Computing check.

The software can use a TPM's (Trusted Platform Module) Sealing function to encrypt your data such that it's impossible to access your own data if the software is modified. It can then pass control over that data only to software updates that carry a signed security certificate from Broadcom (or any other company using this system).

It is no longer open source, your system no longer works as you can no longer access your Sealed data if you change so much as a single letter of the code. Even recompile unaltered code won't work, unless you magically manage to get your build environment absolutely identical to the company's build environment and get byte-for-byte output. Even that may be impossible with the newer levels of non-deterministic compiler optimizations.

Also, with TMP's Remote Attestation feature can be used to transmit your machine's software configuration over the internet, so that you can be cut off if your system doesn't match Broadcom (or other company's) cryptographically signed certificate.

And then of course there's Network Access Control (NAC) / Trusted Network Connect (TNC). In the long term, the goal is for ISPs to use NAC/TNC to interrogate your computer for Trusted Computing compliance, and deny you any internet access whatsoever if your machine isn't compliant. Software with this sort of "security" certificate would pass inspection, while any attempt to alter the code would be detected as "tampering". You then get "quarantined". What "quarantine" means is that you are denied internet access - with the exception that you do get very restricted access which can only be used to download the approved software to "fix" your computer into Trusted Computing compliance.

Look at the xkcd comic. In most* cases, important thing - the thing that makes xkcd xkcd - is the dialog. The drawing is literally a bunch of stick figures.

Coding can be similar. Parts of your code can be boring simplistic things that are the code-equivalent of stick figures. But if you want anyone but your "proud family" to appreciate it, it better do something interesting.

* the xkcd fans reading this - and that will be most of you - know there fantastic exceptions where the artwork is, well, fantastic

Bring a laptop that displays a GOATSE or other "MY EYES, THEY BURN, MAKE IT STOP" image if you power it on without pressing "magic keys" that enable a normal boot.

If you are worried about people stealing things for the value of the parts, equip it with hardware-self-destruct that goes off when the cover is removed (but have some way to deactivate it in case you need to remove the cover).

I see a future where travelers going to high-risk areas use laptops with everything soldered onto the motherboard AND where the motherboard won't work unless a specific device is within radio range or plugged in. Think Apple-iPhone-style "parts paring" but for laptops, and one part can go in your pocket.

My guess is they knew of the name's history. There's a case to be made that it's an homage, but IMHO a stronger case to be made that the confusion outweighs any merits of this name. "Multikernel Linux" would've been better.

from SMALLNUM lines of C and pre-processor code.

When it works well, AI-generated code is almost* just raising things to a higher level of abstraction.

* if only it were just that. Unfortunately, "vibe coding" gives you unreproducible/non-deterministic output, merely raising to the next level of abstraction should give you consistent output. It would be like compiling C code where your headers and libraries change out from under you unpredictably and with every build.

I would prefer not having these cameras at all. If you need to read license plates, hire people to do the jobs. If it's that important, it's worth paying for.

But that's not going to happen.

So, I can live with destroying all images within seconds unless there was an actual need to keep them, then keeping them and the data gathered from them in an encrypted, non-network-accessible location only for as long as they are needed, with strong oversight to make sure images really are deleted when no longer needed. Any supposed "need" to keep these images beyond, say, the time it takes to send out a you-didn't-pay-your-toll-bill invoice and give the recipient an opportunity to pay or protest should require court oversight.

In rare cases where the police are "on the lookout" for car matching a general description ("driver in green station wagon kidnapped small child from Springfield Kwik-E-Mart, no license plate"), keeping all images within a small targeted search area for hours instead of seconds may be tolerable, with the police keeping only those images that are useful for the investigation after the several hours have expired. In any case, keep the images offline.

In any case, keep the images encrypted and offline. I don't want some overseas black-hat group collecting a dossier of my car's travels.

You are confusing the police department's FLOCK camera with my across-the-street-nosy-neighbor's doorbell camera that stores data unencrypted on a weak- or no-password-required web site that the cops happen to be watching and recording 24/7.