Forgot your password?
typodupeerror

Comment Re:will start shipping (Score 4, Interesting) 30

I don't think it will be a problem. These are $150 Chinese phones with a coat of cheap gold paint. They can get a few hundred of them and send them out and it'll make it look like they aren't scamming people at least for a little while.

The summary should also mention that the main selling point of the Trump phone was that it was supposed to be Made in America. That was a major part of the sales pitch and a key promise that motivated whatever pre-orders they got. To whatever extent the alleged 600k pre-orders is plausible, it was that promise that made it so. But Trump Mobile quietly changed the terms on their web site, removing the "Made in America" promise and replacing it with a claim that the phones are "Designed with American values in mind".

My guess is that they announced before even checking whether they could actually make a phone, typical Trump business "strategy", then discovered that doing it ranges from extremely difficult/expensive to impossible depending on how you define "made". You could probably import all the parts and assemble them in the US, though it'd add a lot of cost (Moto tried it). You simply couldn't create an even marginally-decent device from chips fabbed here. You could get an SoC and a modem that are only a few years behind current flagships, thanks to TSMC Arizona (thanks, Biden!), but DRAM, flash, display, camera sensor, MLCCs... even high-density PCBs are available only from Asia.

Note that I think this is a national security problem that needs serious attention. We're way too dependent on foreign manufacturing chains for critical components, components that aren't just needed for modern consumer electronics, but for high-tech weaponry. Biden made a little bit of a start on addressing it with the CHIPS act, but Trump has undermined a lot of that (and wants to repeal it entirely). To really get to where you could build something comparable to a five year-old flagship entirely in the US would require another half-dozen CHIPS Acts focusing on flash, displays, image sensors, MLCCCs, PCBs, batteries (the US makes lots of Li-ion batteries but they're EV batteries and the differences in form factor, chemistry and defect rates between those and phone batteries are enormous), etc. We're just that far behind.

Comment Re:If it's free, you are the product (Score 1) 88

I'm still going to be really pissed off if google do successfully kill F-droid though.

I don't think Google has any intention or desire to kill F-droid -- and here I really understand the situation quite deeply from my decade in Android Security. I worked on platform security, not the anti-malware team, but I knew a lot of the core anti-malware guys and talked to them regularly. I was the twelfth engineer to join the Android Security team back when one small team was responsible for all of it (platform, anti-malware and offensive/red-team), so I knew the anti-malware guys (all three of them!) well back then. The team later split and the anti-malware group grew to dozens, then hundreds of engineers, but my old colleagues were (and are) still involved.

What you're referring to is the developer registration requirements, and those absolutely are another example of Google trying to stop abuse that hurts users, and trying to do it in the least-invasive way possible. The problem is that there is a massive ecosystem of malware out there. Google spends incredible sums of money fighting it, but in the armor v warhead battle, the armor is perpetually behind.

In recent years it's gotten a lot worse, and the old techniques (static and dynamic analysis) are no longer working because the malware construction tools have gotten so good that the malware authors are incredibly agile. When the anti-malware team identifies a malicious app in the ecosystem they have the tools to shut it down, but the authors can replace it in hours, maybe minutes, with a new version that can't be identified. This isn't because the team's malware-identification tools are lousy, in fact they're incredibly sophisticated.

I'm not sure how much of the cat-and-mouse game I should describe here. Both legally and morally it's unclear to me how much I can safely say about the details of what Google does to detect malware and what malware authors do to counter it, so I won't say much. I'll just say that it's a very complicated and subtle technical battle... and Google is losing. Not on the Play store, because they have a non-technical advantage there: Developers have to identify themselves and pay a fee. Those requirements mean that when malware is identified, Google can not only shut down the malware, but can also block the malware author. The author can get another ID and pay another fee, so this defense is circumventable... but the circumvention is hard to scale.

What Google is trying to do is to apply this same highly-effective non-technical defense to the rest of the Android app ecosystem. Not because the fees mean anything, and not because Google objects to the existence of other Play stores, but because it's a simple and extremely effective way to break the business model of Big Malware.

Will it stop all malware? Obviously not. But it will make malware hard to scale and that fact alone will destroy the malware business model, and with the financial incentive removed, the sophisticated malware industry will die. This will actually benefit the Play store, too, because less sophisticated malware is easier to identify and kill.

If Google succeeds at this, it shouldn't kill F-Droid. It will just mean that someone, somewhere, in addition to spending their time on building open source apps and packaging them for distribution, will also have to give $25 to Google, and send their ID. Unless Google can work out a different way to handle F-Droid... and that seems very feasible! F-Droid's requirement that source code be available is a really good defense against malware, not so much because of "many eyes" as because people would be very skeptical of any open source code that does the obviously weird shit that malware does to evade Google's detection schemes.

Bottom line, I don't think F-Droid is at risk, and I don't know anyone in Android who even wants to eliminate it. Well, no one in a decisionmaking position, anyway. I do know a few Android engineers (in the security team) who sincerely believe that Apple's walled garden model is superior because it makes security a lot easier. But that's very much a minority view. 99% of Android engineers want their platform to be open.

Comment Re:you will pry my texas brisket (Score 1) 85

I live in California and it's not uncommon here either, in the mountains :) It's especially gross here because people are doing it because they're poor. That means they depend on whatever wood they can get.

Yeah, that's unfortunate. At least where I live we have mountains full of standing dead timber for the taking (occasional forest fires, beetle kills, etc. -- this isn't to say the forests are unhealthy, healthy forests have standing dead timber) that is relatively accessible and the permits are cheap. It means people are burning varieties of pine rather than hardwoods, which burn hotter and longer, but it's clean wood. Except maybe for a bit of lead, apparently?

Comment Re:If it's free, you are the product (Score 2) 88

Profits have never been higher, and yet their offering continues to get worse..

I doubt that the product is actually getting worse, and I have good reason for my doubt.

Nearly all of the things like this that Google does have one real purpose: Combating abuse. During my ~15 years at Google I never worked on counter-abuse, but I spend about a decade doing stuff that led me to work pretty closely with the counter-abuse teams, and the inventiveness of the people abusing Google's products and systems never ceased to amaze me. And it isn't trivial abuse that is ignorable, because not preventing the abuse would actually make the product offerings worse.

I don't know what the storage abuse might be, but I can think of a lot of things that could be done, and my experience touching on counter-abuse at Google taught me that for every thing I can think of, there are people out there who can think of a hundred more, and will then invest serious amounts of time and money in implementing them.

One of my favorite examples was related to Android GPS location. It's a favorite mostly because of how trivial it was, but the vast resources abusers poured into it, and I'm sure they only did it because they got even more out of it -- this large-scale abuse is all for-profit. For a long time it was easy to spoof your location without giving any evidence of the fact. This caused problems for location-based games like Pokemon Go or Ingres, who lost players because it screwed up the game[*]. So, the games started checking if the device was in developer mode, which allowed "legitimate" location spoofing. So cheaters started using bootloader-unlocked devices which they could configure to lie about being in developer mode. So games started using Android Keystore attestation (I wrote Keystore, hence why I got pulled in) to make it difficult to impossible to do that. Except that some number of official attestation keys leaked out of factories and people found they could get those and fake out the games. Also, there were some crappy devices that didn't do the Keystore security right. If you bought one of those cheap devices and modified the software, you could cheat

To this point, it's fine. Just normal security cat-and-mouse, and it keeps the number of cheaters small enough not to matter, so it's fine. But someone decided to scale it, for a fee. Someone (or some ones) set up massive device farms. One organization made some mistakes that leaked a bit of device information and allowed us to count the devices in the farm and there were tens of thousands. What did they do? They arranged to help Pokemon Go players spoof their location. If you played Pokemon Go and wanted to cheat, you could pay $5 per month and they'd give you a customized version of the game that would let you spoof your location but whenever the game asked for an attestation it would get one from one of the farm devices, all of which were hacked to be able to lie about their configuration.

That's just one example, and there are an unbelievable number of others. I recently chatted with a friend on the counter-abuse team and they are really tearing their hair out over some of the incredibly clever attacks people are mounting with AI. She couldn't give me details (and if she had, I couldn't share them).

Anyway, what's really going on here, I'm sure, is that there's some large-scale, systematic abuse of GMail storage that is to a degree that it's costing Google hundreds of millions of dollars. What exactly, I have no idea. And they think that they can address it by reducing storage for people who won't take a simple step to prove that they're real people (phone number verification). Obviously, phone number verification doesn't prove that you're a real person... but it increases the cost of large-scale abuse, and that's the point. I'm sure there will be other I'm-a-person verification schemes so those without phones have an option, but all of them will aim to inconvenience abusers and increase their costs, without too-greatly inconveniencing legitimate users.

[*] My personal experience: I played Ingres quite a lot for a couple of years, but quit it completely after one cheating event, and never went back. I spent a whole day climbing a 10,000-foot mountain peak, covered in deep snow, in the dead of winter, to capture a key portal, only to have it taken away from me 30 minutes later by someone who definitely didn't climb the mountain. I know because if they'd been there, I'd have seen them. Pissed me off so bad I deleted the app and never installed it again.

Comment Re:you will pry my texas brisket (Score 2) 85

from my cold dead hands.

I want 12+ hours of smoke on that brisket, and I don't care if it's regular or unleaded.

After all, we're all going to die at some point, but life without brisket... isn't worth living.

Unless you're cooking brisket every day, and so are a lot of your neighbors, it's not likely to be a problem.

Where it becomes an issue is when a non-trivial number of people are using it for heating their homes... which is not that uncommon in the Mountain West.

It used to be very common where I live (northern Utah), and likely would be still, but the density of woodsmoke was enough that when combined with common winter weather conditions ("temperature inversions" that trap a layer of air 2-3 thousand feet deep in the bowl created by surrounding mountains), it became a health hazard. To combat that, the government instituted "no burn days" when using a wood-burning stove in your home was prohibited. Those became common enough that most people eventually found burning wood (and coal) for home heating was annoying.

When I was a kid, my home was primarily heated with wood, plus a bit of coal at night. The house had a gas furnace, but we could cut several cords of wood from the mountains for a permit that cost about $10, plus another $30 in gas -- and our time and sweat, of course, but given the family finances, labor was cheap. That ended in the mid-90s because there were so many no-burn days that my dad gave up.

However, it's still quite common in less densely-populated areas of the Mountain West. This information may change the calculation of how dense is too dense to allow heating with wood.

Comment Re:Don't get this bit (Score 1) 44

Ah, okay. I was thinking about protecting from melting in the heat, but of course collapsing due to pressure differential would also be bad.

A large mass of cryogenic fuel/oxidizer right up against the other side of a thermally-conductive dome also makes a great heat sink. Warming the fuel will cause it to expand, but after burning a lot to get up there, tankage is not a problem.

Comment Re:Forgot how to implement a Laravel API... (Score 1) 118

Oh, I'm not talking about those at all, just how when something I studied deeply in college slips my mind, I think, "damn, getting old". Which I still think is what the person quoted was actually dealing with. You and I are used to it (if you've done anything for 40 years). This guy may have been running into it for the first time and putting the blame elsewhere.

Ah, gotcha. You were referring to the comment from the summary, not mine. Yeah, it's fun to watch the young'uns realize that they are absolutely going to spend their whole lives realizing they forgot something they used to know. It's even more fun to watch them the first time they look at code they wrote two months ago and say "Who wrote this stupid shit? Oh....".

Comment Re:Justice for some.... (Score 1) 100

When my car gets broken into the cops shrug. Once I was told I can fill out a report but it's "not going to be a priority"

Seems the rich and famous get a different justice system on both ends.

Did they steal stuff worth millions?

Though, of course, this raises the question of why someone would leave valuable masters in a suitcase in an unoccupied core.

Comment Re:But the real cost is increased service prices (Score 1) 72

Nuclear reactors use most surface water, not ground water.

Datacentres are no pickier. You can even cool a datacentre with saltwater, you just need a heat exchanger.

Also, closed loop does not evaporate. The loop is not closed if stuff escapes from it.

You're arguing with the actual terminology used in the nuclear industry. "Closed loop" or "closed cycle" designs have the water pumped in a cycle through cooling towers. The towers lose water to evaporation, taking heat with them, but the rest of the water is returned to be reheated again. "Open loop" or "open cycle" designs have no cooling towers. The water is heated and just discharged hot. They consume much more water (over an order of magnitude more), but most of that is returned. Closed loop are more common, but you see open loop in some older designs, and in seawater-cooled reactors.

Comment Re:According to the summary... (Score 1) 107

I've printed many hundreds of kg on my P1S, thanks.

I do not consider having to write data out to a card and transport it back and forth between the printer and the computer to be the pinnacle of convenience. That's something that would be considered embarrassingly inconvenient for a 1980s printer, let alone a modern net-connected device. And it's designed to be inconvenient for non-cloud prints for a reason.

Slashdot Top Deals

How long does it take a DEC field service engineer to change a lightbulb? It depends on how many bad ones he brought with him.

Working...