* Posts by JohnFen

5648 publicly visible posts • joined 20 Feb 2015

WebAssembly gets nod from W3C and, most likely, an embrace from cryptojackers online

JohnFen

Re: I will not use this

"It's basically the same as the Javascript (ECMAScript) permissions - given that WebAssembly has its roots in the "virtual machine" made in Javascript."

Yes, and I already don't allow almost any Javascript to execute in my browser.

"Seriously, the problem is not what technology you choose, but how stupid your browser manufacturer's are."

No, the problem is that websites cannot be trusted to execute code on my machine.

"You've had a webassembly-enabled browser for several years now, I guarantee it."

My browser allows me to disable it, which I do.

"Focus on the problem (browsers which don't implement proper security for their page interpretation) not the brand name on the language that exposes that (e.g. Javascript, WebAssembly)."

My problem is not improper implementations by browsers -- that's something that can be addressed. My problem is that even if the browser's security is 100% bulletproof, client-side scripting is still for more powerful and capable than I'm comfortable allowing web developers to use on my machines.

JohnFen

Re: I will not use this

How will I not always have a choice? The worst that could happen is that the bulk of the web will be unacceptable for my use, but honestly, that's already true.

JohnFen

I will not use this

It's too dangerous to allow random websites to execute code on my machine as it is, which is why I don't allow most sites to execute any client-side scripting. It's nice that WebAssembly uses a sandbox, but that doesn't really reduce the risk enough for me to be comfortable with it.

So, no WebAssembly for me.

If you want an example of how user concerns do not drive software development, check out this Google-backed API

JohnFen

Re: Why would this be necessary?

"If a company wants to know if an app is installed, TRY to launch it."

It is quite literally none of their goddamned business what apps I do or do not have installed.

JohnFen

"I do not have any "web apps" installed on my devices nor will I have any in future"

Yes, I'm in this camp. Web apps are inferior and present far more difficult security problems.

JohnFen

Re: No Chrome,...

"What are we users to do?"

I'm already resigned to the fact that it's likely that the web will become unacceptable for me to use at all in the next several years.

JohnFen

Re: No Chrome,...

"Is there hundreds or even dozens of any program?"

For most types of programs, there are indeed dozens.

JohnFen

Just a reminder

That's just a reminder that it's an excellent idea to avoid Google products.

Apple: Mysterious iPhone 11 location pings were because of 'ultra-wideband compliance'

JohnFen

Re: "We do not see any actual security implications,"

Of course they can, but I don't see how that's relevant. That there's a security concern from one vector doesn't make it OK to have security problems from other vectors.

JohnFen

I'm actually surprised

Given that Apple is so vocal about privacy and security, I'm very surprised that they'd roll this out without allowing users to disable it. I'm even more surprised that Apple said that they don't see the very obvious security/privacy problems with having it enabled.

Former Oracle product manager says he was forced out for refusing to deceive customers. Now he's suing the biz

JohnFen

"When an entire industry is based on fraud, how is that not organized crime?"

You're painting with far too wide of a brush here. The entire industry is not based on fraud. Most software manufacturers strive to produce honest, quality, working products. It's true that the megacorporations are less concerned about doing that, but they're not even close to being the entire industry.

JohnFen

Re: "Managing Customer Expectations"

I do. We use it often where I work. But what we mean by that is "make sure the customer isn't expecting more than we can deliver".

JohnFen

Re: One Not-As-Rich-as-Bill-Gates Loser Called Larry Ellison

"Wouldn't surprise me if he was proud of it"

Most assholes are proud of being assholes.

JohnFen

Say it ain't so!

Oracle selling vaporware? They'd never do that.

If there's somethin' stored in a secure enclave, who ya gonna call? Membuster!

JohnFen

Excellent

I'm always happy to have a means by which I can stop my machines from keeping secrets from me.

Trump Administration fast-tracks compulsory border facial recognition scans for all US citizens

JohnFen

Re: State border crossings, too

Yes. Fortunately, that check is extremely cursory. All they do is ask you if you have any prohibited produce in your vehicle. If you say yes, they'll require that you dispose of them or show a permit for them. If you say no, then off you go. I've never heard of anybody actually being searched or anything.

JohnFen

Re: At a Loss For Words

Since Trump lost the popular vote, I think it's hard to say that he was elected democratically. He was elected by the electoral college, which is more of a republic sort of thing.

JohnFen

Re: Not surprising

Hmm, I chose the word in an attempt to speak truth through snark. But I guess I didn't snark hard enough!

JohnFen

Nobody will step out and ask to see your papers. They won't have to, because you'll already have been surveilled within an inch of your life. That's the entire point.

JohnFen

Yes, so what?

JohnFen

Re: Not surprising

Well, "against" was my word, not theirs. But your underlying point is well-taken nonetheless.

JohnFen

Not surprising

Remember when they promised that facial recognition would never be used against US citizens? I do. This is yet another in the ongoing cascade of promises that Trump has broken.

EFF warns of 'one-way mirror' of web surveillance by tech giants – led by Google

JohnFen

Re: The wider scope

"the individual can theoretically retain privacy by creating multiple pseudonymous digital identities that do not intersect and using them for different purposes."

This is something that I've been doing since around 1991. Every so often, I slip up and manage to get two identities correlated in some way, requiring me to nuke them both, but it generally works well.

"when the entire scope of tracking on- and off-line is taken into account it's almost impossible for separate identities not to intersect,"

I don't think it's anything close to impossible. But maintaining the separation does require more effort, and a willingness to forgo a certain level of convenience (for instance, by only buying things with cash)

"Consequently the real solution can only be to disallow tracking that is not freely permitted tracked subject"

I agree 100% with this. I'm not as skeptical as you are about the likelihood that this will happen, but I do think that if it does, it's going to take decades of fighting.

JohnFen

Re: HTML local storage hole - GDPR fails?

I'm not saying it doesn't have legitimate uses. All of the things that were added to HTML5 have legitimate uses, even the aspects that I find objectionable.

JohnFen

Re: HTML local storage hole - GDPR fails?

"Well, now, we have official 'super-cookies' -- html5 local storage can be used not just as a super cache, but to store data that javascript can read and send back to the server.... aka super-cookies."

Indeed. This is one of the many things that are part of HTML5 that make me truly despise HTML5.

JohnFen

Re: why it works

Yes, this. It's a mistake to confuse resignation with not caring.

JohnFen

Re: tracker tax

"Last but not least, the younger generations don't really feel concerned"

My observation is that the younger generations tend to be more concerned than the older generations. However, they're also more transactional, and are willing to trade personal data for services under the right circumstances. Their concern is not necessarily total privacy, but that they want to have control over who gets the data and who doesn't.

JohnFen

Re: "The problem is complex"

The problem with that is that when you put a tax on something, you've legitimized it. Tracking people without their informed consent shouldn't be legitimized, it should be very illegal.

Windows 10 Insiders: Begone, foul Store version of Notepad!

JohnFen

"This computer is a computer for my cinema room and for the HTC vive. So doesnt need updating isnt used for browsing etc and updates have broken HDR."

In that case, why not firewall that machine off so it can't talk to the internet at all? You won't get any more updates then.

JohnFen

Re: Isn't this also usually followed by...

Eh, this is a matter of taste. I have used Notepad++ in the way you're talking about, and it's OK, but I prefer other solutions.

JohnFen

Re: Isn't this also usually followed by...

Notepad++ is clearly good for lots of people, and it is well-implemented.

For me, though, it falls in a weird "in-between" place that doesn't really do me much good. It's too featureful to serve as a replacement for what I use Notepad for, and it's not featureful enough to serve as a replacement for the full-fat text editor I use for larger jobs.

JohnFen

Re: A good u-turn

"Problem with the store is that not everyone has access to it."

The other problem with the store is that it's simply unacceptable for a lot of people. I know that I'd never install anything from it, and I know lots of other people who feel the same way.

Staffer representation on our board? LMAO! Good one, cackles Microsoft

JohnFen

Re: Not a good idea

"there are things that are discussed at the board level that need to stay within that context and not be known outside of it"

Such as what the next Big Evil Thing they are going to do is, and how to keep the public from figuring it out?

AT&T subscribers back in court to crack open telco giant's $60m FTC settlement over limited 'unlimited data' plans

JohnFen

Yes, class action lawsuits do provide a means for people to opt out of the class, preserving their ability to sue on their own. The instructions about how to opt out are included with the Class Action Notification you receive. There is a cut-off date for opting out, though, so this is a "you snooze, you lose" sort of thing.

EU gets a bit STRESSED out about 5G: With great economic benefits come great security risks

JohnFen

Re: Not so sure

Good point, but they strongly imply widespread economic benefits, not just benefits to the telecoms and equipment manufacturers.

JohnFen

Not so sure

I'm not so sure that the claims that 5G will bring great economic benefits are at all well-founded.

Since the FCC won't act, Congress finally moves on robocalls by passing half-decent TRACED Act

JohnFen

"I sometimes think Idjit Pai is selling the DNCR lists to the trash callers."

I don't know if they sell it or not (I don't think they do), but those lists are absolutely made available to telemarketers, so that they know which numbers they aren't supposed to call. So yes, the FCC does make the list available to trash callers.

JohnFen

Re: Levying fines is hard

All of the times the FCC technically levied fines on domestic companies, but never bothered to actually collect them, indicates that they aren't interested in mitigating the bad behavior of US telecoms.

It's also not really necessary to chase after international robocalls. It would be effective to require domestic telecoms to put mitigations into place, and fine them if they aren't making a good faith effort (which is the approach the legislation appears to be taking). It wouldn't eliminate robocalls, but it could reduce them enough to make it possible to start answering the phone again.

JohnFen

Color me skeptical

"The TRACED Act will put an end to that nonsense."

We'll see.

"The FCC will be able to levy huge fines - although whether it actually bothers to collect them is a different matter"

This is the heart of my skepticism. The legislation doesn't require the FCC to do anything, it just gives them the authority to levy fines. I believe they already had that authority, but this makes it explicit. However, the FCC has clearly demonstrated that it doesn't actually want to do anything about this problem, and so I don't think they'll start unless they're legally compelled to.

It's Hipp to be square: What happened when SQLite creator met GitHub

JohnFen

Re: Biassed much?

"If you only listen to people that agree with everything you do, eventually you stagnante and die"

I would be terrified if everyone I interacted with agreed with everything I say and do. I rely on others to point out when I'm I'm wrong and haven't noticed. If my world were full of people who agreed with me on everything, I'd do worse that stagnate and die -- I would be actively getting more stupid with each passing day.

JohnFen

Re: Biassed much?

"So, the question might be, if GitHub and, by extension Microsoft, isn't going to care about git, then who is?"

Everyone who uses git, maybe? There are a lot more people using git than are using GitHub.

JohnFen

Re: product-specific compilers, product-specific SCMs...

"These days, I explicit block..."

The insane trend for software to phone home has made me even more strict with my firewall rules. All outgoing traffic is blocked by default, and I selectively allow programs to talk in a restricted way if needed, on a case by case basis.

JohnFen

Re: "GitHub has to be both independent and neutral"

"Personally, I do not understand what made them accept being bought. [...] GitHub was not in need of money, so it's just basic greed that made them sell out."

So then, you really do understand what made them accept being bought.

JohnFen

Exactly right

"This leads to Hipp's second point. "GitHub used to be a Git repository hosting company. But now, they are about providing other software development and management infrastructure that augments the version control. They might as well change their name to Hub at this point," he said."

This is exactly right, and this fact made it easier to abandon GitHub after the Microsoft purchase.

We are absolutely, definitively, completely and utterly out of IPv4 addresses, warns RIPE

JohnFen

Re: Convert some local addresses?

"But does that convenience outweigh the possibility that you will have to share your public IP address with 10 other customers of your ISP?"

Yes, actually. I could restrict my use without pain (for instance, I don't really need both the 192.168.* and 10.* ranges). If the range that is safe to use gets too restricted, then it just means that I'll implement something to make it work, either with fancy router tricks or switching my LAN to use IPv6. I'm not sure which way I'd go -- it all depends on what the least painful path is, and I haven't needed to conduct that analysis yet.

Internet Society says opportunity to sell .org to private equity biz for $1.14bn came out of the blue. Wow, really?

JohnFen

Re: Good for them, I suppose

"The real meaning is: as long as I live."

I think that's an overly optimistic interpretation.

Den Automation raised millions to 'reinvent' the light switch. Now it's lights out for startup

JohnFen

Re: ???

"Doesn't sound tough; maybe $40-50 per switch/socket/..."

If you don't care about transmission rates, guaranteed delivery, or security, you can do this a whole lot cheaper than that by using X10.

JohnFen

Re: Boy genius

Indeed. And, as much as people don't like to admit it, success is also more about luck than hard work. Perseverance and hard work are needed, of course, because you have to keep trying in order to catch the lucky break.

JohnFen

That is an entirely valid and rational stance.

When considering the adoption of any technology, the key question to ask is: will this cost me less (in terms of time, money, hassle, etc.) than the benefit I'll get? Excluding the people who enjoy this sort of things as a kind of hobby (which is a valid benefit), I don't see that the cost/benefit ratio is favorable for the vast majority.

JohnFen

Re: SMS

I can do this with my homebrew automation system. I can text my home and get status reports and snapshots from cameras, as well as send commands to change things. It's true that SMS is not really secure, but I have some protection: when I text my home, I need to include a password that is computed based on the time of day. If the password is wrong, then the text is ignored.

Although I can't say as I really use that functionality, so I should disable it. 99% of the time, my portable devices are hooked into my home's VPN anyway, so I can just talk directly with my automation server.