It wouldn't be hard for someone to resell SIMs (even pre-activated SIMs for a premium) to have less data on you recorded at time of said secondary transaction?
But the reseller still has to have their ID on file so they will constantly get deposed in cases where a sim card they sold was used and now the police are trying to identify the buyer. It would be a huge pain for them and I don't see it actually protecting the buyer much.
Wouldn't it be better to financially incentivise doing this, than simply force it?
That way, leadership positions can be an equation of balancing financial benefit from government incentives against financial loss from having a low quality candidate take up valuable space just because they tick a diversity box.
I'm all for diversity, I would know. I'm LGBTQ. But how CSR is often done in the corporate world is rather stultifyingly and 'token' at best.
I still think this is good - do prove me wrong - just saying it could be done better.
I'm a user on a 2019 16-inch MBP (MacBookPro16,1) who hopes to move to Linux as my base OS on this hardware full-time over the next 12 months. (https://github.com/Dunedan/mbp-2016-linux)
This is because I honestly cannot find a laptop with the combination of 64+ GB RAM, a non-NDIVIA GPU (edit: to clarify, this is because of NVIDIA's notoriously bad compatibility with Linux), and other premium hardware aspects like its market-leading trackpad at this time - and I doubt that will change anytime soon.
I live with the debilitating T2 kernel panic hardware bug every week. There's also a very bad graphics bug that I and many others are facing. (Not sure if that one can be avoided by simply using Linux.)
I just want to do away with this T2 chip, and whatever it does to get in the way of an otherwise great Intel-based computing experience. The CPU can handle all my encryption just fine...
Thank you to your team for what you're doing. I assume Apple will constantly patch T2 jailbreaks with future macOS system updates (as that's how firmware is updated), and play a long-term cat and mouse game.
While it doesn't entirely meet your specs you can get a T495 with 32GB of RAM [0] and Vega graphics. We're getting close, I am holding on to my T470 as a daily driver and it's one of the best laptops I've owned (I'm forced to use a 16" MBP for work as well - and I still prefer the T470).
One of these years we'll get a comparable AMD laptop. Fingers crossed.
Well I have slightly lower vision than most people so it prob doesn't bother me as much as it would most. But yeah that's an issue. I was actually so excited about the other components when I bought it that I kind of overlooked the resolution specs. I was / am disappointed about that aspect of it, but everything else is awesome.
Why without an Nvidia GPU? Just go with an XPS 15 or 17 and embrace Nvidia on Linux. I have three developers running Linux on HP zBooks with Nvidia GPUs without any hassle.
You can also buy any newer Thinkpad (my recommendation). They are also available with AMD CPUs.
Everyone in the Linux space, from what I regularly read and hear, says that NVIDIA GPUs are notorious and a bad idea for using Linux. They're saying go with AMD. (As well as Ryzen instead of Intel for CPUs, where possible.) The only open-source nouveau drivers are absolutely terrible, I can attest to that fact myself. There's several benefits to not relying on NVIDIA's proprietary and non-in-built drivers for a decent experience. You'll know this already, depending on how deeply and regularly you use Linux.
I will anecdotally agree; I've been a Linux laptop user for... well, 2 decades maybe? and explicitly choose Dell Mobile Precision and/or IBM/Lenovo T-series laptops with ATI/AMD, dealing with NVIDIA graphics is just a pain in the ass once we passed the GeForce era (ish).
I'd rather just have/use Intel GPU over them as well, I am not a laptop gamer to need anything NVIDIA offers in exchange for the pain in maintenance using out of tree modules to me.
Depending on which distro you use NVIDIA grapics can be quite painless. Using Pop!_OS, I just had to download the correct iso from their downloads page.
I believe most other distros have NVIDIA's drivers in their non FL/OSS repos as well.
Optimus graphics will even work with the most current drivers.
I'll agree here as well. While I'd love to get more AMD centric options without Nvidia - they're not as bad these days as it was years ago. In fact I use an Intel NUC (Skull Canyon) as my daily desktop driver. The kicker is I wanted to do some OpenCV with Nvidia and run the NUC with an eGPU on Linux. I've been doing it for years and it works surprisingly well. It's gotten even better with 'egpu-switcher' [0].
I’m using Pop!Os (preinstalled) with a sys76 laptop. Works great (can even game) battery life is terrible (though it looks fantastic and can drive a 32 inch high dpi external)
I can switch to built in Intel video for better battery but it requires a reboot. I see this as a stopgap. My home machine has an amd video.
I've used nvidia GPUs on Ubuntu with the proprietary drivers.
In my experience they're largely OK. There are some rough edges - you'll struggle to get Steam and CUDA working at the same time, for example - but no showstopping problems.
I certainly don't have a debilitating kernel panic every week :)
At my end, that's what I have to start testing on my 2019 MBP as I plan a transition to bare metal Linux fully on it, using the tools at https://github.com/Dunedan/mbp-2016-linux. (Will take several months.) I'll be sure to document it in that community and share tips when extensive testing is done.
It's only MBP NVIDIA GPU in Linux (older model) that I have extensive experience on so far, and it's been terrible with nouveau.
Nvidia gpus require proprietary drivers that are only provided for specific distros and are only supported for a small amount of time. And if you find any bug well tough luck, nobody can help you. For a work setup that you rely on someone else in the company for support they might be fine but I wouldn't recommend them for a personal setup.
All this is on top of the fact that they still don't support Wayland and you have to reboot to switch between the igpu and the nvidia gpu.
10 years of support on the latest driver branch (current branch goes back to the 600 series, and the 400 series was dropped in June) doesn’t exactly seem like a small amount of time.
>Last time I looked, it was perfectly possible to install them directly, without support by the distro. Yes, it's more work.
Yes, you can install them and they will break with every single update and you need to re-install them. And you will encounter bugs that no-one has any idea why they are there and no-one will help you with.
>There's an open source driver, nouveau, but of course it's behind the newest hardware.
It's not just behind, it's actively sabotaged by nvidia by locking basic hardware functions behind closed firmware that it encrypted.
> I honestly cannot find a laptop with the combination of 64 GB RAM, a non-NDIVIA GPU, and other premium hardware like its market-leading trackpad at this time
I really hope so. I'm even willing to give up the Apple trackpad if something else comes that lines everything else up. I tried so hard a couple of weeks ago to find something non-Apple that ticked all the boxes, and was shocked my existing MBP was the only one that ticked enough of them. I'm waiting and waiting for an explicitly Linux-supporting manufacturer to offer a truly high end and Linux-friendly laptop. It's a holy grail right now.
Education or information is not control or nannying. Decision != informed decision.
I think any regulation that at minimum benefits consumers when it's hardly anything for corporations to add to their existing labelling is good for society and a great allocation of resources.
This is different to the forced wearing seatbelts when driving, which genuinely forces the restriction of one's physical freedom, and yet benefits no one else but you (within the scope of your own decisions) if you have a car accident.
A lot of commonplace stuff can cause harm above a certain dosage. Which is partially why Prop 65 is failing.
99% of things in Prop 65 are fine in moderation. And the 1% that isn't (I would love to be warned of that myself) - well, it's lost among everything else.
Right. Obviously if they put the sign on nothing, no information would be communicated. And the same if they put it on "50% of things" (defined however you like) because everyone knows the median thing isn't a real cancer risk. Maybe it could communicate the breaking of some threshold, but not a meaningful one.
To be truly informative, binary cancer warnings should be rare -- they should appear near a threshold where reasonable people are likely to be swayed by them (but not certain to be swayed by them -- at that point we're probably labeling too few things.)
But enough about binary labels, though. They should have to put figures on them: "Scientists believe that the cancer risk of this cup of coffee is statistically expected to decrease your lifespan by 5 minutes, plus or minus a day, with 95% confidence."
The issue isn't that the regulation is providing education. It's that the state mandates everyone put idiotic signs that are obviously meaningless everywhere.
If the state wanted to be useful they should maintain a useful and easy to understand list of common substances and explain in simple terms exactly what the risk is.
More creation, less control of people for no benefit.
OK, thanks for the education. That makes sense. Didn't know that. I do not live in CA.
But where should we draw the line and balance the scales of helping or promoting human health (including education, which can save lives), restricting businesses who don't care about human health, and allowing citizens to have the freedom to be as unhealthy as they want (which I'll agree should be a human right)?
With cigarettes, the most alarming label messaging doesn't seem to stop its most determined users from enjoying them. Was a fierce cultural war fought against that regulation? IIRC, yes. (From a documentary.)
One factor here seems to be a war for freedom of diet and lifestyle, extending to the desire to not even have to see messages that tell you your lifestyle may be unhealthy for you (or your children), even if the science is clear.
If there's no mention of dose and the warning is based on substandard, uncontrolled evidence, what are you really learning? That if you repeat a small-N "experiment" enough times with the toxin of our choice, some rodent will develop cancer?
Hope I don't get downvoted, but I like to entertain plausible but low probability ideas because my creative mind goes there:
What if some outages like this are the US government performing security attack testing to test infrastructure of PRISM-like partners (or just anyone economically important to the US), so that when real attacks come from cyber enemy states like China, things have already been probed to see what needs to be fixed.
Kind of like national security HIIT, so your body politic is ready for war. National security is about economic health too. It's all part of the one picture.
Not a impossibility but there's nothing to support this. Unsupported accusations are just conspiracy theories without a cult following behind them [yet].
If I were offering a free (as in price) alternative to MS Office, I'd first recommend WPS Office over LibreOffice, even though it's closed-source. It has a much better interface out of the box. But I'd use something to block it from phoning home to its probably Chinese government-beholden servers, like OpenSnitch for Linux* or LuLu for macOS.
If I may, in my experience Softmaker is not bad at all (still closed source and Commercial, but affordable), LibreOffice simply does not fit, for very light use LibreOffice is fine, but still has - here and there - too many "quirks".
To me, what matters most is privacy and freedom. -> Open-source transparency of code, data, and all that happens with it. (Including the ability to fully control and see what's happening in your system at the network level, like OpenSnitch - https://github.com/gustavo-iniguez-goya/opensnitch).
I don't see any of MSFT's actions threatening this on a really big picture level. It's always been and always will be up to 'the community' to build and make Linux and free software what it is.
Linux, especially Linux Desktop, is wonderfully flourishing right now, and I don't think it's because 'MS hasn't offered a more compelling alternative to Linux' in the cloud. More largely, it's because we've built what we've wanted. Maybe I'm naive about what we've been ungratefully depending on. If so, I'd settle for a mildly cautious and watchful neutral ground. All I can say is, please contribute to Linux and FOSS if you can. I do.
> Linux, especially Linux Desktop, is wonderfully flourishing right now [...] because we’ve built what we’ve wanted
I agree, but it has to be said that this has also happened because desktop features across the board have stagnated.
There has been little evolution of desktop features in the last 15 years on Windows and Mac; MS and Apple are focused on other things, namely services integration to increase revenue and convergence with mobile OSes to reduce costs. This has allowed the Linux desktop to catch on and solidify, by not having to constantly chase feature-matching. Same for hardware support: new devices and ports for the desktop and laptop market have been few and far between; if anything things are getting simpler (USB-C for everyone, no cd, no modem, etc).
I have no doubt that both Apple and MS could destroy the attractiveness of Linux desktops very quickly if they focused a bit more resources on evolving their desktops.
They won't. Such backdoors would have to be hidden from Joe Average Coder at Microsoft first and foremost. Coding for MS is not a livelong thing, you know? So any backdoor would a) be obfuscated and b) have some form of plausible deniability. If I would have to make them, they would look like strings of two or three bugs.
Likely you're right, but let's see if anything can become plausibly demonstrable after obsessive scrutiny. Like many situations in life, it may depend on whether someone determined / resourceful enough wants to do this. There may be no one with sufficient motivation.
Also, it's not just (allegedly) all of XP source that's been leaked:
It's also Windows Server 2003, MS DOS 3.30, MS DOS 6.0, Windows 2000, Windows CE 3, Windows CE 4, Windows CE 5, Windows Embedded 7, Windows Embedded CE, Windows NT 3.5, and Windows NT 4!
Do you know if there is source code for classic Windows apps like the Calculator, Notepad or Paint? Would love to recreate those simple apps and chuck the lousy Linux/Mac equivalents.
As a recall, making notepad is like a homework assignment for a visual basic class. You just drag the text editor window and add the menus, there isn't a whole lot there!
Paint would probably be a bit more work, but there are a few clones out there already
Really looking to build a tool with the same look and feel. Launches fast, can just paste text stripping formatting and then allow you to save it as txt or copy it as is to other apps. A typical Ubuntu install gives you something like gedit2 or pluma. Too much for a text editor. Same goes for Paint. I can't believe that I have to install a heavy app like Gimp, Pinta or Krita. They are significantly more heavy and less stable in my experience. The simplicity of these tools make their brilliance.
The same goes for Mac. Mac has "textEdit" and "Notes" apps but it handles formatting, is slower to launch and is more of a Wordpad clone. For Paint, their Preview tool is terrible. I just want to take a screenshot, paste it in a file, maybe add a red circle or square and save it as png. Quick and fast.
There is no reason to build them for Windows. I just use the ones already available for Windows. I want to build it for Mac so I can get the great simple tools on Windows but on the stability of Mac. For Paint I have resorted to buying a Mac Store app called Paint2 made by some Chinese developer. It is still too complex but is the best I can do now.
If it really does exist, the backdoor can simply be inserted during the last-minute compile before release. It would be invisible in the code repository, the vast majority of internal developers at Microsoft won't even see anything unusual. Also, I heard anecdotes that Microsoft already allowed governments to audit the source code of Windows under NDA on multiple occasions in the past.
But if you cannot guarantee the correspondence between source and binary releases, such a review only helps a little. Reproducible build is crucial for auditability.
> I heard anecdotes that Microsoft already allowed governments to audit the source code of Windows under NDA on multiple occasions in the past.
I can confirm that back in the Windows 2000 days, MS let a major global bank have access to the Windows 2000 source code to aid them in coding some low level bespoke software.
Back then, if you were a gold customer, you could pretty much get anything out of MS under an NDA.
'MS let a major global bank have access to the Windows 2000 source code to aid them in coding some low level bespoke software.'
Examples of this are comparatively well known but it seems to me it's really not relevant here. In those instances it's extremely unlikely that said institutions would have access to even the majority of the source code let alone all of it.
All they need are API hooks and or various security code that's relevant for their purposes, etc. If I were the Microsoft person responsible for interfacing with these banks, I'd do what I've done with unrelated stuff, which is to tell them just sufficient to do the job (that's to say only on a need-to-know basis).
And that's why modern compilers won't have that. It was exactly so the same source, even compiled a second later, it will generate different binary file.
I hate it. It was so easy in DOS era - same source, same binary file, easy peasy.
The major variables in modern compilers are just automatic timestamps, exploit mitigation random seeds, and toolchain versions, it is possible to make them immutable. The problem can be fixed, and there are already major projects to address it. Do you know that 90% of the Debian packages are already reproducible [0]?
That’s true. But that may also be a plausible deniability thing - you create a place to hide binary modifications by making sure no two builds are exactly the same.
It could be chalked to some lack of care; however, up until 2000 or so, non reproducible builds were considered a bug in at least two places I worked in. The fact that it has become so hard to make builds reproducible could be Increased “entropy” (because no one cares To fix it) - but it could also be orchestrated by someone with a vested interest.
E.g. - suppose you are a three letter agency, and want to implement a “reflections on trusting trust” attack. Non reproducible builds become a pre-requisite.
This is correct. Back at least in the Vista days each public release had to be passed to the NSA to validate the encryption algorithms and implementation. I’d imagine they poked around a few other parts of the OS
The NSA has a dual mandate - to improve security for the US government (and by extension, US businesses to an extent), and to peek into communications outside the US.
They have been pretty negligent about the first (or even malicious about it - e.g. the dual drbg case), letting the second take over - but officially they still have the first mandate.
In fact, DES was considerably strengthened in its day by the NSA review - at that time for reasons not understood by industry or academia. It was later discovered that the change required by the NSA made DES much more resistant to differential cryptanalysis, a technique that was (re)discovered by academic cryptographers much later.
Every “conspiracy” I’ve heard about the NSA and friends turned out to be true, most with definite proof from the Snowden releases.
> Every “conspiracy” I’ve heard about the NSA and friends turned out to be true
And therefore every next thing anyone on the Internet concocted has to be true as well?
I get what you're saying though, and I'm well aware of the dual mandate. But you haven't given me anymore reason to believe this particular one, and I find it strange because I've never heard of any company in any country having to give their software to an intelligence agency before being allowed to release only the modified version. Implanting backdoors is not unheard of, but after they had great success with the clipper chip it's usually done without the company in question knowing about it.
You say the excuse was to validate some implementation, but in that case Microsoft wouldn't need to publish any modified versions, the nsa would just point out "this contains too strong crypto, can't export this" or "you made a mistake in algo X allowing attack Y". Not "please substitute this dll with our version and better not tell your customers!".
You are reading too much into cududa’s comment and mine, quite a bit of things neither of us said.
Cududa mentioned Microsoft let the NSA review it - that it was procedure, not that it was law. Furthermore, no one claimed that NSA recommendations or replacement DLLs had to be used by law - though that makes little difference. I mentioned that this would be in line with well known history of DES development. That’s basically all we said about it.
I have no idea what you are referring to with the Clipper chip. But RSA, NIST and others were definitely aware they were peddling NSA recommendations With the dual-drbg fiasco.
EternalBlue was probably the biggest backdoor used by the US government for years and even Microsoft (at least officially) didn't know about it. Finding and not reporting bugs is much easier than getting a company to put in backdoors without anyone blowing the whistle or objecting.
There's a possibility the leaked files are tampered from the original code anyway, i.e. backdoors were removed before being initially leaked. Rationale being that Microsoft / government wanted to control the situation long-term by letting something tampered be what leaks out underground instead of the 100% full thing.
There have always been rumors about such back doors, but even the public ones, encryption schemes, have never been proven by pure analysis. As far as back doors in code goes, have a look at this: http://underhanded-c.org/. It's a pity it seems to have been short lived.
Then it needs some authoritative source, a leak, or result of a raid. Which was my point: analyzing the Windows XP code most likely is not going to prove there's a US mandated backdoor.
Plausible deniability where people can look is a huge thing. Even where people can’t Easily look - e.g. Intel ME “firmware”, it’s likely done as shoddy/buggy coding, so Intel can just look incompetent (and not downright malicious) when it does come out.
Russia and China aren’t buying any of this, and are fabricating their own chips. 5-Eyes are likely in on the thing so no reason for them to set up their own fab facilities.
But setting up your own software ecosystem is much easier (especially given Linux / BSD), even though it’s still expensive - so intelligence agencies would rather not give countries incentive to do so just because there’s a back door.
