Monday, 25 May

04:44

Russ Allbery: Review: The Last Emperox [Planet Debian]

Review: The Last Emperox, by John Scalzi

Series: Interdependency #3
Publisher: Tor
Copyright: April 2020
ISBN: 0-7653-8917-7
Format: Kindle
Pages: 318

This is the conclusion of the Interdependency trilogy, which is a single story told in three books. Start with The Collapsing Empire. You don't want to read this series out of order.

All the pieces and players are in place, the causes and timeline of the collapse of the empire she is accidentally ruling are now clear, and Cardenia Wu-Patrick knows who her friends and enemies are. What she doesn't know is what she can do about it. Her enemies, unfettered Cardenia's ethics or desire to save the general population, have the advantage of clearer and more achievable goals. If they survive and, almost as important, remain in power, who cares what happens to everyone else?

As with The Consuming Fire, the politics may feel a bit too on-the-nose for current events, this time for the way that some powerful people are handling (or not handling) the current pandemic. Also as with The Consuming Fire, Scalzi's fast-moving story, likable characters, banter, and occasional humorous descriptions prevent those similarities from feeling heavy or didactic. This is political wish fulfillment to be sure, but it doesn't try to justify itself or linger too much on its improbabilities. It's a good story about entertaining people trying (mostly) to save the world with a combination of science and political maneuvering.

I picked up The Last Emperox as a palate cleanser after reading Gideon the Ninth, and it provided exactly what I was looking for. That gave me an opportunity to think about what Scalzi does in his writing, why his latest novel was one of my first thoughts for a palate cleanser, and why I react to his writing the way that I do.

Scalzi isn't a writer about whom I have strong opinions. In my review of The Collapsing Empire, I compared his writing to the famous description of Asimov as the "default voice" of science fiction, but that's not quite right. He has a distinct and easily-recognizable style, heavy on banter and light-hearted description. But for me his novels are pleasant, reliable entertainment that I forget shortly after reading them. They don't linger or stand out, even though I enjoy them while I'm reading them.

That's my reaction. Others clearly do not have that reaction, fully engage with his books, and remember them vividly. That indicates to me that there's something his writing is doing that leaves substantial room for difference of personal taste and personal reaction to the story, and the sharp contrast between The Last Emperox and Gideon the Ninth helped me put my finger on part of it. I don't feel like Scalzi's books try to tell me how to feel about the story.

There's a moment in The Last Emperox where Cardenia breaks down crying over an incredibly difficult decision that she's made, one that the readers don't find out about until later. In another book, there would be considerably more emotional build-up to that moment, or at least some deep analysis of it later once the decision is revealed. In this book, it's only a handful of paragraphs and then a few pages of processing later, primarily in dialogue, and less focused on the emotions of the characters than on the forward-looking decisions they've made to deal with those emotions. The emotion itself is subtext. Many other authors would try to pull the reader into those moments and make them feel what the characters are feeling. Scalzi just relates them, and leaves the reader free to feel what they choose to feel.

I don't think this is a flaw (or a merit) in Scalzi's writing; it's just a difference, and exactly the difference that made me reach for this book as an emotional break after a book that got its emotions all over the place. Calling Scalzi's writing emotionally relaxing isn't quite right, but it gives me space to choose to be emotionally relaxed if I want to be. I can pick the level of my engagement. If I want to care about these characters and agonize over their decisions, there's enough information here to mull over and use to recreate their emotional states. If I just want to read a story about some interesting people and not care too much about their hopes and dreams, I can choose to do that instead, and the book won't fight me. That approach lets me sidle up on the things that I care about and think about them at my leisure, or leave them be.

This approach makes Scalzi's books less intense than other novels for me. This is where personal preference comes in. I read books in large part to engage emotionally with the characters, and I therefore appreciate books that do a lot of that work for me. Scalzi makes me do the work myself, and the result is not as effective for me, or as memorable.

I think this may be part of what I and others are picking up on when we say that Scalzi's writing is reminiscent of classic SF from decades earlier. It used to be common for SF to not show any emotional vulnerability in the main characters, and to instead focus on the action plot and the heroics and martial virtues. This is not what Scalzi is doing, to be clear; he has a much better grasp of character and dialogue than most classic SF, adds considerable light-hearted humor, and leaves clear clues and hooks for a wide range of human emotions in the story. But one can read Scalzi in that tone if one wants to, since the emotional hooks do not grab hard at the reader and dig in. By comparison, you cannot read Gideon the Ninth without grappling with the emotions of the characters. The book will not let you.

I think this is part of why Scalzi is so consistent for me. If you do not care deeply about Gideon Nav, you will not get along with Gideon the Ninth, and not everyone will. But several main characters in The Last Emperox (Mance and to some extent Cardenia) did little or nothing for me emotionally, and it didn't matter. I liked Kiva and enjoyed watching her strategically smash her way through social conventions, but it was easy to watch her from a distance and not get too engrossed in her life or her thoughts. The plot trundled along satisfyingly, regardless. That lack of emotional involvement precludes, for me, a book becoming the sort of work that I will rave about and try to press into other people's hands, but it also makes it comfortable and gentle and relaxing in a way that a more emotionally fraught book could not be.

This is a long-winded way to say that this was a satisfying conclusion to a space opera trilogy that I enjoyed reading, will recommend mildly to others, and am already forgetting the details of. If you liked the first two books, this is an appropriate and fun conclusion with a few new twists and a satisfying amount of swearing (mostly, although not entirely, from Kiva). There are a few neat (albeit not horribly original) bits of world-building, a nice nod to and subversion of Asimov, a fair bit of political competency wish fulfillment (which I didn't find particularly believable but also didn't mind being unbelievable), and one enjoyable "oh no she didn't" moment. If you like the thing that Scalzi is doing, you will enjoy this book.

Rating: 8 out of 10

Someone Comes to Town, Someone Leaves Town (part 04) [Cory Doctorow's craphound.com]

Here’s part four of my new reading of my novel Someone Comes to Town, Someone Leaves Town (you can follow all the installments, as well as the reading I did in 2008/9, here).

In this installment, we meet Kurt, the crustypunk high-tech dumpster-diver. Kurt is loosely based on my old friend Darren Atkinson, who pulled down a six-figure income by recovering, repairing and reselling high-tech waste from Toronto’s industrial suburbs. Darren was the subject of the first feature I ever sold to Wired, Dumpster Diving, which was published in the September, 1997 issue.

This is easily the weirdest novel I ever wrote. Gene Wolfe (RIP) gave me an amazing quote for it: “Someone Comes to Town, Someone Leaves Town is a glorious book, but there are hundreds of those. It is more. It is a glorious book unlike any book you’ve ever read.”

Here’s how my publisher described it when it came out:

Alan is a middle-aged entrepeneur who moves to a bohemian neighborhood of Toronto. Living next door is a young woman who reveals to him that she has wings—which grow back after each attempt to cut them off.

Alan understands. He himself has a secret or two. His father is a mountain, his mother is a washing machine, and among his brothers are sets of Russian nesting dolls.

Now two of the three dolls are on his doorstep, starving, because their innermost member has vanished. It appears that Davey, another brother who Alan and his siblings killed years ago, may have returned, bent on revenge.

Under the circumstances it seems only reasonable for Alan to join a scheme to blanket Toronto with free wireless Internet, spearheaded by a brilliant technopunk who builds miracles from scavenged parts. But Alan’s past won’t leave him alone—and Davey isn’t the only one gunning for him and his friends.

Whipsawing between the preposterous, the amazing, and the deeply felt, Cory Doctorow’s Someone Comes to Town, Someone Leaves Town is unlike any novel you have ever read.

MP3

02:31

Kernel prepatch 5.7-rc7 [LWN.net]

The 5.7-rc7 kernel prepatch is out. "So it looks like I was worried for nothing last rc. Of course, anything can still change, but everything _looks_ all set for a regular release scheduled for next weekend. Knock wood."

Sunset, 5/24/20 [Whatever]

Some good drama in this one.

Have an excellent rest of your Sunday, folks.

02:10

Enrico Zini: Music links [Planet Debian]

It's the end of the world as we know it, twice as fast
After Homemade Instruments Week on the facebook page, here is an article with some PVC pipes instruments! Percussion on PVC pipes A classic, long pipes for big bass, easy to tune by changing the length …
"Ut queant laxis" or "Hymnus in Ioannem" is a Latin hymn in honor of John the Baptist, written in Horatian Sapphics and traditionally attributed to Paulus Diaconus, the eighth-century Lombard historian. It is famous for its part in the history of musical notation, in particular solmization. The hymn belongs to the tradition of Gregorian chant.

Only The Finest [QC RSS]

Rear admiral woofing ton

01:20

Masks Now Available to Order [Nina Paley]

Angel O’ Death masks (screen prints as complete masks and kits) and hand-printed Angel O’ Death and Eyes of the Goddess masks are now available at http://www.palegraylabs.com/seder-masochism . Eyes of the Goddess screen print masks will be available later, once I get a batch screenprinted. Please be patient as these aren’t all sewn and packaged yet. But the materials are all ready, and the production has been proven!

Share

00:35

Releasing prisoners convicted of nonviolent crimes [Richard Stallman's Political Notes]

Releasing prisoners convicted (or merely accused) of nonviolent crimes not only protects them from Covid-19. It helps protect the whole community.

The article mentions the figure of "5,000%", which always tends to mislead.

Percentages are a clear way of stating the difference between two figures only when the percentage difference is under 100%. For an increase which more than doubles the figure, using percent to represent it is a method of exaggeration. Instead of saying "5,000% more", say "50 times as much." That is a big increase indeed, but has nothing to do with 5,000.

Government us of location tracking by portable phones [Richard Stallman's Political Notes]

Many governments have increased the use of location tracking by portable phones, in the name of Covid-19, even though that location data is not precise enough to be of any use for contact tracing.

However, human rights organizations are fighting back.

As for me, I don't want to carry a personal tracking device. And they can be used also as listening devices. I have never had one and I never will.

My not having one also assures I will never use the other systems that piggyback on a mobile phone to track or identify people. No contactless payments. No use-a-text-message-to-log-in.

Please join the resistance against pressure to use systems that track you. Just start saying no, even to some of them, and mention this in your mail signatures, your profiles, etc.

Federal funding to increase Covid-19 testing and contact tracing [Richard Stallman's Political Notes]

Senator Warren and Rep. Andy Levin propose federal funding to increase Covid-19 testing and contact tracing as the base for freeing the US of the disease.

This would be a great step towards the task of world-wide eradication.

Senate plan to cut Social Security [Richard Stallman's Political Notes]

The Senate plan to cut Social Security, proposed by Mitt Romney, has support even from some nominal Democrats in the senate.

This shows that even though Romney has criticized the conman, he is nonetheless part of dooH niboR's cruel band.

Postal Voting [Richard Stallman's Political Notes]

Indigenous people in the US will be at a disadvantage in postal voting.

Smaller microplastic particles are more numerous in the ocean [Richard Stallman's Political Notes]

Most measurements of microplastics in the ocean detect only milliplastics, since they use a strainer with holes .5mm across. A survey with .1mm holes found that the smaller particles are more numerous.

The .1mm-.5mm particles add up to much less mas of plastic than the larger ones. However, if toxins leak out in proportion to surface area, they could leak quantities disproportionate to their masses. Also, they could be eaten by smaller animals that could not ingest a .5mm particle, and enter the food chain lower down.

Climate risks and opportunities need to be incorporated into the financial system [Richard Stallman's Political Notes]

* Climate risks and opportunities need to be incorporated into the financial system as well as public policymaking and infrastructure.*

*We now have the proof: greening the economy doesn't come at the price of prosperity. The investment to rebuild economic activity can be directed towards a green economy and still rebuild economic activity.

The obstacle, as usual, is the control that planet roasters have over several important countries, including especially the US. Doing anything good will require overcoming their political power.

Sunday, 24 May

23:21

Link [Scripting News]

Thread: A friend tells me that Node does breaking releases regularly. I've been working in Node for seven years so far and it hasn't affected me yet. So they must not be heavy earth-shaking things.

Link [Scripting News]

I have been trained not to click on links to most news sites because the experience is so unpleasant.

22:51

Dirk Eddelbuettel: #3 T^4: Customizing The Shell [Planet Debian]

The third video (following the announcement, the shell colors) one as well as last week’s shell prompt one, is up in the stil new T^4 series of video lightning talks with tips, tricks, tools, and toys. Today we cover customizing the shell some more.

The slides are here.

This repo at GitHub support the series: use it to open issues for comments, criticism, suggestions, or feedback.

If you like this or other open-source work I do, you can now sponsor me at GitHub. For the first year, GitHub will match your contributions.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

22:36

Which VPN Providers Really Take Anonymity Seriously in 2020? [TorrentFreak]

The VPN industry is booming and prospective users have hundreds of options to pick from. All claim to be the best, but some are more anonymous than others.

The VPN review business is also flourishing. Just do a random search for “best VPN service” or “VPN review” and you’ll see dozens of sites filled with recommendations and preferred picks.

We don’t want to make any recommendations. When it comes to privacy and anonymity, an outsider can’t offer any guarantees. Vulnerabilities are always lurking around the corner and even with the most secure VPN, you still have to trust the VPN company with your data.

Instead, we aim to provide an unranked overview of VPN providers, asking them questions we believe are important. Many of these questions relate to anonymity and security, and the various companies answer them in their own words.

We hope that this helps users to make an informed choice. However, we stress that users themselves should always make sure that their VPN setup is secure, working correctly, and not leaking.

This year’s questions and answers are listed below. We have included all VPNs we contacted that don’t keep extensive logs or block torrent traffic on all of their servers.

The order of the providers is arbitrary and doesn’t carry any value. A few links in this article are affiliate links. This won’t cost you a penny more but it helps us to keep the lights on.

1. Do you keep (or share with third parties) ANY data that would allow you to match an IP-address and a timestamp to a current or former user of your service? If so, exactly what information do you hold/share and for how long?

2. What is the name under which your company is incorporated (+ parent companies, if applicable) and under which jurisdiction does your company operate?

3. What tools are used to monitor and mitigate abuse of your service, including limits on concurrent connections if these are enforced?

4. Do you use any external email providers (e.g. Google Apps), analytics, or support tools ( e.g Live support, Zendesk) that hold information provided by users?

5. In the event you receive a DMCA takedown notice or a non-US equivalent, how are these handled?

6. What steps would be taken in the event a court orders your company to identify an active or former user of your service? How would your company respond to a court order that requires you to log activity for a user going forward? Have these scenarios ever played out in the past?

7. Is BitTorrent and other file-sharing traffic allowed on all servers? If not, why? Do you provide port forwarding services? Are any ports blocked?

8. Which payment systems/providers do you use? Do you take any measures to ensure that payment details can’t be linked to account usage or IP-assignments?

9. What is the most secure VPN connection and encryption algorithm you would recommend to your users?

10. Do you provide tools such as “kill switches” if a connection drops and DNS/IPv6 leak protection? Do you support Dual Stack IPv4/IPv6 functionality?

11. Are any of your VPN servers hosted by third parties? If so, what measures do you take to prevent those partners from snooping on any inbound and/or outbound traffic? Do you use your own DNS servers?

12. In which countries are your servers physically located? Do you offer virtual locations?

Tip: Here’s a list of all VPN providers covered here, with direct links to the answers.

Private Internet Access

1. We do not store any logs relating to traffic, session, DNS or metadata. There are no logs kept for any person or entity to match an IP address and a timestamp to a current or former user of our service. In summary, we do not log, period. Privacy is our policy.

2. Private Internet Access, Inc. is an Indiana corporation, under the parent company Kape Technologies PLC, a company listed on the London Stock Exchange.

3. We have an active, proprietary system in place to help mitigate abuse including attempts to bypass our simultaneous connection limit.

4. At the moment we are using Google Apps Suite and Google Analytics on our website only with interest and demographics tracking disabled and anonymized IP addresses enabled. We utilize DeskPro for our support team.

5. Primarily, we stress that our service is not intended to be used for illegal activities and copyright infringements and we request our users to comply with this when accepting our Terms of Use. That said, we have an active, proprietary system in place to help mitigate abuse that preserves the privacy of our customers while following the letter of the law.

6. Every subpoena is scrutinized to the highest extent for compliance with both the “spirit” and “letter of the law.” While we have not received any valid court orders to identify an active or former user of service, we do periodically receive subpoenas from law enforcement agencies that we scrutinize for compliance and respond accordingly. If forced to provide logs by a court of law, Private Internet Access has verified in court multiple times that we keep no logs. Our company would fight a court order that requires us to do any sort of logging.

7. BitTorrent and file-sharing traffic are not discriminated against or throttled. We do not censor our traffic, period. We do provide port forwarding services on some of our VPN servers, check here for the full list of PIA VPN servers that support port forwarding.

8. We utilize a variety of payment systems, including, but not limited to: PayPal, Credit Card (with Stripe), Amazon, Google, Bitcoin, Bitcoin Cash, Zcash, CashU, OKPay, PaymentWall, and even support payment using major store-bought gift cards. Payment details are only linked to accounts for billing purposes. IP assignments and other user activity on our VPN servers aren’t linkable to specific accounts or payment details because of our strict and demonstrated no-log policy.

9. At the moment, the most secure and practical VPN connection and encryption algorithm that we recommend to our users would be our cipher suite of AES-256 + RSA4096 + SHA256 over OpenVPN.

10. Our users gain access to a plethora of additional tools, including but not limited to a Kill Switch, IPv6 Leak Protection, DNS Leak Protection, Shared IP System, and MACE, which protect users from malware, trackers, and ads.

11. We utilize our own bare metal servers in third-party data centers that are operated by trusted business partners with whom we have completed serious due diligence. When countries or data centers fail to meet our high privacy standards, we remove our VPN server presence as has previously happened in Brazil, South Korea, Germany, and Russia.

12. We currently operate 3,395 servers across 64 locations in 44 countries. For more information on what countries are available, please visit our PIA network page. All of our locations are physical and not virtualized.

Private Internet Access details

ExpressVPN

1. No, ExpressVPN doesn’t keep any connection or activity logs, including never logging browsing history, data contents, DNS requests, timestamps, source IPs, outgoing IPs, or destination IPs.

2. Express VPN International Ltd is a British Virgin Islands (BVI) company.

3. We reserve the right to block specific abusive traffic to protect the server network and other ExpressVPN customers. With regards to limits on the number of devices, our systems are merely able to identify how many active sessions a given license has at a given moment in time and use that counter to decide whether a license is allowed to create one additional session. This counter is temporary and is not tracked over time.

4. We use Zendesk for support tickets and SnapEngage for live chat support; we have assessed the security profiles of both and consider them to be secure platforms. We use Google Analytics and cookies to collect marketing metrics for our website and several external tools for collecting crash reports (only if a user opts into sharing these reports). ExpressVPN is committed to protecting the privacy of our users, and our practices are discussed in detail in our comprehensive Privacy Policy.

5. As we do not keep any data or logs that could link specific activity to a given user, ExpressVPN does not identify or report users as a result of DMCA notices. User privacy and anonymity are always preserved.

6. Legally our company is only bound to respect subpoenas and court orders when they originate from the British Virgin Islands government or in conjunction with BVI authorities via a mutual legal assistance treaty. As a general rule, we reply to law enforcement inquiries by informing the investigator that we do not possess any data that could link activity or IP addresses to a specific user. Regarding a demand that we log activity going forward: Were anyone ever to make such a request, we would refuse to re-engineer our systems in a way that infringes on the privacy protections that our customers trust us to uphold.

Not storing any sensitive information also protects user privacy and security in the event of law enforcement gaining physical access to servers. This was proven in a high-profile case in Turkey in which law enforcement seized a VPN server leased by ExpressVPN but could not find any server logs that would enable investigators to link activity to a user or even determine which users, or whether a specific user, were connected at a given time.

7. We do not believe in restricting or censoring any type of traffic. ExpressVPN allows all traffic, including BitTorrent and other file-sharing traffic (without rerouting), from all of our VPN servers. At the moment, we do not support port forwarding.

8. ExpressVPN accepts all major credit cards, PayPal, and a large number of local payment options. We also accept Bitcoin, which we recommend for those who seek maximum privacy in relation to their form of payment. As we do not log user activity, IP addresses, or timestamps, there is no way for ExpressVPN or any external party to link payment details entered on our website with a user’s VPN activities.

9. By default, ExpressVPN automatically chooses the protocol best-suited to your network depending on a variety of factors. For example, our primary protocol, OpenVPN, uses a 4096-bit CA with AES-256-GCM encryption, TLSv1.2, and SHA256 signatures to authenticate traffic.

10. Yes, our Network Lock feature, which is turned on by default, prevents all types of traffic including IPv4, IPv6, and DNS from leaking outside of the VPN. We do not yet support IPv6 routing through the VPN tunnel. ExpressVPN also protects users from data leaks in a number of ways.

11. Our VPN servers are hosted in trusted data centers with strong security practices, where the data center employees do not have server credentials. The efforts we take to secure our VPN server infrastructure are extensive and have been audited. For example, with our proprietary TrustedServer technology, we reinstall the entire VPN server software stack from scratch with every reboot, ensuring we have complete confidence in what software is running on each of our servers and that no unauthorized software or backdoors can persist on these servers. More details are available here.

We run our own logless DNS on every server, meaning no personally identifiable data is ever stored. We do not use third-party DNS.

12. ExpressVPN has over 3,000 servers in 94 countries. For more than 97% of these servers, the physical server and the associated IP addresses are located in the same country. For countries where it is difficult to find servers that meet ExpressVPN’s rigorous standards, we use virtual locations. The specific countries are published on our website here.

ExpressVPN details

NordVPN

1. We do not keep connection logs nor timestamps that could allow us to match customers with their activity.

2. Tefincom S.A., operating under the jurisdiction of Panama.

3. We are only able to see the server load. We also use an automated tool that limits the maximum number of concurrent connections to six per customer. Apart from that, we do not use any other tools.

4. NordVPN uses third-party data processors for emailing services and to collect basic website and app analytics. We use Iterable for correspondence, Zendesk to provide customer support, Google Analytics to monitor website and app data, as well as Crashlytics, Firebase Analytics and Appsflyer to monitor application data. All third-party services we use are bound by a contract with us to never use the information of our users for their own purposes and not to disclose the information to any third parties unrelated to the service.

5. NordVPN is a transmission service provider, operating in Panama. DMCA takedown notices are not applicable to us.

6. If the order or subpoena is issued by a Panamanian court, we would have to provide the information if we had any. However, our zero-log policy means that we do not store any information about our users’ online activity – only their email address and basic payment info. So far, we haven’t had any such cases.

7. We do not restrict any BitTorrent or other file-sharing applications on most of our servers. We have optimized a number of our servers specifically for file-sharing. At the moment, we do not offer port forwarding and block outgoing SMTP 25 and NetBIOS ports.

8. Our customers are able to pay via all major credit cards, regionally localized payment solutions and cryptocurrencies. Our payment processing partners collect basic billing information for payment processing and refund requests, but they cannot be connected to an internet activity of a particular customer. Bitcoin is the most anonymous option, as it does not link the payment details to the user identity or other personal information.

9. All our protocols are secure, however, the most advanced encryption is used by NordLynx. NordLynx is based on the WireGuard® protocol and uses ChaCha20 for encryption, Poly1305 for authentication and integrity, and Curve25519 for the Elliptic-curve Diffie–Hellman key agreement protocol.

10. We provide automatic kill switches and DNS leak protection. Dual-Stack IPv4/IPv6 functionality is not yet supported with our service; however, all NordVPN apps offer an integrated IPv6 Leak Protection.

11. Most of our servers are leased; however, the security of our infrastructure is our top priority. To elevate our standards to a higher level, we have partnered with VerSprite, a global leader in cybersecurity consulting and advisory services. Due to our special server configuration, no one is able to collect or retain any data, ensuring compliance with our no-logs policy. We do have our own DNS servers, and all DNS requests travel through a VPN tunnel. Our customers can also manually setup any DNS server they like.

12. We do not offer virtual locations, our servers are located in places we state they are. At the time of writing, we have almost 6000 servers in 59 countries.

NordVPN details

HideIPVPN

1. We do not store or share any such information that allows doing that. The only information we store is that related to the payment process. But it is not shared anywhere outside the payment systems.

2. The registered name of the company is Server Management LLC and we operate under US jurisdiction.

3. A single subscription can be used simultaneously for three connections. Abuses of service usually mean using non-P2P servers for torrents or DMCA notices.

Also, our no-log policy makes it impossible to track who downloaded/uploaded any data from the internet using our VPN. We use IPtables plugin to block P2P traffic on servers where P2P is not explicitly allowed. We block outgoing mail on port 25 to prevent spamming activity.

4. We use the live chat provided by tawk.to and Google Apps for incoming email. For outgoing email, we use our own SMTP server.

5. Since no information is stored on any of our servers there is nothing that we can take down. We reply to the data center or copyright holder that we do not log our user’s traffic and we use shared IP-addresses, which make it impossible to track who downloaded any data from the internet using our VPN.

6. HideIPVPN may disclose information, including but not limited to, information concerning a client, to comply with a court order, subpoena, summons, discovery request, warrant, statute, regulation, or governmental request. But because we have a no-logs policy and we use shared IPs there won’t be anything to disclose, excepting billing details. This has never happened before.

7. This type of traffic is welcomed on our German (DE VPN), Dutch (NL VPN), Luxembourg (LU VPN) and Lithuanian (LT VPN) servers. It is not allowed on US, UK, Canada, Poland, Singapore, and French servers as stated in our TOS. The reason for this is our agreements with data centers. We do not allow port forwarding and we block ports 22 and 25 for security reasons.

8. HideIPVPN accepts the following methods: PayPal, Bitcoin, Credit & Debit cards, JCB, American Express, Diners Club International, Discover. All our clients’ billing details are stored in the WHMCS billing system.

9. SoftEther VPN protocol looks very promising and secure. Users can currently use our VPN applications on Windows and OSX systems. Both versions have a “kill switch” feature in case the connection drops. Our apps can re-establish a VPN connection and once active restart closed applications. Also, the app has the option to enable DNS leak protection.

10. Yes, our free VPN apps have both features built-in. It is worth mentioning that our free VPN apps for Windows and macOS – there is a brand new version of them – have even more cool and unique features. We were one of the first – if not THE FIRST – to introduce as you call it a “kill switch” in our apps. Now, we give users the ability to easily choose the best, “fastest” VPN server available for them in their location – a “Sort by speed” option.

11. We don’t have physical control of our VPN servers. Servers are outsourced in premium data-centers with high-quality Tier 1 networks. Our servers are self-managed and access is restricted to our personnel only.

12. At the moment we have VPN servers located in 11 countries – US, UK, Netherlands, Germany, Luxembourg, Lithuania, Canada, Poland, France, Australia and Singapore.

HideIPVPN website

IVPN

1. No. We believe that not logging VPN connection related data is fundamental to any privacy service regardless of the security or policies implemented to protect the log data. Specifically, we don’t log: traffic, DNS requests, connection timestamps and durations, bandwith, IP address or any account activity except simultaneous connections.

2. Privatus Limited, Gibraltar. No parent or holding companies.

3. We limit simultaneous connections by maintaining a temporary counter on a central server that is deleted when the user disconnects (we detail this process in our Privacy Policy).

4. No. We made a strategic decision from day one that no company or customer data would ever be stored on third-party systems. All our internal services run on our own dedicated servers that we setup, configure and manage. No third parties have access to our servers or data. We don’t host any external scripts, web trackers or tracking pixels on our website. We also refuse to engage in advertising on platforms with surveillance-based business models, like Google or Facebook.

5. Our legal department sends a reply stating that we do not store content on our servers and that our VPN servers act only as a conduit for data. In addition, we inform them that we never store the IP addresses of customers connected to our network nor are we legally required to do so. We have a detailed Legal Process Guideline published on our website.

6. Firstly, this has never happened. However, if asked to identify a customer based on a timestamp and/or IP address then we would reply factually that we do not store this information. If legally compelled to log activity going forward we would do everything in our power to alert the relevant customers directly (or indirectly through our warrant canary).

7. We do not block any traffic or ports on any servers. We provide a port forwarding service.

8. We accept Bitcoin, Cash, PayPal, and credit cards. When using cash there is no link to a user account within our system. When using Bitcoin, the transaction is processed through our self-hosted BitPay server. We store the Bitcoin transaction ID in our system.
If you wish to remain anonymous to IVPN you should take the necessary precautions when purchasing Bitcoin. When paying with PayPal or a credit card a token is stored that is used to process recurring payments but this is not linked in any way to VPN account usage or IP-assignments.

9. We offer and recommend WireGuard, a high-performance protocol that utilizes state-of-the-art cryptography. Since its merge into Linux Kernel (v5.6) and the release of 1.0 version of the protocol, we consider it to be ready for wide-scale use. Alternatively, we also offer OpenVPN with RSA-4096 / AES-256-GCM, which we also believe is more than secure enough for the purposes for which we provide our service.

10. Yes, the IVPN client offers an advanced VPN firewall that blocks every type of IP leak possible including IPv6, DNS, network failures, WebRTC STUN etc. Our VPN clients work on a dual-stack IPv4/IPv6 but we currently only support IPv4 on our VPN gateways.

11. We use bare metal dedicated servers leased from third-party data centers in each country where we have a presence. We install each server using our own custom images and employ full disk encryption to ensure that if a server is ever seized the data is worthless.
We also operate an exclusive multi-hop network allowing customers to choose an entry and exit server in different jurisdictions which would make the task of legally gaining access to servers at the same time significantly more difficult. We operate our own network of log-free DNS servers that are only accessible to our customers through the VPN tunnel.

12. We have servers in 32 countries. No virtual locations. Full list of servers is available here.

IVPN website

AzireVPN

1. No, we do not record or store any logs related to our services. No traffic, user activity, timestamps, IP addresses, number of active and total sessions, DNS requests, or any other kind of logs are stored.

2. The registered company name is Netbouncer AB and we operate under Swedish jurisdiction where there are no data retention laws that apply to VPN providers.

3. We took extra security steps to harden our servers. They are running using Blind Operator mode, a software module that ensures that it is extremely difficult to set up any kind of traffic monitoring. Abuses like incoming DDoS attacks are usually mitigated with UDP filtering on the source port used by an attacker.

4. No, we do not rely on and refuse to use external third-party systems. We run our own email infrastructure and encourage people to use PGP encryption for reaching us. The ticketing support system, website analytics (Piwik, with anonymization settings) and other tools are hosted in-house on open-source software.

5. We politely inform the sender that we do not keep any logs and are unable to identify a user.

6. In the case that a valid court order is issued, we will inform the other party that we are unable to identify an active or former user of our service due to our particular infrastructure. In that case, they would probably force us to handover physical access to the server, which they would have to reboot to disable the Blind Operator mode and to be able to gain any kind of access. Since we are running our custom system images directly into RAM, all data would be lost.

So far, we have never received any court order and no personal information has ever been given out.

7. Yes, BitTorrent, peer-to-peer and file-sharing traffic is allowed and treated equally to any other traffic on all of our servers. We do not provide port forwarding services yet, however, we do provide a public IPv4+IPv6 addresses mode on OpenVPN which assigns IP addresses being used by only one user at a time for the whole duration of the connection to the server. In this mode, all ports are opened, with the exception of unencrypted outgoing port 25 TCP, usually used by the SMTP protocol, which is blocked to prevent abuse by spammers.

8. As of now, we offer a variety of payment options including anonymous methods such as Bitcoin, Litecoin, Monero and some other cryptocurrencies, and cash money via postal mail. We also offer PayPal (with or without recurring payments), credit cards (VISA, MasterCard and American Express through Paymentwall) and Swish. We do not store sensitive payment information on our servers, we only retain an internal reference code for order confirmation, and the customer connected to the transaction information is removed after 6 months.

9. We recommend our users to use our WireGuard servers, using official clients available on Windows, Linux, macOS and OpenWrt (routers). We propose an easy-to-use WireGuard-based client on Android and iOS.

– Data channel cipher: ChaCha20 with Poly1305 for authentication and data integrity.
– Authenticated key exchange: Noise Protocol Framework’s Noise_IKpsk2, using Curve25519, Blake2s, ChaCha20, and Poly1305. It uses a formally verified construction.

10. We offer a custom open-source VPN application called azclient for all major desktop platforms (Windows, macOS and Linux) which currently supports OpenVPN. Its source code is released on Github under the GPLv2 license. We are currently revamping this client to a WireGuard-based one and are planning to add a kill switch and DNS leak protection features to it in the future.

As we provide our users with a full dual-stack IPv4+IPv6 functionality on all servers and VPN protocols, we do not need to provide any IPv6 leak protection. Our tunnels are natively supporting IPv6 even from IPv4 only Internet lines, by tunneling IPv6 traffic into IPv4 transparently. Also, our WireGuard servers can be reached through both IPv4 and IPv6.

11. We physically own all our servers in all locations, co-located in closed racks in different data centers around the world meeting our strict security criteria, using dedicated network links and carefully chosen network upstream providers for maximum privacy and network quality. We host our own non-logging DNS servers in different locations.

12. As of now, we operate across 11 locations on 3 continents. New locations in France, Germany, Romania, Spain and Switzerland are planned soon. There are no virtual locations.

AzireVPN website

Windscribe

1. No.

2. Windscribe Limited. Ontario, Canada.

3. Byte count of all traffic sent through the network in a one month period as well as a count of parallel connections at any given moment.

4. No. Everything is self-hosted.

5. Our transparency policy is available here.

6. Under Canadian law, a VPN company cannot be compelled to wiretap users. We can be legally compelled to provide the data that we already have (as per our ToS) and we would have to comply with a valid Canadian court order. Since we do not store any identifying info that can link an IP to an account, the fact that emails are optional to register, and the service can be paid for with cryptocurrency, none of what we store is identifying.

7. We allow P2P traffic in most locations. Yes, we provide port forwarding for all Pro users. Only ports above 1024 are allowed.

8. Stripe, Paypal, Coinpayments, Paymentwall. IP addresses of users are not stored or linked to payments.

9. The encryption parameters are similar for all protocols we support. AES-256 cipher with SHA512 auth and a 4096-bit RSA key. We recommend using IKEv2, as it’s a kernel space protocol that is faster than OpenVPN in most cases.

10. Our desktop apps have a built-in firewall that blocks all connectivity outside of the tunnel. In an event of a connection drop, it fails closed – nothing needs to be done. The firewall protects against all leaks, IPv4, IPv6 and DNS. We only support IPv4 connectivity at this time.

11. We lease servers in over 150 different datacenters worldwide. Some datacenters deploy networking monitoring for the purposes of DDOS protection. We request to disable it whenever possible, but this is not feasible in all places. Even with it in place, since most servers have dozens/hundreds of users connected to them at any given moment, your activity gets “lost in the crowd”. Each VPN server operates a recursive DNS server and performs all DNS resolution locally.

12. Our server overview is available here. We don’t offer virtual locations.

Windscribe website

VPNArea

1. We do not keep or record any logs. We are therefore not able to match an IP-address and a time stamp to a user of our service.

2. The registered name of our company is “Offshore Security EOOD” (spelled “ОФШОР СЕКЮРИТИ ЕООД” in Bulgarian). We’re a VAT registered business. We operate under the jurisdiction of Bulgaria.

3. To prevent email spam abuse we block mail ports used for such activity, but we preemptively whitelist known and legit email servers so that genuine mail users can still receive and send their emails.

To limit concurrent connections to 6, we use an in-house developed system that adds and subtracts +1 or -1 towards the user’s “global-live-connections-count” in a database of ours which the authentication API corresponds with anonymously each time the user disconnects or connects to a server. The process does not record any data about which servers the subtracting/detracting is coming from or any other data at any time, logging is completely disabled at the API.

4. We host our own email servers. We host our own Ticket Support system on our servers. The only external tools we use are Google Analytics for our website and Live Chat software.

5. DMCA notices are not forwarded to our users as we’re unable to identify a responsible user due to not having any logs or data that can help us associate an individual with an account. We would reply to the DMCA notices explaining that we do not host or hold any copyrighted content ourselves and we’re not able to identify or penalize a user of our service.

6. This has not happened yet. Should it happen our attorney will examine the validity of the court order in accordance with our jurisdiction, we will then inform the appropriate party that we’re not able to match a user to an IP or timestamp, because we’re not recording any logs.

7. BitTorrent and torrents in general are allowed on all our servers. We offer port forwarding only on the dedicated IP private VPN servers at the moment with the goal to allow it on shared servers too. The only ports which are blocked are those widely related to abuse, such as spam.

8. We accept PayPal, Credit/Debit cards, AliPay, Bitcoin, Bitcoin Cash, Ethereum, WebMoney, GiroPay, and bank transfers. In the case of PayPal/card payments, we link usernames to the transactions so we can process a refund. We do take active steps to make sure payment details can’t be linked to account usage or IP assignments. In the case of Bitcoin, BCH, ETH we do not link usernames to transactions.

9. We use AES-256-CBC + SHA256 cipher and RSA4096 keys on all our OpenVPN servers without exception. We also have Double VPN servers, where for example the traffic goes through Russia and Israel before reaching the final destination. We also have Tor over VPN servers to provide diversity in the anonymous setup a user prefers.

10. Yes, we provide both KillSwitch and DNS Leak protection. We actively block IPv6 traffic to prevent IP leaks, so connections are enforced via IPv4.

11. We use our own no-logs DNS servers. We work with reliable and established data centers. Nobody but us has virtual access to our servers. The entire logs directories are wiped out and disabled, rendering possible physical brute force access to the servers useless in terms of identifying users.

12. All our servers are physically located in the stated countries. A list of our servers in 60+ countries is available here.

VPNArea website

AirVPN

1. No, we do not keep or share with third parties ANY data that would allow us to match an IP address and a timestamp to a current or former user of our service

2. AirVPN in Italy. No parent company/companies.

3. No tools are used.

4. No, we do not use any external email providers, analytics, or support tools that hold information provided by users.

5. They are ignored if they pertain to P2P, they are processed, verified and handled accordingly (rejected or accepted) if they pertain to web sites (or FTP services etc.) hosted behind our VPN servers.

6. a) We would co-operate to the best of our abilities, although we can’t give out information we don’t have. b) We are unable to comply due to technical problems and limitations. c) The scenario in ‘case b’ has never occurred. The scenario in ‘case a’ has occurred multiple times, but our infrastructure does not monitor, inspect or log customers’ traffic, so it is not possible to correlate customer information (if we had it) with customers’ traffic and vice-versa.

7. a) Yes, BitTorrent and other file-sharing traffic is allowed on all servers. AirVPN does not discriminate against any protocol or application and keeps its network as agnostic as possible. b) Yes, we provide remote inbound port forwarding service. c) Outbound port 25 is blocked.

8. We accept payments via PayPal and all major credit cards. We also accept Bitcoin, Ethereum, Litecoin, Bitcoin Cash, Dash, Doge, and Monero. By accepting directly various cryptocurrencies without intermediaries we get rid of privacy issues, including correlations between IP addresses and payments. By accepting directly Monero we also offer the option to our customers to pay via a cryptocurrency which protects transactions with a built-in layer of anonymity.

9. CHACHA20-POLY1305 and AES-256-GCM

10. We provide Network Lock in our free and open-source software. It can prevent traffic leaks (both IPv4 and IPv6 – DNS leaks included) even in case of application or system processes wrong binding, in case of UPnP caused leaks, wrong settings, WebRTC and other STUN related methods, and of course in case of unexpected VPN disconnection. b) Yes, we do provide DS IPv4/IPv6 access, including IPv6 over IPv4, pure IPv4 and pure IPv6 connections. In this way even customers whose ISP does not support IPv6 can access IPv6 services via AirVPN.

11. We do not own our datacenters and we are not a transit provider, so we buy traffic from Tier 1, Tier 2 and only occasionally Tier 3 providers and we house servers in various datacenters. The main countermeasures are: exclusive access to IPMI etc. via our own, external IP addresses or specific VPN for the IPMI etc.; reboot inhibition (requiring remote validation); some other methods we will not reveal. However, if servers lines are wiretapped externally and transparently, and server tampering does not occur, there is no way inside the server to prevent, or be aware of, ongoing wiretapping. Wiretapping prevention must be achieved with other methods on the client-side (some of them are integrated into our software), for example, VPN over Tor, Tor over VPN etc.

12. NO, we do not offer virtual locations and/or VPS. We declare only real locations of real “bare metal” servers.

AirVPN website

CactusVPN

1. No, we don’t keep any information of this type.

2. CactusVPN Inc., Canada

3. We restrict our services with up to 5 devices per package for VPN connections and to unlimited devices for our SmartDNS service as long as all of them have the same IP address. Abuse of services is regulated by our Linux firewall and most of the datacenters we hire servers from provide additional security measures for server attacks.

4. No

5. We did not receive any official notices yet. We will only respond to a local court order.

6. If we have a valid order from Canadian authorities we have to help them identify the user. Bus as we do not keep any logs we just can’t do that. We did not receive any orders yet.

7. BitTorrent and other file-sharing traffic is allowed on Netherlands, Germany, Switzerland, Spain, Latvia and Romanian servers.

8. PayPal, Visa, MasterCard, Discover, American Express, Bitcoin & Altcoins, Alipay, Qiwi, Webmoney, Boleto Bancario, Yandex Money and other less popular payment options.

9. We recommend users to use SoftEther with ECDHE-RSA-AES128-GCM-SHA256 cipher suite.

10. Yes, our apps include Kill Switch and Apps. Killer options in case a VPN connection is dropped. Also, they include DNS Leak protection. We only support IPv4.

11. We use servers from various Data Centers. All the VPN traffic is encrypted so the datacenters cannot see the nature of the traffic, also the access on all servers is secured and no datacenter can see its configuration.

12. Here’s the link to all our servers.

CactusVPN website

Trust.Zone

1. Trust.Zone doesn’t store any logs. Therefore, we have no data that could be linked and attributed to the current or former user. All we need from customers is an email to sign up.

2. Trust.Zone is under Seychelles jurisdiction. The company is operated by Internet Privacy Ltd.

3. Our system can understand how many active sessions a given license has at a given moment in time. This counter is temporarily placed in RAM and never logged or saved anywhere.

4. Trust.Zone has never used any third-party tools like Google Analytics, live chat platform, support tools or other.

5. If we receive any type of DMCA requests or Copyright Infringement Notices – we ignore them. Trust.Zone is under offshore jurisdiction, out of 14 Eyes Surveillance Alliance. There is no data retention law in Seychelles.

6. A court order would not be enforceable because we do not log information and therefore there is nothing to be had from our servers. Trust.Zone supports Warrant Canary. Trust.Zone has not received or been subject to any searches, seizures of data, or requirements to log any actions of our customers.

7. BitTorrent and file-sharing traffic is allowed on all Trust.Zone servers. Moreover, we don’t restrict any kind of traffic. Trust.Zone does not throttle or block any protocols, IP addresses, servers or any type of traffic whatsoever.

8. All major credit cards are accepted. PayPal, Alipay, wire transfer, and many other types of payments are available. As we don’t store any logs, there is no way to link payment details with user’s internet activity

9. We use the most recommended protocols in the VPN industry – IKEv2/IPSec, OpenVPN. We also support our own protocol which is faster than OpenVPN and also includes Perfect Forward Secrecy (PFS). Trust.Zone uses AES-256 Encryption by default.

10. Trust.Zone supports a kill-switch function. We also own our DNS servers and provide users with the ability to use our DNS to avoid any DNS leaks. All features listed above are also available with a 30-day Free Plan. Trust.Zone does not support IPv6 to avoid any leaks. We also provide users with additional recommendations to be sure that there are no DNS leaks or IP leaks.

11. We have a mixed infrastructure. Trust.Zone owns some physical servers and we have access to them physically. In locations with lower utilization, we normally host with third-parties. But the most important point is that we use dedicated servers in this case only, with full control by our network administrators. DNS queries go through our own DNS servers.

12. We are operating with 175+ dedicated servers in 93 geo-zones and are still growing. We also provide users with dedicated IP addresses if needed. The full map of the server locations is available here.

Trust.Zone website

SwitchVPN

1. No, SwitchVPN does not store any logs which would allow anyone to match an IP address and a time stamp to a current or former user of our services.

2. Our company name is “CS SYSTEMS, INC” and it comes under United States jurisdiction.

3. We pro-actively take steps to mitigate abuse of our service/servers by implementing certain firewall rules. Such as blocking default SMTP ports which are likely to be abused by spammers.

4. We use Chatra for providing Live Chat and our web-based ticketing system which is self-hosted. No personal information is collected.

5. SwitchVPN is transitory digital network communications as per 17 U.S.C § 512(a) of the Copyright Act. So in order to protect the privacy of our users we use shared IP addresses, which makes it impossible to pinpoint any specific user. If the copyright holder only provides us with an IP address as identifying information, then it is impossible for us to associate a DMCA notice with any of our users.

6. There have been no court orders since we started our operation in 2010, and as we do not log our users’ sessions and we utilize shared IP addresses, it is not possible to identify any user solely based on timestamps or IP addresses. Currently, there are no mandatory data logging requirements in the United States but in case the situation changes, we will migrate our company to another privacy-friendly jurisdiction.

7. Yes, We have P2P optimized servers that provide dynamic port forwarding. It can be easily filtered in our VPN application.

8. We accept all major payment methods such as Credit Card, PayPal, Bitcoin and other Crypto Currencies. We use shared IPs and every account is assigned an alias username for connecting to the VPN server.

9. SwitchVPN utilizes AES-256bit encryption with SHA512 Authentication Channel by default.

10. Yes, Kill Switch & DNS Leak protection is provided on our Windows and Mac application. Currently we only support IPv4.

11. Before we get into an agreement with any third party, we make sure the company does not have any poor history for privacy and we make sure the company is in-line with our privacy requirements for providing our users with a no-log VPN service. We also use our own DNS servers to anonymize all DNS requests.

12. All of our servers are physically located in the countries we have mentioned, we do not use virtual locations.

SwitchVPN website

PrivateVPN

1. We DO NOT keep any logs. We do not store logs relating to traffic, session, DNS, or metadata.

2. We’re registered in Sweden under the name “Privat Kommunikation Sverige AB”

3. The nature of our VPN service makes it practically impossible for us to do any sort of monitoring of abuses. We do monitor the realtime state of the total amount of connections per user account as we allow 6 connections simultaneously. This specific information is never stored.

4. We are using LAdesk support tools, included ticket system and Live Chat. They remain on the chat server for the duration of the chat session, then optionally sent by email to a user, and then destroyed.

5. Since we don’t keep any information on any of our servers DMCA is not applicable to our service as it is not a codified law or act under Swedish jurisdiction

6. We don’t retain or log any identifiers at all. So, basically even when ordered to actively investigate a user we are limited to the number of active logins which is just a numerical value. That being said, we have not received a court order to date

7. P2P is allowed on all our servers as a matter of policy. We are not in the business of restricting and throttling things. The whole point of a user connecting to our VPN servers is to get uncensored and unrestricted Internet. We do support port forwarding with one open port to all ports opened.

8. We accept all forms of Credit/Debit card payments through the Stripe payment gateway, PayPal payment method, and Bitcoins. A credit card or a PayPal payment has to be linked to a user account for us to be able to refund a customer due to our 30-day money-back guarantee. More important, a VPN IP can’t be linked to a user account.

9. OpenVPN over UDP with 256-bit security for both data and TLS control channel encryption and Wireguard.

10. Our Windows and macOS VPN app offers a robust Kill switch and DNS leak protection. DNS leaks on any major platform are owing to broken installations which are fixed as soon we see a report or any issues. IPv6 leak protection is available on every platform and multiple VPN protocols. We offer guides and instructions to set up a kill switch on macOS, GNU/Linux, and Android. At this stage, we do not support any Dual Stack IPv4/IPv6 functionality.

11. We have physical control over our servers and network in Sweden, Denmark, Germany, Netherlands, United Kindom – London, Netherlands, France Italy, Spain, Switzerland, USA – NYC – LA, and Canada – Toronto as those locations and networks are 100% managed and owned by PrivateVPN. With all other locations, we use a variation of different hosting providers such as M247. All inbound and outbound traffic is encrypted and can’t be inspected. Yes, each VPN server has its own DNS server which is pushed to the VPN client.

12. We use a mix of physical and virtual servers depending on the demand and needs of a given location. Virtual servers are categorized in our server list on our website to avoid confusion and maintain transparency.

PrivateVPN website

WhatTheServer

1. We do not maintain any logs that would allow us to identify a user.

2. What The * Services, LLC is incorporated in the USA.

3. As mentioned above we do not log. We have no way to log bandwidth. All limiting is done by active sessions to prevent one person from sharing an account with hundreds of people. We use a custom session management system that operates completely on real-time data and keeps no logs.

4. We run our own communications infrastructure. No analytics are used currently.

5. We send out the below response as we have no logs. “Thanks for the note today. Just for clarification to you (‘InsertDatacenterNameHere’) and you only (this message is not for distribution); the operator(s) of the named network(s) within the notification provide no validation of any claim(s) made on behalf of an ‘abuse’ complainant. The operator(s) of this network, hosts, and network devices have no knowledge of any activities named in the complaint and operate in the absence of logs, records, or other commonly used identifying materials. We appreciate you (‘InsertDatacenterNameHere’) bringing such items to our attention, and if we are able to assist in any way in the future, please let us know. Thanks. This ticket may be closed upon receipt and review.”

6. We have only had one of these requests for a VPS client. We responded by replying to the requester letting them know we were looking into it, and we notified the customer via his email on file. Then we contacted the EFF and they put us in touch with a lawyer who helped us get the case dropped, because we did not have the information requested. If we do have another request in the future we will take several steps. First, we would consult with our lawyers to confirm the validity of the order/subpoena, and respond accordingly if it is NOT a valid order/subpoena. Then we would alert our user of the event if we are legally able to.

If the order/subpoena is valid, we would see if we have the ability to provide the information requested, and respond accordingly we do NOT have the information requested. If we DO have the information requested,
we would immediately reconfigure our systems to stop keeping that information. Then we would consult with our lawyer to determine if there is anyway we can fight the order/subpoena and/or what is the minimum
level of compliance we must meet, as well as, notify the user of the event if we are legally able to do so. If we were forced to start keeping logs on our users, we would go out of business and start a new company in a different jurisdiction.

7. We allow file sharing on our network. We do ask people to use the EU nodes for file-sharing. We have no way to enforce that, but it helps to prevent the USA-based nodes from complaints and shutdown from overzealous copyright trolls. We do offer port forwarding plans with our Perfect Dark Plans. We do not block any ports or monitor.

8. We accept PayPal and Cryptocurrency. All that is required is a working email for signup. Signups via Tor or proxies are highly encouraged along with placeholder information if paying in cryptocurrency. We also use a completely different authentication infrastructure and random usernames for the VPN accounts.

9. We recommend OpenVPN and Our VPN has Perfect Forward Secrecy setup with ECDHE-RSA-AES256-GCM-SHA384 for all our VPN servers which is based on Softether and Ubuntu which allows people to use any protocols their devices supports. This ensures maximum compatibility and the best protection for all.

10. Our VPN profiles are compatible with Qomui (Qt OpenVPN Management UI) and others that have this built into the opensource VPN client. We push custom Adblocking DNS to clients. We also have ‘push “block-outside-dns”’ in our OpenVPN server config files which will prevent the client from leaking DNS requests. Additionally, we include “resolve-retry infinite” and “persist-tun” in the OpenVPN client config files which will prevent the client from sending data in the clear if the VPN connection goes down. We do have dual-stack IPv4/IPv6 support which can be used if IPv6 is enabled on the device.

11. All of our infrastructure is hosted in third-party colocations. However, we use full-disk-encryption on all of our servers. We also use custom DNS servers with adblocking to mitigate tracking from ad networks. We notice this also speeds up mobile devices and removes ads from lots of the apps without paid ad-free versions.

12. We offer VPN server locations in US,NL,UK,HK,JP. We do offer virtual locations upon request.

WhatTheServer website

ibVPN

1. We do not keep and we do not share with third parties ANY logs that can identify a user of our service with an IP address and/or a timestamp. We are also GDPR compliant and (in our opinion) keeping this kind of logs is not respecting the Privacy by Design guidelines.

2. The company’s registered name is Amplusnet SRL. We are a Romanian company, which means we are under EU jurisdiction. In Romania, there are no mandatory data retention directives.

3. We limit the number of concurrent connections and we are using Radius for this purpose.

4. The back end of the website is a dedicated WHMCS for billing and support tickets. We do not use external email providers (we host our own mail server). Our users can contact us via live chat (Zendesk). The chat activity logs are deleted on a daily basis. There is no way to associate any information provided via live chat with the users’ accounts.

5. So far we did not receive any DMCA notice for any P2P server from our server list. That is normal considering that the servers are located in DMCA-free zones. For the rest of the servers, P2P and file-sharing activities are not allowed/supported.

6. So far, we have not received any court order. We do not support criminal activities, and in case of a valid court order, we must follow the EU laws under which we operate.

7. We have dedicated P2P servers that allow BitTorrent and other file-sharing applications. The servers are located in Netherlands, Luxembourg, Canada, Sweden, Russia, Hong Kong and Lithuania. We do not reroute P2P connections. We do not provide port forwarding. We are blocking the SMTP ports 25 and 465 to avoid spam from our servers.

8. Payments are performed exclusively by third-party processors, thus no credit card info, PayPal ids, or other identifying info are stored in our database. For those who would like to keep a low profile, we accept BitCoin, LiteCoin, Ethereum, WebMoney, Perfect Money etc.

9. We support SSTP and SoftEther on most of the servers. We also offer double VPN and TOR over VPN.

10. Yes, Kill Switch and DNS leak protection are implemented in our VPN clients. Kill Switch is one of the most-used features. Our users can decide to block all the traffic when the VPN connection drops or to kill a list of applications. We allow customers to disable IPv6 traffic and to make sure that only our DNS servers are used while connected to the VPN. Also, we support SOCKS5 on our P2P servers which can be used for downloading torrents and do not leak any data if the connection to the SOCKS5 proxy drops.

11. We do not have physical control over our VPN servers. We have full remote control to all servers. Admin access to servers is not provided for any third-party.

12. The full list of server locations is available here.

ibVPN website

Mullvad

1. No, all details are explained in our no-logging data policy.

2. Mullvad VPN AB – Swedish. Parent company is Amagicom AB – Swedish.

3. We mitigate abuse by blocking the usage of ports 25, 137,139, and 445 due to email spam and Windows security issues. The number of connections: Each VPN server reports to a central service. When a customer connects to a VPN server, the server asks the central service to validate the account number, whether or not the account has any remaining time, if the account has reached its allowed number of connections, and so on. Everything is performed in temporary memory only; none of this information is permanently stored to disk.

We also monitor the real-time state of total connections per account as we only allow for five connections simultaneously. As we do not save this information, we cannot, for example, tell you how many connections your account had five minutes ago.

4. We have no external elements at all on our website. We do use an external email provider; for those who want to email us, we encourage them to use PGP encryption which is the only effective way to keep email somewhat private. The decrypted content is only available to us.

5. As explained here, there is no such Swedish law that is applicable to us.

6. From time to time, we are contacted by governments asking us to divulge information about our customers. Given than we don’t store activity logs of any kind, we have no information to give out. Worst-case scenario: we would discontinue the servers in the affected countries. The only information AT ALL POSSIBLE for us to give out is records of payments since these are stored at PayPal, banks etc.

7. All traffic is treated equally, therefore we do not block or throttle BitTorrent or other file-sharing protocols. Port forwarding is allowed. Ports 25, 137,139, and 445 are blocked due to email spam and Windows security issues.

8. We accept cash, Bitcoin, Bitcoin Cash, bank wire, credit card, PayPal, and Swish. We encourage anonymous payments via cash or one of the cryptocurrencies. We run our own full node in each of the blockchains and do not use third parties for any step in the payment process, from the generation of QR codes to adding time to accounts. Our website explains how we handle payment information.

9. We offer OpenVPN with RSA-4096 and AES-256-GCM. And we also offer WireGuard which uses Curve25519 and ChaCha20-Poly1305.

10. We offer a kill switch and DNS leak protection, both of which are supported in IPv6 as IPv4. While the kill switch is only available via our client/app, we also provide a SOCKS5 proxy that works as a kill switch and is only accessible through our VPN.

11. At 12 of our locations (4 in Sweden, 1 in Denmark, 1 in Amsterdam, 1 in Norway, 1 in UK, 1 in Finland, 1 in Germany, 1 in Paris, 1 in Zurich) we own and have physical control over all of our servers. In our other locations, we rent physical, dedicated servers (which are not shared with other companies) and bandwidth from carefully selected providers. Keep in mind that we have 5 locations in the UK and 3 in Germany, the servers we physically own are the ones hosted by 31173.se (they start with gb-lon-0* and de-fra-0* , and gb4-wireguard, gb5-wireguard, de4-wireguard and de5-wireguard).

Yes, we use our own DNS servers. All DNS traffic routed via our tunnel is ‘hijacked’, even if you accidentally select another DNS our DNS will anyhow be used. Except if you have setup DNS over HTTPS or DNS over TLS.

12. We don’t have virtual locations. All locations are listed here.

Mullvad website

TorGuard

1. TorGuard has never kept or retained logs for any user. No timestamps or IP logs are kept on any VPN or authentication server. The only information TorGuard has is statistical network data which helps us to determine the load of a given server.

2. TorGuard is owned by VPNetworks LLC and its parent company Data Protection Services. We operate under US jurisdiction.

3. We use custom modules in a platform called Nagios to monitor VPN/Proxy hardware utilization, uptime and latency. TorGuard does enforce an eight device per user limit in real-time and each session is immediately wiped once the user has logged out. If that user failed to logout or was disconnected accidentally, our system automatically discards these stale sessions within a few minutes.

4. We use Google Apps for email and anonymized Google Analytics data for performance reporting. All support is handled internally and TorGuard does not utilize third-party tools for customer support.

5. If a valid DMCA takedown notice is received it would be handled by our legal team. Due to our no-log policy and shared IP network, we are unable to forward any requests to a single user.

6. If a court order is received, it is first handled by our legal team and examined for validity in our jurisdiction. Should it be deemed valid, our legal representation would be forced to further explain the
nature of our shared IP network configuration and the fact that we do not hold any identifying logs or time stamps.

TorGuard’s network was designed to operate with minimum server resources and is not physically capable of retaining user logs. Due to the nature of shared VPN servers and the large traffic volume flowing through our network, it would not be possible to retain such logs. No, that scenario has never played out.

7. Yes, torrents work on all servers except our residential IP network as these are performance optimized for specific streaming platforms. TorGuard does offer port forwarding for all ports above 2048 and the only port we block outgoing is SMTP port 25 to prevent abuse.

8. We use Stripe for credit or debit card processing and utilize our own BTCPay instance for Bitcoin and Litecoin transactions. TorGuard accepts all cryptocurrency through coinpayments.net and use Paymentwall and PayGarden for Gift Card payments. TorGuard has gone through extreme measures by heavily modifying our billing system to work with various payment providers and to help protect our users’ privacy.

9. For a high level of security, we would recommend using OpenVPN with AES-256-GCM-SHA512 using our stealth VPN protocol as an added measure through the TorGuard desktop or mobile apps.

10. Yes – our kill switch is uniquely designed to send all traffic into a *black hole* if the user loses connectivity or the app crashes for any reason. Dual stack IPv4/IPv6 is currently in development and will be released very soon.

11. We do have servers hosted at third parties but only select a location after extensive due diligence on very specific security criteria. We encrypt all disks and run 80% so far on virtual RAM disks. We do provide secure public DNS but we also provide our internal DNS on every endpoint which queries root VPN servers directly.

12. At this time we have three virtual locations: Taiwan, Greece and Mexico. TorGuard would rather not provide any virtual locations but occasionally if we cannot find a bare-metal data center that meets our security criteria we won’t take the risk.

TorGuard website

Perfect Privacy

1. We do not store or log any data that would indicate the identity or the activities of a user.

2. The name of the company is VECTURA DATAMANAGEMENT LIMITED COMPANY and the jurisdiction is Switzerland.

3. The number of connections/devices at the same time is not limited because we do not track it. In case of malicious activity towards specific targets, we block IP addresses or ranges, so they are not accessible from our VPN servers. Additionally, we have limits on new outgoing connections for protocols like SSH, IMAP, and SMTP to prevent automated spam and brute force attacks. We do not use any other tools.

4. Our websites use Google Analytics to improve the quality of the user experience and it’s GDPR compliant with anonymized IP addresses. You can prohibit tracking with just one click on a provided link in the privacy policy. If a customer has a problem with Google, he has the possibility to disable the tracking of all Google domains in TrackStop. I believe we are the only VPN provider who offers this possibility. All other solutions like email, support and even our affiliate program is in-house software and under our control.

5. Because we do not host any data, DMCA notices do not directly affect us. However, we generally answer inquiries. We point out that we do not keep any data that would allow us to identify a user of the used IP address.

6. If we receive a Swiss court order, we are forced to provide the data that we have. Since we don’t log any IP addresses, timestamps or other connection-related data, the only step on our side is to inform the inquiring party that we do not have any data that would allow the identification of a user based on that data. Should we ever receive a legally binding court order that would require us to log the activity of a user going forward, we’d rather shut down the servers in the country concerned than compromise our user’s privacy.

There have been incidents in the past where Perfect Privacy servers have been seized, but no user information was compromised that way. Since no logs are stored in the first place and additionally all our services are running within RAM disks, a server seizure will never compromise our customers. Although we are not subject to US-based laws, there’s a warrant canary page available.

7. With the exception of our US servers and French servers, BitTorrent and other file-sharing software is allowed. We offer port forwarding and do not block any ports.

8. We offer Bitcoin, PayPal and credit cards for users who prefer these options and over 60 other payment methods. Of course, it is guaranteed that payment details are not associated with any IP addresses. The only
thing you know about a person is that he or she is a customer of Perfect Privacy and which email address was used.

9. The most secure protocol we recommend is still OpenVPN with 256-bit AES-GCM encryption. With our VPN Manager for Mac and Windows you also have the possibility to create cascades over four VPN servers. This Multi
Hop feature works tunnel in tunnel. If you choose countries for the hops which are known not to cooperate with each other, well you get the idea. On top of that you can activate our NeuroRouting feature, which changes the routing depending on the destination of the visited domain and dynamically selects different hops for the outgoing server to ensure it is geographically close to the visited server.

10. Yes, our servers support full Dual Stack IPv4/IPv6 functionality, even when your ISP does not support IPv6. Our VPN Manager has a “kill switch” which has configurable protection with three security levels.

11. We run dedicated bare-metal servers in various data centers around the world. While we have no physical access to the servers, they all are running within RAM disks only and are fully encrypted.

12. Currently, we offer servers in 26 countries worldwide. All servers are located in the city displayed in the hostname – there are no virtual locations. For full details about all servers locations, please
check our server status site as we are constantly adding new servers.

Perfect Privacy website

SlickVPN

1. SlickVPN doesn’t log traffic or session data of any kind. We don’t store connection time stamps, used bandwidth, traffic logs, or IP addresses.

2. Slick Networks, Inc. is our recognized corporate name. We operate a complex business structure with multiple layers of offshore holding companies, subsidiary holding companies, and finally some operating companies to help protect our interests. The main marketing entity for our business is based in the United States of America but the top level of our operating entity is based out of Nevis.

3. We block port 25 to reduce the likelihood of spam originating from our systems. The SlickVPN authentication backend is completely custom and limits concurrent connections.

4. We utilize third party email systems to contact clients who opt-in for our newsletters and Google Analytics for basic website traffic monitoring and troubleshooting. We believe these platforms to be secure. Because we do not log your traffic/browsing data, no information about how users may or may not use the SlickVPN service is ever visible to these platforms.

5. If a valid DMCA complaint is received while the offending connection is still active, we stop the session and notify the active user of that session. Otherwise, we are unable to act on any complaint as we have no way of tracking down the user. It is important to note that we rarely receive a valid DMCA complaint while a user is still in an active session.

6. This has never happened in the history of our company. Our customer’s privacy is of topmost importance to us. We are required to comply with all valid court orders. We would proceed with the court order with complete transparency, but we have no data to provide any court in any jurisdiction. SlickVPN uses a warrant canary to inform users if we have received any such requests from a government agency. Users can monitor our warrant canary here: SlickVPN Warrant Canary.

7. Yes. All traffic is allowed. SlickVPN does not impose restrictions based on the type of traffic our users send. Outgoing mail is blocked but we offer a method to split tunnel the mail out if necessary. We can forward ports upon request. Some incoming ports may be blocked with our NAT firewall but these can be opened on request

8. We accept PayPal, Credit Cards, Bitcoin, Cash, and money orders. We keep user authentication and billing information on independent platforms. One platform is operated out of the United States of America (marketing) and the other platform is operated out of Nevis (operations).

Payment details are held by our marketing company which has no access to the operations data. We offer the ability for the customer to permanently delete their payment information from our servers at any point and all customer data is automatically removed from our records shortly after the customer ceases being a paying member.

9. We recommend using OpenVPN if at all possible (available for Windows, Apple, Linux, iOS, Android) and we use the AES-256-CBC algorithm for encryption.

10. Our leak protection (commonly called a ‘kill-switch’) keeps your IPv4 and IPv6 traffic from leaking to any other network and protects against DNS leaks. Your network will be disabled if you lose the connection to our servers and the only way to restore the network is manual intervention by the user. We don’t offer IPv6 connections at this time.

11. We physically control some of our server locations where we have a heavier load. Other locations are hosted with third parties unless there is enough demand in that location to justify racking our own server setup. To ensure redundancy, we host with multiple providers in each location. We have server locations in over forty countries.

In all cases, our network nodes load over our encrypted network stack and run from RAMDisk. Anyone taking control of the server would have no usable data on the disk. We periodically remount our ramdisks to remove any lingering data. Each of our access servers acts as the DNS server for customers connected to that node.

12. SlickVPN offers VPN service in 40 countries around the world. We do not do offer virtual locations.

SlickVPN website

HeadVPN

1. We do not keep any logs on our network servers that can match an IP address and time stamp with a user.

2. Our service is incorporated under a company in Seychelles for our users’ security and anonymity. The company name is Global Stealth, Inc.

3. There are no such limits on our network.

4. Yes, we are using Google Analytics for our website traffic analysis. We also use Zendesk for chat platform.

5. We don’t receive DMCA notices as we have a special server network in DMCA-free zones.

6. It will be basically ignored.

7. BitTorrent and P2P are allowed on our special networks designed for this purpose. These networks have all ports open.

8. We support credit card and PayPal. Payments can be linked to accounts.

9. We support AES256 SSL encryption supported protocols over multiple ports.

10. Yes, we do support Kill Switch for our users.

11. All our servers are hosted on globally known data centers with high security. We have our global DNS and SmartDNS network.

12. We have servers in more than 80 countries globally.

HeadVPN website

VPNhub

1. We do not keep any logs of data transmitted through our service and we have no way of knowing what our users are doing while connected to our servers. However, we will note that all payment processors store IP data for the purpose of fraud mitigation. Our payment processor is no different.

2. We operate under AppAtomic, physically headquartered with personnel in Cyprus. We also have offices in Montreal where sales, development, and support take place.

3. We have proprietary systems being used to mitigate abuse, but don’t enforce limitations on concurrent connections at the current time.

4. We use Google’s Firebase and Analytics for basic statistical reporting, however, those services do not have access to data transferred by our users. ZenDesk is currently employed to provide support, however, we plan on migrating everything in-house in the near future.

5. Since we keep no logs, there is virtually nothing we can do to respond to DMCA or equivalent inquiries.

6. Since we do not log activity, we have no way of identifying users. In the event that we are somehow forced to log activity for a user going forward, it would be reflected in the Warrant Canary within our Privacy Policy.

7. We do not restrict torrents, file-sharing or P2P.

8. We use ProBiller as a payment provider on our web site, as well as Apple and Google within our iOS and Android apps respectively. Since we have no logs, there is never anything that can be linked to usage of our service nor IP assignment.

9. It depends on the platform. Open VPN and IKEv2 are both considered to be the best in the industry.

10. We have a kill-switch feature within our desktop apps, as well as our Android app. For iOS, incorporating a kill-switch is not possible due to operating system restrictions, but we do have an Auto-Reconnect upon Disconnect feature there.

11. We’ve contracted StackPath for the purpose of network infrastructure. Our agreement forbids the snooping of any traffic, and we use DNS servers they host.

12. Here’s a full list.

VPNhub website

CyberGhost

1. We have a strict No-Logs policy, so none of our traffic or DNS servers log or store any user info.

2. We’re part of Kape.

3. Our dedicated team monitors the whole service and infrastructure for any abuse of service. We have several tools in place, from CDN protection to firewalls and our own server monitoring system. Concurrent connections limits are monitored & also enforced via our systems to avoid such types of abuses.

4. We use Google Analytics, Zendesk, and Active Campaign.

5. Back in 2011, we were the first in the VPN industry to publish a Transparency Report. It’s something we still do today when we launch our reports quarterly. When we receive a lot of DMCA takedown notices our reply is always the same: we keep no logs and cannot comply with the request.

6. Since we store no logs, such requests do not affect us. Under Romanian law, data retention is not mandatory. This allows us to give our ‘Ghosties’ complete digital privacy.

7. In some countries, local legislation prevents us from offering adequate service for torrenting. Other locations have performance constraints. We currently do not support port forwarding services. What’s more, specific ports related to email services are also blocked as an anti-spam security measure.

8. We do not any store payment details. These are handled by our payment providers, which are entirely Payment Card Industry Data Security Standard compliant.

9. We generally favor the AES-256 encryption platform & protocol wide for its good balance of performance and security.

10. Yes, we have a kill switch in place, but we do not support dual stack.

11. We use disk encryption to make sure no third party can access the contents of our VPN servers. Furthermore, we have additional server authenticity tests in place to eliminate the risk of Man-in-the-middle attacks. We use self-managed DNS servers to ensure the E2E protection of online activity.

12. We have over 6,500 VPN servers in 90 countries. Most of them are physically located within the borders of the specified country. All details are available here.

CyberGhost website

OVPN

1. Our entire infrastructure and VPN service is built to ensure that no logs can be stored – anywhere. Our servers are locked in cabinets and operate without any hard drives. We use a tailored version of Alpine, which doesn’t support SATA controllers, USB ports etc.

2. OVPN Integritet AB (Org no. 556999-4469). We operate under Swedish jurisdiction.

3. We don’t monitor abuse. In order to limit concurrent connections, our VPN servers validate account credentials by making a request to our website. Our web server keeps track of the number of connected devices. This is stored as a value of 0-4, where it is increased by one when a user connects and decreased by one when a user disconnects.

4. For website insights, we use Matomo/Piwik, an Open Source solution that we host ourselves. The last two bytes of visitors’ IP addresses are anonymized; hence no individual users can be identified. Automatic emails from the website are sent using Postmark. Intercom is used for support.

5. Since we don’t store any information, such requests aren’t applicable to us.

6. We can’t provide any information to the court. A court wouldn’t be able to require logging in our jurisdiction – but in case it did happen we would move the company abroad. OVPN has insurance that covers legal fees as an additional layer of safety, which grants us the financial muscles to refute any requests for information.

7. We don’t do any traffic discrimination. As such, BitTorrent and other file-sharing traffic are allowed on all servers. We do provide port forwarding services as incoming ports are blocked by default. The allowed port range is 49152 to 65535. For other ports, we recommend users to purchase our Public IPv4 add-on.

8. PayPal, credit cards (via Braintree), Bitcoin (via Bitpay), Bitcoin Cash (via Bitpay), cash in envelopes as well as a Swedish payment system called Swish. We never log IP addresses of users, so we can’t correlate an IP address to a payment.

9. OVPN’s default settings, which uses AES-256-GCM for OpenVPN. In terms of connection, we recommend using our Multihop add-on.

10. Our desktop client provides a kill switch as well as DNS leak protection. All our servers support dual-stack IPv4 & IPv6. Our browser extension blocks WebRTC leaks.

11. We own all the servers used to operate our service. All VPN servers run without any hard drives – instead we use tmpfs storage in RAM. Writing permissions for the OpenVPN processes have been removed, as well as syslogs. Our VPN servers do not support physical console access, keyboard access nor USB access. The servers are colocated in various data centers that meet our requirements. OVPN does not rent any physical or virtual servers. We operate our own DNS servers.

12. We do not offer any virtual locations. All our regions are listed here. We have photos of our servers at all locations, which are viewable by clicking on the region names

OVPN website

Surfshark

1. We do not keep any logs, data, timestamps or any other kind of information that would enable anyone to identify current or former users of our service.

2. Surfshark is a registered trademark of Surfshark Ltd., a company registered in the British Virgin Islands (BVI). Surfshark Ltd. is not a subsidiary of any other company.

3. We do not limit the number of simultaneous connections. We have safeguards against abuse of our service: our Terms of Service has a clause on Fair Usage Policy; if this policy is intentionally violated, we have an automated network maintenance system that indicates the abnormalities on server load, and can limit an immoderate number of devices simultaneously connected to one session to make sure that none of our customers are affected by potentially deteriorated quality of our services.

4. We do not use any Alphabet Inc. products except for Google Analytics, which is used to improve our website performance for potential customers. For a live 24/7 customer support and ticketing service, we use industry-standard Zendesk. For our communication, we use a secure email system Hushmail. For transactional communication, we use SendGrid and Iterable for user communication.

These third-party services have no access to any other kind of user information outside the scope of the one specified in our Privacy Policy. Also, we have legally binding agreements with all third-party service providers to not disclose any of the information they have to anyone outside the scope of the services they provide to us

5. DMCA takedown notices do not apply to our service as we operate outside the jurisdiction of the United States. In case we received a non-US equivalent, we would not be able to provide any information because we have none (strict no logs policy).

6. We have never received a court order from the British Virgin Islands (BVI) authorities. If we ever received a court order from the BVI authorities, we would truthfully respond that we are unable to identify any user as we keep no logs whatsoever. If data retention laws would be enacted in the BVI, we would look for another country to register our business in. For any information regarding received legal inquiries and orders we have a live warrant canary.

7. Surfshark is a torrent-friendly service. We allow all file-sharing activities and P2P traffic, including BitTorrent. For that, we have hundreds of specialized servers in various countries, and the user will always be connected to the fastest specialized server in case of P2P activities. We do not provide port forwarding services, and we block port 25.

8. Surfshark subscriptions can be purchased using various payment methods, including cryptocurrency, PayPal, Alipay, major credit cards, and many country-specific options. None of these payments can be linked to a specific user as we do not collect any timestamps, IP addresses, session information, or other data.

9. We recommend using advanced IKEv2/IPsec and OpenVPN (UDP and TCP) security protocols with strong and fast AES-256-GCM encryption and SHA512 signatures. Also, on our Windows and Android apps we support Shadowsocks protocol as an option. The AES-256-GCM is different from AES-256-CBC as it has an inbuilt authentication which makes the encryption process faster.

10. We provide ‘kill switches’ in all our apps and have an inbuilt DNS leak protection. Also, Surfshark provides IP masking, IPV6 leak protection, WebRTC protection, ad, malware and tracker blocking on DNS level, MultiHop (double VPN), Whitelister (works bots as direct and reverse split tunneling), etc. Currently, we do not support Dual Stack IPv4/IPv6 functionality.

11. We use our own DNS servers which do not keep any logs as per our Privacy Policy. All our servers are physically located in trusted third-party data centers. 80% of our servers are already RAM-only, and we’ll have a 100% RAM-only server network by the end of June 2020.

Before choosing a third-party service provider, we have a strict due diligence process to make sure they meet our security and trust requirements. To prevent unauthorized snooping, we use the 2FA method to reach our servers and have developed a special authorization procedure so that only authorized system administrators can access them for configurations.

12. As of May 2020, we have over 1700 servers physically located in 109 locations, in 64 countries. As per user requests, we have only a few virtual locations that are clearly indicated within our apps’ user interfaces.

Surfshark website

VPN.ac

vpn.ac logo1. We keep minimal connection session logs to help us in troubleshooting customers’ connection problems but also to identify attacks.

This information contains IP address, connection start and end time, protocol used (including port) and amount of data transferred for OpenVPN connections. This info isn’t stored on any server disk and is wiped out on session-end time or daily. For WireGuard connections, the endpoint IP (public user’s IP) is erased within a few minutes after closing the connection (no handshakes within a specific time).

2. Cryptolayer SRL, registered in Romania.

3. There are automated firewall rules that can kick-in in the event of some specific abusive activities. Manual intervention can take place when absolutely necessary, in order to maintain the infrastructure stable and reliable for everyone. Concurrent connections are limited by the authentication back-ends.

4. No, we don’t.

5. We are handling DMCA complaints internally without involving the users (i.e. we are not forwarding anything). We use shared IP addresses so it’s not possible to identify the users.

6. This has never happened. In such an event, we would rely on legal advice. It’s worth noting that we use shared public IPs on all servers so it’s not possible to identify a user based on past activity using a specific VPN gateway IP.

7. It is allowed on all servers. Port forwarding is not supported due to security and privacy weaknesses that come with it, ports aren’t blocked except for SMTP/25.

8. All popular cryptocurrencies, PayPal, credit cards, several country-specific payment methods, some gift cards. Crypto payments can be anonymous.

9. OpenVPN using Elliptic Curve Cryptography for Key Exchange (ECDHE, curve secp256k1) is used by default in most cases. We also support RSA-4096, SHA256 and SHA512 for digest/HMAC. For data encryption we use AES-256-GCM and AES-128-GCM. We are also supporting the WireGuard VPN protocol with its parameters (Curve25519, Blake2s, ChaCha20, Poly1305)

10. Yes, these features are embedded in our client software. We also provide guides and support on how to set effective “kill switches” for specific applications like torrent clients.

11. We have physical control over our servers in Romania. In other countries, we rent or collocate our hardware. We use our own DNS resolvers and all DNS traffic between VPN gateways and DNS resolvers is encrypted, not logged.

12. We don’t use “virtual locations”. All servers are physically located in several countries, a full list is available here.

VPN.ac website

—–

*Note: Private Internet access, ExpressVPN and NordVPN are TorrentFreak sponsors. We reserve the first three spots for them as a courtesy. This article also includes a few affiliate links which help us pay the bills. We never sell positions in our review article or charge providers for a listing.

All VPNs

Private Internet Access
ExpressVPN
NordVPN
HideIPVPN
IVPN
AzireVPN
Windscribe
VPNArea
Surfshark
AirVPN
CactusVPN
Trust.Zone
SwitchVPN
PrivateVPN
WhatTheServer
ibVPN
Mullvad
TorGuard
Perfect Privacy
SlickVPN
HeadVPN
VPNhub
CyberGhost
OVPN
VPN.ac

From: TF, for the latest news on copyright battles, piracy and more.

21:56

Alexander Artemenko: trivial-ssh [Planet Lisp]

This system is a simple wrapper around cl-libssh2 which is binding to the libssh2. Trivial SSH provides a few macros to safely establish a connection, open and close streams.

In the next example we'll connect to the host and run two commands to get its hostname and OS description:

;; Make this before Quickloading the system:
;; brew upgrade libssh2

POFTHEDAY> (flet ((read-lines (s)
                    (loop for line = (read-line s nil nil)
                          while line
                          collect line)))

             (ssh:with-connection (conn "134.209.21.115" (ssh:agent "root"))
               (values
                (ssh:with-command (conn iostream "hostname -f")
                                  (read-lines iostream))
                (ssh:with-command (conn iostream "lsb_release --id --release --codename")
                                  (read-lines iostream)))))
("my-lovely-host.inter.net")
("Distributor ID:  Ubuntu"
 "Release: 18.04"
 "Codename:        bionic")

Also, there is are commands to upload and download files using SCP protocol. Here is how we can copy the bootstrap file to the host and execute it:

POFTHEDAY> (ssh:with-connection (conn "134.209.21.115" (ssh:agent "root"))
               (ssh:upload-file conn "install.sh" "/tmp/install.sh")
               (ssh:with-command (conn stream "chmod +x /tmp/install.sh"))
                 (ssh:with-command (conn stream "/tmp/install.sh")))

The cool part of with-command macro is that you have a communication stream and can read output during the command execution. Here we are installing Emacs on the remote host and can observe the process:

Here is the code from this sample:

POFTHEDAY> (flet ((-> (from to)
                    (loop for line = (read-line from nil nil)
                       while line
                       do (write-string line to)
                          (terpri))))
             (ssh:with-connection (conn "134.209.21.115"
                                        (ssh:agent "root"))
               (ssh:with-command
                   (conn stream "apt-get update &&
                                apt-get install -y emacs-nox")
                   (-> stream *standard-output*))))

Update

Found that cl-libssh2 does not support agent forwarding. Because of that, I'm not able to call git pull on the remote machine.

I tried to patch cl-libssh2 to support the latest libssh2 where agent forwarding was supported in August 2019, but this patch does not work yet.

If somebody is interested to help me with that, he might try this pull-request:

https://github.com/alxchk/cl-libssh2/pull/7

21:00

About That Deal, Five Years On [Whatever]

Today is a red-letter day in my personal history, because five years ago (and also on a Sunday, calendars are weird), the New York Times announced that I had signed a 13-book deal with Tor books for $3.4 million, a deal notable for its length (we expected it to run for roughly a decade) and for the amount of money being splashed out. In the wake of the announcement was a week of congratulations for me (which I appreciated) and a whole lot of Monday morning quarterbacking about whether this deal was actually a good deal for me, or for Tor (which I found mostly amusing). We’re now halfway through the expected decade of the deal, so I figure now is as good a time as any to offer some thoughts on it and how it’s been for me, living with it in the real world.

First, how has the deal been working out? Well, so far, four books covered by the contract have been released: The Collapsing Empire, Head On, The Consuming Fire and this year’s book, The Last Emperox. Of the four, three were New York Times bestsellers and the one that wasn’t was nominated for the Hugo and won the Locus Award (there was an additional bestseller in there too: The Dispatcher, which showed up on the NYT’s inaugural Audio Fiction best seller list). In terms of the Interdependency series, the sales and bestseller rankings grew from the first of the books to the last. All the published books in the deal have been optioned for film/TV, and some of the currently unpublished ones have been, too. All the published books have sold in multiple languages.

This isn’t (just) luck. The deal was designed, in large part, to allow Tor and me the luxury of time to strategically build on the sales and the following I already had. One of the things I said to Tor when we were negotiating the deal is that I was perfectly happy to be known and to be labeled as a science fiction writer — I didn’t want to suddenly go “mainstream,” but I would be happy to be science fiction’s ambassador to the mainstream. Since the deal, that’s been the general thrust of our efforts; I write unapologetically science fictional books that non-genre readers might find approachable, and Tor’s magnificent marketing and PR people pitch me to the usual suspects in terms of press and readership — and then beyond that, too.

So yes, the deal has absolutely been working out so far. I have been the beneficiary of intentionality, and the agreement of the two primary parties to work strategically toward a goal, that goal being selling loads and loads of books to as many people as possible. To my credit, I’m writing accessible books that people (mostly) seem to like, and to Tor’s credit, they’ve been very active and creative in marketing and selling the books, and me. I can’t overstate the importance of the latter, and I saw it in action in the last few months, when my physical book tour had to be scrapped and Tor’s PR/Marketing folks built an online tour for me in a matter of days. I am in awe of and grateful for Tor’s publicity machine (and particularly Alexis Saarela, my direct PR person), and in return I try to hold up my end of the deal, not just in what and how I write, but in helping them promote me, and in supporting Tor and the other writers they have and promote. This is how the deal is supposed to work, and how things get done.

I’ve been asked if having a contract with so many books on it exposes me to pressure, as in Oh Jesus, I just finished another book and yet I still have nine more books that I have to write please release me from my prison of words. The short answer to this is, lol, no. I get to write for a decade (at least!) and don’t have to worry about whether what I’m writing will sell and if I’ll get paid for it. There are very few writers who would turn down that deal.

The slightly longer answer is: Hello, have you looked at the global economy at the moment, it’s in a shambles and it’s absolutely the freelancers and gig economy workers of the world — including the writers — who are going to take it on the chin. It might be years before things hit a new equilibrium. Many if not most of the writers I know are incredibly apprehensive about what this means for their ability to support themselves and their families through writing. And then here’s me, who all he has to do is — write. If I write, I get paid. Someone is contractually obliged to pay me a specified amount for every single book they’ve already agreed that they will take from me when I finish writing it. I have many problems with the state of the world today — oh boy, let me tell you about that — but getting paid isn’t one of them. That is an actual gift.

(Well, no, not an actual gift, since I still have to, you know, write the books in order to get paid. But I think you know what I mean.)

When I first talked about the deal five years ago, one of the things that I noted was that it gave me stability — rare for a writer in any era, and it feels even more rare in this one. Stability, as it turns out, is a huge boost to my productivity. This should not be a surprise — strange how when you don’t have to devote brain cycles to how you’re going to afford eating or keeping a roof over your head, you might have more cycles to commit to creativity — but when talking about a large, long contract, I think people tend to see the obligation it requires rather than the constancy it affords. For me, I don’t really see the obligation, because, you know, as a commercially-oriented author whose only job is writing, I’m obliged anyway. If I didn’t have this bigass contract, I would still have to write a book a year, more or less, plus a bunch of other things, or else I wouldn’t be able to pay my bills. That obligation was already baked in to how I live my professional life.

What the contract did, again, was alleviate the anxiety of whether what I wrote would sell, or whether I would get paid for it (or more accurately, if I would get paid what I thought was reasonable). Now, being the lucky dick that I am, I will cheerfully note that selling work was never really a problem for me prior to the contract; my modus operandi was to say to Tor, “Hey, here’s a book, want it?” and they would say “Thank you, yes, that would be lovely.” But on the other hand, there is a three-year gap in my novel publishing schedule between 2008 and 2011, and it’s there for business reasons, not because I didn’t want to write novels in there. Yes, it’s weirdly coincident to the last major global economic downturn. Strange, that. Lesson: There are no guarantees in this business, even if you’re already a best selling award magnet. Unless you get that guarantee in the form of a contract.

That stability has business applications aside from money. For example, Tor has, for print and eBook, my entire back list of novels — fourteen so far, and (obviously) more to come. Having them all with the same house means we plan and strategize on how to use the back list to our advantage. So, for example, this April we did a one-day giveaway of The Collapsing Empire and a one-day $2.99 eBook sale of The Consuming Fire, directly ahead of the release of The Last Emperox. Tor can also do things like make the entire backlist readily available to bookstores when a new release comes out, so people who like the newest book have no problem finding older work, to the benefit of us and to bookstores. Book sales aren’t just about new books and bestseller lists — Old Man’s War is still my biggest seller, and it’s never been near a NYT list — and having stability and continuity in who is distributing the Scalzi library is a huge competitive advantage not every author gets to have.

Mind you, when the deal came out, there were a number of commentators who suggested that I had traded stability for the opportunity to make real money, since, depending on how one decided to slice it, an average of $261,000 per book or $340,000 per year, guaranteed, wasn’t all that much money; it wasn’t, really, what a bestselling, award-winning author should be making, now, was it?

(This is where actual authors, and actual bestselling authors, throw their heads back and laugh outrageously loudly, by the way.)

But these commentators are not entirely wrong. I mean, they’re wrong about $261k not being “real” money for a book, honestly, that’s just a ridiculous assertion in a world where the average advance for a science fiction novel from a “Big Five” publisher is something like $12.5k. But they’re not wrong that stability was as important to me as the price tag on the deal. And this was for a couple of reasons.

The first is: Look, unless you’re buying yachts and helicopters and trophy spouses and cocaine, or live in San Francisco, there comes a certain financial threshold where all your life needs and wants are taken care of and more money just becomes more money and not much more. What that number is for you depends on several factors, including where you live (see: San Francisco above), what your debts and owes are, how important being flashy with your money is, whether it’s really critical to you that your kids go to an Ivy-level school rather than Eastern Michigan University (or your state’s equivalent), where you vacation and (hopefully) how much you save for the day when you’re not making money anymore.

Turns out, for me, that number is somewhere around $200,000. At $200,000 all my bills and debts are paid, I’m able to invest and save and pay for my kid’s college, I get to buy whatever thing it is I want to buy (usually tech stuff and musical instruments), I can donate to charities and most of all I can just stop worrying about whether I can afford to live. More money after that? Great! Love it! I’m a capitalist! Into savings and investments it goes. But for me, the quality of my day-to-day life is not manifestly changed above $200k — a sum which in itself, incidentally, would still put me in the top ten percent of income earners in the United States.

What that realization means for me is that after a certain point, I had the luxury of looking at a book deal not just in terms of what the money was, but what else I was getting from it and what that would mean in the long term, financially and otherwise. It might not surprise you to know that before Tor made their offer, I was actively being scouted by other science fiction imprints, and had more than one lunch with editors and publishers where we talked about how I would fit into their house and plans. I think it’s not unreasonable for me to suggest that I could have gotten something like a seven-figure, three-book deal from another Big Five publisher, where the average advance per book would have been significantly higher than what I got from Tor.

But here’s the other reason stability was as important as the money: Because the tradeoffs matter. Is it better, for example, to go for a book deal that offers more money up front but has a shorter term, and represents a concrete break with your publishing past (this is the back list thing again), requires you to get used to a new publisher, editor, PR/Marketing team and so on, with the knowledge that if those three books underperform, for whatever metrics “underperform” represents, you’re out on the pavement again and everyone knows why? Or is it better to get possibly less per book up front than you might get elsewhere (but still more than enough, I mean, Jesus), work with people you know, like, and respect professionally, know — because it’s in the contract — that your books will be a priority on release, and if one or two (or more!) underperform, you have time and resources to adjust and compensate? For a decade, at least?

There is no wrong answer to this, incidentally — the answer is entirely about one’s own tolerance for risk and/or desire for the ability to do long-term planning and strategy. By this point, I think, my own answer is obvious.

And part of that, and because I’m not entirely immune to the charms of money, even when I have enough, is because here’s a thing I know: Money makes more money, and calls attention to itself — which is to say that the longer you’re making significant amounts of money, the easier it is to make significant amounts of money, and to be visible to the people who will give you money. When commentators looked at the deal as $261k per book or at the $340k per year figure, they were only seeing the money in a blunt and not very useful breakdown that was only about the money in the contract. What they didn’t see was what the attention a $3.4 million, decade-long, 13-book deal, could get me.

Which was, in this case: a separate deal for the audiobook rights, mirroring the Tor deal in length, with the result being that each book release is a priority for a second publisher (Audible, who is a delight to work with), meaning more publicity and marketing, also from exceptionally smart folks. More long-term deals from foreign publishers with more money attached. Increased interest from Hollywood, with option deals following. Paid speaking gigs and other business opportunities. Write ups and profiles and analysis in mainstream media, not just genre and trade publications. A raised profile that Tor and my other publishers can work with and use to increase interest in my work and grow sales, which makes the next round of publicity and marketing easier, raising my profile further — something we can do over and over and over, not just two or three times. And — this is important — increased interest in my back list, which generates sales and royalties between new releases.

Money makes money, or can, anyway. With this deal, at least, that has absolutely been the case. Krissy does not like for me to talk specific sums and I think she has a reasonable basis for this. I can say, without being overly specific, that with respect to the contract and all the knock-on deals and benefits that accrued because of it, and after (absolutely earned) agency and lawyer fees, we left that $3.4 million figure in the dust a while back. With luck, we’ll close out the contract having made a respectable multiple of that amount (Ifif I don’t mess up and write something unreadable, if the economy doesn’t crash so hard that people just stop reading, or at least, paying for books, if I don’t die of coronavirus or marauding bears, if I don’t become such a complete jerk that people can’t bear the sight of my name on a book, if a meteor doesn’t dinosaur us all, if, if, if). Please note that if I’ve already cleared that sum, my partners, Tor most of all, are doing pretty well with the arrangement too. Sometimes things work like they should.

So yes, I paid for stability. I’m happy to say it’s paying me back.

Perhaps the best thing I could say about this contract five years in is that if I had to do it over again, I can’t think of much that I would do differently. It created for me the ability to write the books I want to write, and apparently the books that people want to read. All while knowing that I have partners I can trust to sell the work, and me, to the world, over and over again. Again, this is a gift that not every writer gets to have. I’m immensely grateful for it, and I look forward to writing more books under this contract. Nine more, in fact. I can’t wait.

19:30

Link [Scripting News]

Taking it easy today, not much writing or programming. The weather has turned gorgeous, real upstate NY summer weather. After a long winter and an even longer almost-spring, including snow on May 9, and a pandemic, it's pretty ecstatic weather, luxurious, great-to-be-alive type weather. It's the contrasts that make the eastern part of the US so much more livable than the west, say I, a native son of the east who spent many years in the west.

Link [Scripting News]

I'm always looking for a good binge, and I found one. The second season of Homecoming is out, on Amazon. I started it the other night instead of watching the news. I had forgotten most of the plot of the first season, I remember liking it, but it didn't leave much of an impression. The second season is nicely done, has a Mr Robotish feel, there's a constant stream of twists and surprises, it's fun and so far intellectually gratifying, and it reviews the plot of season 1 as it goes. We have an inkling of how it will end because the first episode is about how it ends, or so we are led to believe. I don't know otherwise because I still have a few episodes to go. But nothing in this show is a straight line, and as I said it's well done. I especially like the end of each episode. They end with a twist, but they stay wtih the scene as the credits roll. I had not seen this technique before.

19:14

Pirate ‘Treasures’ Continue to Show Up on Google Maps [TorrentFreak]

pirate map legoGoogle Maps is a wonderful tool that helps millions of people find their way around the world. Some would be literally lost without it.

Generally speaking, Maps is used to navigate the real world. However, spammers are also using it to guide prospective pirates on the Internet.

This leads to rather unusual findings. For example, this week one of our searches guided us to a user-generated Google Map that marked a location in the middle of New Delhi, India.

While it’s no secret that there are millions of pirates in the Asian country, it was still a bit of a surprise to see the location tagged as “GTA V Free Download For PC Full Version Setup+Torrents

Below is a screenshot on the map, which links to a now-removed page at hellboundgamers.com. It also reveals that these links can generate quite a lot of traffic, with this particular map having been viewed more than 12,000 times.

GTA Maps pirate scam

When we investigated further, we found dozens of these pirates ‘treasures’ scattered around Google Maps. Some pinpoint specific locations, others just load a generic map. What they all have in common is that they are filled with pirate keywords.

For example, one Google Maps layer targets prospective pirates of the movie “Boy Erased.” It is advertised with a bunch of related terms, such as ‘Full Movie Online Boy Erased,’ ‘Online Free Watch Boy Erased online free HDQ,’ ‘Boy Erased watch online free 1080P,’ to name a few.

boy erased pirate keywords

Some links are more nefarious than others. The trick can be used by pirates to draw attention to their sites, but more often it’s abused by scammers who link to some kind of paysite, where people should never leave their credit card details.

That begs the question of how many people who viewed these links fell into a trap?

The scammers use the My Maps trick because these search results are more likely to rank well. Google Maps is seen as a trusted site, as opposed to a random page where links are spammed.

This problem isn’t entirely new either. We signaled similar issues in the past and Google is undoubtedly aware of them too. As is often the case with user-generated content, however, they rely on copyright holders to alert them.

When we look at Google’s received takedown notices reported by Lumen, we see that many of these My Maps links have been reported by copyright holders. However, that doesn’t deter scammers and spammers from hiding new ‘treasures’ on Google Maps.

From: TF, for the latest news on copyright battles, piracy and more.

17:44

Today in GPF History for Sunday, May 24, 2020 [General Protection Fault: The Comic Strip]

"I hope you're feeling better this morning..." "After nearly being devoured by a giant carnivorous gecko thanks to you? Oh, LOADS better..."

16:49

Petter Reinholdtsen: More reliable vlc bittorrent plugin in Debian (version 2.9) [Planet Debian]

I am very happy to report that a more reliable VLC bittorrent plugin was just uploaded into debian. This fixes a couple of crash bugs in the plugin, hopefully making the VLC experience even better when streaming directly from a bittorrent source. The package is currently in Debian unstable, but should be available in Debian testing in two days. To test it, simply install it like this:

apt install vlc-plugin-bittorrent

After it is installed, you can try to use it to play a file downloaded live via bittorrent like this:

vlc https://archive.org/download/Glass_201703/Glass_201703_archive.torrent

It also support magnet links and local .torrent files.

As usual, if you use Bitcoin and want to show your support of my activities, please send Bitcoin donations to my address 15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

16:24

Pluralistic: 24 May 2020 [Pluralistic: Daily links from Cory Doctorow]


Today's links



Bloomberg editorial calls for a supersized New Deal (permalink)

Sometimes, you can actually see the Overton Window shifting. This month is one of those times, with Bloomberg running a Noah Smith op-ed calling for a new New Deal, arguing that the main problem with the last one is that it didn't go far enough.

https://www.bloomberg.com/opinion/articles/2020-05-15/u-s-economy-needs-another-new-deal-for-coronavirus-depression

Smith devotes a fair chunk of his column to debunking New Classical economists who claim that the New Deal lengthened the Great Depression, an idea that has been comprehensively demolished by careful empirical work, and is only cited today by plute-lovin' motivated reasoners.

Though Smith doesn't write the words "Modern Monetary Theory," it's hard not to see them waiting just off to one side – the idea that inflation is causedby government spending on things the private sector is trying to but – not by deficits.

https://pluralistic.net/2020/05/14/everybody-poops/#deficit-myth

With the corollary that when the private sector stops buying things – especially the labor of tens of millions of people – the private sector can buy those things without creating inflation.

In other words, everyone can have a job. Everyone should have a job. Not giving people jobs is bad for the economy. An economic system that has a "natural level of unemployment" is cruel and unworthy of our loyalty.

https://pluralistic.net/2020/05/05/the-hard-stuff/#jobs-guarantee



A Database of Ruin (permalink)

This week marks the publication of Barton Gellman's "Dark Mirror," an important addition to the canon of books about the Snowden revelations. Earlier this week, The Atlantic ran a fascinating excerpt about how spy agencies targeted Gellman.

https://pluralistic.net/2020/05/21/profitable-butchers/#sources-and-methods

Today in Wired, we get another taste – a long excerpt about the "Database of ruin" – the NSA's system for mapping the "social graphs" of every person in America using phone billing record.

https://www.wired.com/story/inside-the-nsas-secret-tool-for-mapping-your-social-network/

This system was handwaved by GW Bush, who said, "if somebody is talking to al Qaeda, we want to know why" – but as Gellman discovered, that's not what the "Stellarwind" program did. This wasn't about getting terrorists' call records to see who they talked to.

It was about "six degrees of separation," finding everyone who talked to someone that a terrorist talked to, then everyone they talked to, and so on and so on. Exponential growth (a subject we've become much more familiar with) means that soon, you're looking at everyone.

The computational intensity of this task meant that the trillions of records the NSA ingested weren't inert on a hard-drive, waiting to be pulled after an attack so that cops could find confederates of the attacker. Rather, they were constantly, continuously recomputed.

For decades, the NSA was created these algorithmic webs of suspicion, seemingly in ignorance of Cardinal Richilieu's Law: "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."

This is what made it a "database of ruin." Because just as predictive policing doesn't predict crime (it predicts whom the police will suspect of crime), so did Mainway/Stellarwind perfectly predict whom the NSA would suspect – but it did not predict who was a terrorist.

And it's what made the system a "dark mirror" – the NSA knew who we talked to and when, but we never knew who they talked to and when. It was one-way glass.

Gellman: "If the power implications do not seem convincing, try inverting the relationship in your mind: What if a small group of citizens had secret access to the telephone logs and social networks of government officials?"

"How might that privileged knowledge affect their power to shape events? How might their interactions change if they possessed the means to humiliate and destroy the careers of the persons in power?"

In 2008 – a few years after the Mark Klein revelations (the events that precipitated Snowden's own whistleblower journey), I was so struck by this concern that I wrote a short story about it.

In "The Things That Make Me Weak and Strange Get Engineered Away," I imagine a system of automated, universal suspicion, abetted by a cadre of willfully blind, technically excellent and brilliant prodigies in monasteries.

https://www.tor.com/2008/08/06/weak-and-strange/

Rather than raising honeybees or making wine, their monastic order processes data for the security agencies. "Weak and Strange" follows one of these monks as he confronts who he is and what he does.

Living in our present moment requires enormous compartmentalization skills – there is no "ethical consumption," so either you don a hairshirt of material privation, or you try not to dwell on the oceans of blood just below the surface.

It's why I'm so interested in whistleblowers like Snowden, and anyone who confronts the reality of their own complicity in the indefensible. Even if you don't have to go into exile as a result of your actions, you still pay a giant psychic price for it.

I re-read Weak and Strange the other day, after reading Matt Web's post about neurodiversity (I wrote the story after a car-ride in which Patrick Nielsen Hayden proposed that monasteries were the medieval way of managing neurodiversity).

http://interconnected.org/home/2020/05/19/resiliance

It reminded me that I've been thinking about the subject of confronting complicity for a long time.

Which was something of a revelation, because my next novel, ATTACK SURFACE (AKA Little Brother 3) is all about this.

https://read.macmillan.com/promo/attacksurfacepreordercampaign/

Somehow, I'd forgotten about Weak and Strange for the years I spent on that book (!). But again, that is the satisfying and sometimes frightening thing about writing: it tells you stuff about yourself you've forgotten or never noticed.



Coronagrifting and other bad design fictions (permalink)

My favorite kind of humor turns on sharp analytic observations, which is why some of my favorite non-comedic writing comes from very funny people. Exhibit A is Kate "McMansion Hell" Wagner, whose superb dunks of bougie architecture are always a highlight of my day.

https://pluralistic.net/2020/03/28/unreciprocated-solidarity/#snarkitechture

As good as those are, I'm even more fond of Wagner's writing about other subjects – the wider social context she draws on for her signature humor pieces.

https://pluralistic.net/2020/04/22/filternet/#kate-wagner

In a new piece in this vein, Wagner outdoes herself, coining "coronagrifting" to describe a particularly odious form of "design fiction" in which design and architecture firms photoshop unworkable, fanciful "inventions" for a post-pandemic world.

https://mcmansionhell.com/post/618938984050147328/coronagrifting-a-design-phenomenon

From Burger King's cardboard crowns to a conversion of Berlin's half-built Brandenberg airport into a pandemic ward to torso-shielding glass bubbles for restaurants, coronagrifting is a symbiosis between moribund design studios and revenue-starved ad-supported media.



Wagner traces their lineage to "paper architecture," a 1960s/70s trend where designers and architects switched from designing buildings to drawing pictures of buildings that couldn't ever exist.

But while paper architecture was "radical, critical and playful," it was eventually sapped of this spirit in the 1980s with the "aesthetic hegemony of Postmodernism," which reinvented paper architecture as "PRchitecture."

PRchitecture: "architecture and design content that has been dreamed up from scratch to look good on instagram feeds or, more simply, for clicks." When starchitects like Bjarke Ingels photoshop designs like "Oceanix," it begets TED Talks, not buildings.

And those TED Talks land Ingels contracts with fascist dictators like Jair Bolsonaro – not contracts to build ecotopian post-global warming floating cities.

PRchitecture, in turn, was the larval form of coronagrifting: creating fanciful, impossible coronavirus designs that get seized upon by the ad-supported, click-driven design press, as a way of sustaining both design firms and their press during the economic apocalypse.

If so, what's the big deal?

Wagner: "You may be asking, "What's the harm in all this, really, if it projects a good message?" And the answer is that people are plenty well encouraged to stay home due to the spread of a deadly virus at the urging of health authorities."

"These tone-deaf art world creeps are using such a crisis for shameless self promotion and the generation of clicks and income, while providing little to no material benefit to those at risk and on the frontlines."

IOW, Wagner is a true believer in design and architecture and she wants it to DO BETTER. This is where Wagner's critical and comedic work converges, with the idea that this could turn out great…if we don't screw it up.

(this is basically my motto for tech, which may be why I love her work so much)

Wagner: "I'm also extremely sure there are interventions that can be made at the social, political, and organizational level, like campaigning for paid sick leave, organizing against layoffs and for decent severance or an expansion of public assistance, or generally fighting the rapidly accelerating encroachment of work into all aspects of everyday life – that would bring much more good and, dare I say, progress into the world than a cardboard desk captioned with the hashtag #StaytheFuckHome."



This day in history (permalink)

#15yrsago Alan Moore tells DC Comics to get bent https://web.archive.org/web/20050527220922/http://www.comicbookresources.com/columns/index.cgi?column=litg&article;=2153

#15yrsago Thurl Ravenscroft, RIP: voice of Haunted Mansion and Grinch song, Tony the Tiger https://web.archive.org/web/20050525220256/http://www.newsfromme.com/archives/2005_05_23.html

#10yrsago Schneier at the airport https://www.schneier.com/blog/archives/2010/05/scene_from_an_a.html

#10yrsago Peter Watts discusses his arrest at US border http://sofanauts.com/the-sofanauts-no-35/

#10yrsago Ireland's largest ISP begins disconnecting users who are accused of piracy https://web.archive.org/web/20100605170505/https://www.irishtimes.com/newspaper/frontpage/2010/0524/1224271013389.html

#5yrsago What Sony and Spotify's secret deal really looks like https://www.theverge.com/2015/5/19/8621581/sony-music-spotify-contract

#1yrago Real estate title insurance company exposed 885,000,000 customers' records, going back 16 years: bank statements, drivers' licenses, SSNs, and tax records https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/

#1yrago Germany demands an end to working cryptography https://www.bleepingcomputer.com/news/security/german-minister-wants-secure-messengers-to-decrypt-chats/

#1yrago Comcast fights shareholder call for lobbying transparency, saying that it would be "burdensome" to reveal how much it spends lobbying states https://arstechnica.com/tech-policy/2019/05/comcast-does-so-much-lobbying-that-it-says-disclosing-it-all-is-too-hard/



Colophon (permalink)

Today's top sources: Naked Capitalism (https://nakedcapitalism.com/).

Currently writing: My next novel, "The Lost Cause," a post-GND novel about truth and reconciliation. Friday's progress: 543 words (18963 total).

Currently reading: The Case for a Job Guarantee, Pavlina Tcherneva

Latest podcast: Someone Comes to Town, Someone Leaves Town (part 03) https://craphound.com/podcast/2020/05/18/someone-comes-to-town-someone-leaves-town-part-03/

Upcoming appearances: Discussion with Nnedi Okorafor, Torcon, June 14 https://www.torforgeblog.com/torcon-2020/

Upcoming books: "Poesy the Monster Slayer" (Jul 2020), a picture book about monsters, bedtime, gender, and kicking ass. Pre-order here: https://us.macmillan.com/books/9781626723627

"Attack Surface": The third Little Brother book, Oct 20, 2020. https://us.macmillan.com/books/9781250757531

"Little Brother/Homeland": A reissue omnibus edition with a new introduction by Edward Snowden: https://us.macmillan.com/books/9781250774583


This work licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commerically, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/web/accounts/303320

Twitter (mass-scale, unrestricted, third-party surveillance and advertising):

https://twitter.com/doctorow

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
When life gives you SARS, you make sarsaparilla -Joey "Accordion Guy" DeVilla

15:14

Holger Levsen: 20200523-i3statusbar [Planet Debian]

new i3 statusbar

🔌 96% 🚀 192.168.x.y 🐁 🤹 5+4+1 Qubes (80 avail/5 sys/16 tpl) 💾 77G 🧠 4495M/15596M 🤖 11% 🌡️ 50°C 2955🍥 dos y cuarto 🗺  

- and soon, with Qubes 4.1, it will become this colorful too :)

That depends on whether fonts-symbola and/or fonts-noto-color-emoji are being available.

14:06

05/24/20 [Flipside]

I have finally fixed my old DND comic! It can now be viewed here! This was the comic I made based on our DND campaign from the 2000s.

12:38

A small business isn’t simply a little version of a big business [Seth's Blog]

Fewer meetings, fewer resources, fewer constraints.

The biggest advantage that a small business has is that the owner can look customers in the eye. And vice versa.

Instead of policies, groupthink and leverage, the way forward for a small business might be the very thing that fueled you in the start: find out what people need and help them get it. Right away.

It’s never been easy to be a small business and it’s even more difficult right now. But resilience and flexibility go together.

The first rule remains: figure out what people need and bring it to them.

09:42

Spotify Launches Crackdown on Tools Offering Premium Service For Free [TorrentFreak]

Spotify is currently the most popular music streaming platform in the world with 286 million users. An impressive 130 million subscribe to the company’s premium service with the remainder using the ad-supported tier.

Somewhere in those figures are a small minority who enjoy the features of Spotify Premium but yet manage to do so without paying the subscription fees charged by the company. This is achieved by deploying various hacks and workarounds that remove the restrictions imposed on users of the ad-supported service.

In many cases this means users obtaining a hacked variant of the Spotify software, often on the Android platform. These applications don’t subject users to adverts and in some cases claim to enable other features such as unlimited track skipping and a departure from enforced shuffling.

Needless to say, Spotify views these applications as a threat to its business model. The company has previously taken action against specific tools in an effort to make them harder to find but more recently the Swedish streaming service appears to have stepped up its efforts.

Beginning back in March but increasing as the weeks have passed, Spotify AB has been sending DMCA notices to Google targeting domains that appear to be offering the types of tools highlighted above. Torrentfreak learned of the complaints from a third-party and we were able to track many of them down using the Lumen Database repository.

The majority targeted at Google’s search indexes contain similar wording, with claims that the domains in question are infringing on Spotify’s intellectual property rights. However, the company goes further still with allegations that the tools are designed for fraudulent purposes.

“This site uses Spotify intellectual property in its content without authorization and this falsely suggests Spotify sponsorship or endorsement of the website and violates Spotify exclusive rights,” many read.

“We reasonably believe that it is the intention of its owners to use it as an instrument of fraud.”

Spotify DMCA complaint to Google

At the time of writing Spotify has targeted at least 20 domains with requests like this one to remove more than 60 URLs. Many seem to be so-called APK download sites or similar platforms giving hints and tips about how to obtain Spotify and indeed other services for free, with accompanying links.

However, when testing the domains in the numerous takedown notices our interest was piqued by at least one that triggered a Malwarebytes ‘fraud’ alert. Spotify took a particular interest in this domain by targeting 14 of its URLs, which raises the question of what type of fraud is taking place on the site.

SpotifyPlus.com blocked

Spotify appears to use the term in connection with using its intellectual property and accessing its platform in an unauthorized manner but it wouldn’t be a huge stretch to think that something even more nefarious might be at play with some modified APK files available online today.

In the vast majority of cases, Google has complied by delisting the requested URLs. At the time of writing there are a handful of more recent Spotify complaints marked as pending a decision (1,2,3)but it would be no surprise if they were removed during the days to come.

From: TF, for the latest news on copyright battles, piracy and more.

08:15

Honduras former police chief faces drug trafficking charges [Richard Stallman's Political Notes]

President Hernández of Honduras is suspected of being a major drug trafficker. His former chief of the national police faces US drug trafficking charges.

Hernández got into power in the dubious election held after the US-supported coup. His brother was convicted already of drug trafficking.

Prohibition of recreational drugs is futile and stupid, but that doesn't make trafficking good. For addictive drugs, the state should provide them to addicts in a safe way, so as to pull the plug on the black market.

San Francisco war on homeless [Richard Stallman's Political Notes]

San Francisco continues its war on homeless, especially its uniformed thugs, but some people are being allowed for the time being to live in tents on the street.

Biden considers being more progressive. [Richard Stallman's Political Notes]

Biden says that he will consider being more progressive than he was advocating previously.

For this to win my vote, he must endorse specific progressive policies, not merely say he is thinking about doing so.

German safety laws for meat processing plants [Richard Stallman's Political Notes]

Germany has adopted new safety laws for meat-processing plants.

We should ban use of subcontracted workers in all areas of work.

Study of hydroxychloroquine found to increase death rate [Richard Stallman's Political Notes]

A study of almost 100,000 patients given hydroxychloroquine as a putative treatment for Covid-19 found that the drug increases the death rate.

The bullshitter may be safe taking hydroxychloroquine, for the time being, if he does not have Covid-19.

14 day quarantine for international arrivals to UK [Richard Stallman's Political Notes]

The UK will make people arriving internationally pass 14 days of quarantine.

It might make sense to quarantine travelers from high-sickness countries such as the US and Brazil. However, it is pointless and irrational to do this to people coming from other EU countries. They don't have a higher infection rate than the UK itself.

Urgent: Everyone: Call on Chase to stop lending to planet roasters. [Richard Stallman's Political Notes]

Everyone: phone Chase CEO Jamie Dimon’s office at +1-212270-1111 and call for Chase to stop lending to planet roasters. 350.org suggests saying these words

Hi, my name is _______. I'm calling Jamie Dimon's office today to urge him to stop giving loans to the fossil fuel industry. I want him to do this for the sake of people around the world and the future of our planet. As a consumer, I will refuse to bank with any company that is so out of touch that they're still funding fossil fuels.
if you can't think of something better to say. No insults or name-calling, please — use a polite tone to state your criticism. Fossil fuel infrastructure is expensive. If banks won't lend for that, it can't be built.

05:09

François Marier: Printing hard-to-print PDFs on Linux [Planet Debian]

I recently found a few PDFs which I was unable to print due to those files causing insufficient printer memory errors:

I found a detailed explanation of what might be causing this which pointed the finger at transparent images, a PDF 1.4 feature which apparently requires a more recent version of PostScript than what my printer supports.

Using Okular's Force rasterization option (accessible via the print dialog) does work by essentially rendering everything ahead of time and outputing a big image to be sent to the printer. The quality is not very good however.

Converting a PDF to DjVu

The best solution I found makes use of a different file format: .djvu

Such files are not PDFs, but can still be opened in Evince and Okular, as well as in the dedicated DjVuLibre application.

As an example, I was unable to print page 11 of this paper. Using pdfinfo, I found that it is in PDF 1.5 format and so the transparency effects could be the cause of the out-of-memory printer error.

Here's how I converted it to a high-quality DjVu file I could print without problems using Evince:

pdf2djvu -d 1200 2002.04049.pdf > 2002.04049-1200dpi.djvu

Converting a PDF to PDF 1.3

I also tried the DjVu trick on a different unprintable PDF, but it failed to print, even after lowering the resolution to 600dpi:

pdf2djvu -d 600 dow-faq_v1.1.pdf > dow-faq_v1.1-600dpi.djvu

In this case, I used a different technique and simply converted the PDF to version 1.3 (from version 1.6 according to pdfinfo):

ps2pdf13 -r1200x1200 dow-faq_v1.1.pdf dow-faq_v1.1-1200dpi.pdf

This eliminates the problematic transparency and rasterizes the elements that version 1.3 doesn't support.

Unity Mermaid by Ed Gedeon [Skin Horse]

Shaenon: We’re getting so much fan art this month! Thank you! It’s Mermay, the month for drawing mermaids, and Ed Gedeon has gifted us this not-at-all-terrifying Unity made from a melange of sea creatures. Thanks, Ed!

Channing: Poor Ariel deserved a better fate, I’m afraid. Nevertheless, such a perfect Mermay present! Awesome, thanks Ed!

Naturally, I am waiting with bated breath for my beloved Junicorn.

03:07

Hibiscus Teesdale [Nina Paley]

Last week I saw this very unusual recumbent for sale on Fecebook. I’m always trying to get my friends’ butts on recumbents, and this one appeared to have a more adjustable seat and size range than a typical Easy Racers bike. And look at that — Phil Wood hubs? So I bought it.

Amazingly, a visiting Chicago friend of mine was willing to meet the seller somewhere in Illinois, and the seller was willing to drive all the way from Western Iowa to meet my friend, and it miraculously worked out so that just days after my purchase, this appeared in my driveway:

Hibiscus Teesdale stuffed in the back of my friend’s small car.

The listing said the frame was built by Tom Teesdale of West Branch, Iowa. I looked him up, and discovered he was highly respected but little-known beyond hardcore bike nerd circles. He died in 2014, attending the venerable RAGBRAI cycling event. In his honor, I decided to name this purple giant Hibiscus Teesdale.

At first glance, Hibiscus appears to be an Easy Racers Fold Rush clone. I already own a Fold Rush, so I was reluctant to get another, until I looked more closely at the photos. Hibiscus is different.

Check out that jack shaft!

For one thing, she has a jack shaft. Instead of one long chain running from the crank to the rear cassette, she has two smaller chains: one from crank to jack shaft, one from jack shaft to rear chainrings. Since the Fold Rush chain often falls off and/or gets twisted when folding, this looked like a genius innovation. I could also see the handlebar stem was designed to fold in, a feature I wished my Gold Rush had. Was this the lightweight, improved-folding long-wheelbase recumbent of my dreams?

Ancient photos of the same frame design in green.

Well, no. The first thing I learned in real life was that her fold requires tools. In fact, she has an aluminum brace (the same gorgeous purple as the rest of her) that has to be unscrewed from the elastomer and unbolted from the frame before folding. There is no quick release on this brace; two wrenches are required. There is also no quick release on the handlebar stem. These are all old-school bolts, not Allen bolts, and in many different sizes, so I was glad to have a complete set of bits in my ratcheting wrench set, as well as an adjustable wrench.

Underside of the seat.

The seat, at least, has a quick-release, and is very adjustable, although you still need a wrench to adjust the seat support struts. You can see above there is plenty of room for it to slide back for taller riders, and forward for shorter ones. That makes it more versatile than a typical Easy Racers frame, but it is a whole lotta extra bike if you’re short.

Hibiscus is indeed huge. And heavy. I think she is made of steel, other than her brace. She is at least as heavy as my steel Tour Easy.

She also feels like she might be indestructible. I’m asking the seller if he knows the recommended rider weight limit. I expect she could accommodate heavier riders than anything else in my stable.

Closeup of the elastomer, which resembles a thick rubber hockey puck, between the rear tire and the seat.

Like the Fold Rush, Hibiscus has suspension created by the folding mechanism itself, similar to the suspension on a Brompton, another folding bike I cherish (I Bromptoned all over New York City when I lived there).

The ride is smooth and comfortable, but that could also be because the frame is so long, as well as the huge thick tires she came with. Usually I put narrower road tires on my ‘bents, but since she’s already wearing these wide nubbly shoes, I intentionally rode her on lousy streets, over cracks and gravel. I wasn’t looking for a gravel ‘bent, but now I have one.

Seller’s photo. I’m currently riding without the fairing (or mounts).

I thought the stiff “Cobra” style seat was an odd choice for a heavy suspended bike. I have a Cobra seat on my small Gold Rush, and the ride is very harsh, but that’s probably due to its stiff, small, aluminum frame. On this huge long suspended steel frame, the seat didn’t feel harsh at all. I liked that it held my back up straight.

8 speed cassette with Shimano Deore DX derailer.

I don’t know exactly when Hibiscus was built, but she is equipped with Shimano Deore DX components, which were apparently produced between 1990 and 1993. She has these charming bar-end shifters to match:

I’m pretty sure the handlebar foam is original. Hibiscus is remarkably well preserved for her age. I do need to replace the chains, as a few links are rusting.

Phil Wood hubs!!! I wonder if she also has a Phil Wood bottom bracket, like my modified Gold Rush, but I’m not gonna open her up to find out.

As of this writing, Hibiscus has been in my possession just over 24 hours. So far we’ve spent 17 miles together. I did many errands on her this afternoon, picking up and delivering things.

She is not fast. But the more I ride her, the more I like her. I don’t have room in my garage for 4 long wheelbase recumbents, so at some point one of my stable is going to move on. Will it be Hibiscus, or will it be Foldilocks (Fold Rush), Silver (Gold Rush), or Connie Bikeson (Tour Easy)?

Time to get a bigger garage.

Share

02:42

A typical day on the set at Tabletop [WIL WHEATON dot NET]

This is from my Tumblr Thingy. I thought it would be relevant to some of your interests. QUESTION: Hello, I have a question about Tabletop (don’t worry, it’s not “when […]

Saturday, 23 May

22:49

‘App Watch’ Allows Operators to Monitor and Ban Piracy Apps on Android Set-Top Boxes [TorrentFreak]

pirate boxMany content providers and networks have their own set-top boxes that can be connected to any modern TV.

These devices are often running on Android and sometimes allow users to install third-party apps, via Google’s Play store, for example.

This opens the door to a wide range of other apps which can be problematic, especially when they offer a gateway to pirated content that directly competes with the operator’s service.

To address this potential threat, digital security company Irdeto is offering an ‘App Watch’ service. This is part of the company’s broad range of piracy tools and services which also includes the game anti-tamper software Denuvo, which recently expanded with an anti-cheat service.

App Watch is targeted at providers of streaming services who have their own set-top boxes. It’s meant to safeguard these companies against abuse and prevent consumers from using their boxes as piracy tools.

“The problem with giving consumers choice is that they may get distracted from your services, on your platform,” Irdeto writes, pointing out the worst-case scenario.

“Consumers may use your top-of-the-line STB for everything EXCEPT your services, or at most just your basic package. The potential damage ranges from losing content upsell opportunities to outright enabling piracy on your box.”

Irdeto mentions that Google has a vetting process and removes clearly infringing apps from its store. However, the system isn’t perfect, with apps remaining on set-top boxes even after deletion by Google. App Watch monitors pirate apps and can delete them from users’ devices if needed.

irdeto app watch

In addition, it tackles another major problem that software like Kodi presents. Irdeto stresses that Kodi is perfectly legal. However, it can be abused and exploited by pirate add-ons. This is something App Watch can take care of as well.

App Watch monitors all activity on set-top boxes and it can also see how apps are used. When they connect to pirate streaming sites or use pirate add-ons, the operator can take action. This includes blocking or removing Kodi add-ons, while Kodi itself remains available to users.

“Irdeto provides a range of actions you can take to stop app-based piracy on the set-top box, such as disabling add-ons or blocking URLs,” Irdeto explains, adding that its services can also be used to pursue legal action against pirate suppliers.

All the options and data can be monitored through a dedicated dashboard which reveals how many pirate apps and services are installed. This gives providers full control over their users’ devices.

These app usage data are collected anonymously, but providers can use it to reach out to users directly, and point them back toward the legal options if needed.

“By knowing the demand and methods used to bypass your offers, you can devise promotional strategies and on-screen features that entice and enable viewers to easily switch back to your content offers.”

All in all App Watch sounds like a pretty clever system. Whether consumers will appreciate the monitoring and tracking remains to be seen.

Looking at Irdeto’s Denuvo technology, an often-heard complaint is that the anti-piracy tool decreases performance. While that claim has been disputed, the company is aware of the sensitivities and stresses that App Watch users have nothing to worry about.

“The agent running on the set-top box for monitoring app usage is lightweight and has no performance impact on the viewing experience,” Irdeto concludes.

From: TF, for the latest news on copyright battles, piracy and more.

Listening to the virus [Scripting News]

The latest save my life story (must-read) makes me wonder how to listen to people we support. People who are suffering. What conclusions to draw from what they say?

This is part of the "we're going to have to learn to live with it" approach, which is another part of save my life. It's not only about medicine, math, politics, money and power -- it's also about individual people who need -- what? How can we help? How to listen? How can we help? What to say? And how can we help?

The author wasn't able to convey her condition to the first doctor over the phone. I wanted to know how the doctor could do better. Also how the doctor could have made a difference when there was no treatment, at the time -- not sure if there's treatment possible now, even.

It's about more than science. It's about us.

22:07

Link [Scripting News]

Anybody thinking how we can lobby the Senate to support local governments so we continue to have police, fire, sanitation, health care, teachers, etc.

Me, as a kid [Scripting News]

My brother found this picture of me as a kid in my father's photos.

21:42

Alexander Artemenko: cl-change-case [Planet Lisp]

This cool library is able to transform strings from one time of delimiters to others.

Previously I've used kebab, but cl-change-case is much more featureful:

POFTHEDAY> (cl-change-case:path-case "foo-bar-bazz")
"foo/bar/bazz"
POFTHEDAY> (cl-change-case:path-case "foo-bar_bazz")
"foo/bar/bazz"
POFTHEDAY> (cl-change-case:path-case "foo-bar-bazz")
"foo/bar/bazz"
POFTHEDAY> (cl-change-case:sentence-case "foo-bar-bazz")
"Foo bar bazz"
POFTHEDAY> (cl-change-case:snake-case "foo-bar-bazz")
"foo_bar_bazz"
POFTHEDAY> (cl-change-case:camel-case "foo-bar-bazz")
"fooBarBazz"
POFTHEDAY> (cl-change-case:no-case "foo-bar-bazz")
"foo bar bazz"
POFTHEDAY> (cl-change-case:header-case "foo-bar-bazz")
"Foo-Bar-Bazz"

When this can be useful? In cases when you interop with other systems, but want to use :this-style-of-symbols in Lisp. For example, you might generate identifiers for JavaScript or Python.

Another case is when you want to output labels for UI. Here I have a function which will render an HTML table describing a CLOS object:

POFTHEDAY> (defclass user ()
             ((created-at :initarg :created-at)
              (name :initarg :name)
              (num-posts :initarg :num-posts)))

POFTHEDAY> (defun render (object)
             (let* ((class-name (type-of object))
                    (class (find-class class-name))
                    (slots (closer-mop:class-slots class)))
               (cl-who:with-html-output-to-string (*standard-output* nil :indent t)
                 (:table
                  (loop for slot in slots
                        for slot-name = (closer-mop:slot-definition-name slot)
                        for label = (cl-change-case:sentence-case (symbol-name slot-name))
                        for value = (rutils:fmt "~A"
                                                (slot-value object slot-name))
                        do (cl-who:htm
                            (:tr
                             (:th (cl-who:esc label))
                             (:td (cl-who:esc value)))))))))

POFTHEDAY> (render (make-instance 'user
                                  :name "Bob"
                                  :created-at "2020-05-22"
                                  :num-posts 42))
"
<table>
<tr>
  <th>Created at</th>
  <td>2020-05-22</td>
</tr>
<tr>
  <th>Name</th>
  <td>Bob</td>
</tr>
<tr>
  <th>Num posts</th>
  <td>42</td>
</tr>
</table>"

Alexander Artemenko: named-readtables [Planet Lisp]

This system is highly recommended if you are writing a code which modifies a *readtable* because it allows to define and switch between readtables as you do with Lisp packages.

If you are not familiar with what *readtable* is, then read this article:

https://lisper.in/reader-macros

but pay attention, that the article manipulates with *readtable* instead of using named-readtables. This is bad. Use named-readtables instead.

First, let's see how to use named-readtables to switch between read-tables. As an example, we'll see how to use cl-interpol and rutils readtables.

This is how you can lookup which tables are available:

POFTHEDAY> (ql:quickload '(:cl-interpol :rutils))

POFTHEDAY> (named-readtables:list-all-named-readtables)
(#<NAMED-READTABLE :COMMON-LISP {1000024B73}>
 #<NAMED-READTABLE :CURRENT {1000025663}>
 #<NAMED-READTABLE RUTILS.READTABLE:RUTILS-READTABLE {1004A960E3}>
 #<NAMED-READTABLE RUTILS.READTABLE:STANDARD-READTABLE {1004A96133}>
 #<NAMED-READTABLE :INTERPOL-SYNTAX {1001D19853}>)

Now let's see how does switching work:

;; First I'll switch to the interpol's syntax:
POFTHEDAY> (named-readtables:in-readtable :interpol-syntax)

POFTHEDAY> (let ((username "Bob"))
             #?"Hello ${username}!")
"Hello Bob!"

;; Rutils readtable is not active, and we can't
;; use it's syntax for hashes:
POFTHEDAY> #h(:foo "bar")
; Debugger entered on #<SB-INT:SIMPLE-READER-ERROR
; "no dispatch function defined for ~S" {10068D4C63}>

;; We have to activate  it first
POFTHEDAY> (named-readtables:in-readtable
            rutils:rutils-readtable)

POFTHEDAY> #h(:foo "bar")
#<HASH-TABLE :TEST EQL :COUNT 1 {10068B9013}>

;; But now we are unable to use iterpol's syntax:
POFTHEDAY> (let ((username "Bob"))
             #?"Hello ${username}!")
; Debugger entered on #<SB-INT:SIMPLE-READER-ERROR
; "no dispatch function defined for ~S" {1006AE93F3}>

But what if we want to use both readtables from cl-interpol and from rutils?

It is possible if we merge them together and create a new readtable:

POFTHEDAY> (named-readtables:defreadtable
               :poftheday
             (:merge
              rutils:rutils-readtable
              :interpol-syntax))

POFTHEDAY> (named-readtables:in-readtable
            :poftheday)

POFTHEDAY> (let ((username "Bob"))
             #h(:greeting #?"Hello ${username}!"))
#<HASH-TABLE :TEST EQL :COUNT 1 {1003054C23}>

POFTHEDAY> (rutils:print-ht *)
#{
  :GREETING "Hello Bob!"
 }

Now we'll define a literal syntax for lambda from rutils as a separate named read-table:

POFTHEDAY> (defmacro trivial-positional-lambda (body)
             `(lambda (&optional % %%)
                (declare (ignorable %) (ignorable %%))
                ,body))

POFTHEDAY> (defun |^-reader| (stream char)
             (declare (ignore char))
             (let ((sexp (read stream t nil t)))
               `(trivial-positional-lambda
                 ,(if (and (listp sexp) (listp (car sexp)))
                      (cons 'progn sexp)
                      sexp))))

POFTHEDAY> (named-readtables:defreadtable
               :lambda
             (:merge :standard)
             (:macro-char #\^ #'|^-reader|))

;; Now we can switch to the new readtable
;; and use new syntax for lambdas:
POFTHEDAY> (named-readtables:in-readtable :lambda)

POFTHEDAY> ^(+ % %%)
#<FUNCTION (LAMBDA (&OPTIONAL % %%)) {2252593B}>

POFTHEDAY> (funcall *
                    2
                    3)
5

Named readtables has yet another useful feature - it integrates with SLIME. When you have a (in-readtable) call after you package definition, SLIME will know what readtable to use when you hit Ctrl-C Ctrl-C on defuns.

That is what in-readtable expands to:

POFTHEDAY> (named-readtables:in-readtable :interpol-syntax)

;; It expands to:
(eval-when (:compile-toplevel
            :load-toplevel
            :execute)
  (setf *readtable*
        (named-readtables:ensure-readtable
         ':interpol-syntax))
  (when (find-package :swank)
    (named-readtables::%frob-swank-readtable-alist
     *package*
     *readtable*)))

This %frob-swank-readtable-alist modifies swank:*readtable-alist* to make it know what readtable should be used for the package. But a comment to this code says it is a KLUDGE.

Interesting, how this will or should work in the LispWorks?

UK Tories treaty will encourage environmental degradation [Richard Stallman's Political Notes]

UK Tories are as bad as always, on most issues. Now they propose a new business-supremacy treaty that will encourage environmental degradation.

By denying Parliament the power to vote on these imposed changes to the UK's laws, the British state h s made itself nondemocratic and therefore illegitimate.

China repression on Hong Kong [Richard Stallman's Political Notes]

China has announced plans to impose direct rule and direct repression on Hong Kong.

At least China's dishonesty will be exposed completely.

Scheme to bypass conflict of interest rules [Richard Stallman's Political Notes]

A new scheme to bypass conflict of interest rules: the head of the US Covid-19 vaccine program was appointed with 10 million in stock in GlaxoSmithKline, one of the companies whose activity the program is involved with. (He got the stock as an employee.)

The cheater appointed him as a contractor rather than an employee and claims that this makes conflict of interest rules irrelevant — but that doesn't prevent conflicts of interest.

Real climate defense in the DNC [Richard Stallman's Political Notes]

Climate defense activist RL Miller has been elected to the Democratic National Committee and plans to use her position to push the party towards real climate defense.

I wonder how members of the DNC are elected. I have never seen any campaign about who will be a member.

Lobbying against single-payer universal medical care [Richard Stallman's Political Notes]

The American Hospital Association funds lobbying against single-payer universal medical care (Medicare for All), through a hypocritically named lobbying group, the "Partnership for America's Health Care Future", for which a more accurate name would be the "Partnership for Unaffordable Health Care and Future Patient Bankruptcies."

Doctors have organized to demand that the AHA stop supporting that lobbying.

21:28

Cough Cough [Charlie's Diary]

You better watch out
You better not spy
Don't go out
I'm telling you why
Dominic Cummings is coming to town

He's taken a test
And ignored it twice;
COVID19'll take him in a trice
Dominic Cummings is coming to town

Doesn't care where he's sleeping
He just knows he's exempt
He doesn't care if he's being bad
Pandemic lockdown can go and get bent
So stay in for goodness sake!
O! You better mask up!
You better not cry
Better not cough
I'm telling you why
Dominic Cummings is coughing
Dominic Cummings is coughing
Dominic Cummings is coughing on you

(To the tune of Santa Claus is comin' to Town)

20:07

Dirk Eddelbuettel: RcppSimdJson 0.0.5: Updated Upstream [Planet Debian]

A new RcppSimdJson release with updated upstream simdjson code just arrived on CRAN. RcppSimdJson wraps the fantastic and genuinely impressive simdjson library by Daniel Lemire and collaborators. Via some very clever algorithmic engineering to obtain largely branch-free code, coupled with modern C++ and newer compiler instructions, it results in parsing gigabytes of JSON parsed per second which is quite mindboggling. The best-case performance is ‘faster than CPU speed’ as use of parallel SIMD instructions and careful branch avoidance can lead to less than one cpu cycle use per byte parsed; see the video of the recent talk by Daniel Lemire at QCon (which was also voted best talk).

This release brings updated upstream code (thanks to Brendan Knapp) plus a new example and minimal tweaks. The full NEWS entry follows.

Changes in version 0.0.5 (2020-05-23)

  • Add parseExample from earlier upstream announcement (Dirk).

  • Synced with upstream (Brendan in #12) closing #11).

  • Updated example parseExample to API changes (Brendan).

Courtesy of CRANberries, there is also a diffstat report for this release.

For questions, suggestions, or issues please use the issue tracker at the GitHub repo.

If you like this or other open-source work I do, you can now sponsor me at GitHub. For the first year, GitHub will match your contributions.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

19:00

Node deprecates request [Scripting News]

This is a technical post.

The three words in the title of the post are noun, verb and subject.

Let's go through them one by one.

  • Node is a popular developer platform with set of common libraries called packages. It's based on JavaScript which is a very popular language. And its power comes from the very deep set of freely usable code you can build on. That part is the reason why I switched to JavaScript in 2013. I wanted to tap into the work of all the other developers using Node. That it was JavaScript was incidental, and honestly the Node platform had nothing to do with it, because at the time I switched I had little idea what it was.
  • deprecates is a word that platform vendors use when they are going to break the implicit promise that the platform you're developing on is stable. The word platform implies stability. The fact that platform vendors can do this is one main reason we like to work with open source software, because if we don't agree with what they're doing, we don't have to go with them, which hopefully means they'll be less willing to break us.
  • request is possibly the most used package in Node. I'm not sure. But since Node is used to make servers and one thing servers do a lot of is call other servers to get information, and request is pretty much the only way to do that, you'd have to say even if it isn't the most popular package, it certainly is one of the most important. If you were to remove request almost all Node apps would break. And that is exactly what they're doing. It won't work. I'm sure of it. And they don't know it yet. But they'll find out.

A couple of stories to go with this.

  • Back in the late 90s when we were working on a new version of Frontier, we were generating a lot of new routines for developers to call. We had packages of routines called suites, and as we were generating them we didn't know which package an individual routine would go in when the new version was finalized. So we created a temporary package called toys, disclaimed it would be deprecated before we shipped. We gave it a silly name so people would remember it was doomed. I said to devs, don't depend on anything in toys being there after we ship. Well, as promised, when it came time to ship, we sorted all the routines in toys to their permanent homes and deleted toys. Everything broke. Everything. The outcry was so loud and angry that we put toys back. The lesson is this, when you ship something to developers you're stuck with it, so be sure you can live with it when you ship. You have to live with your mistakes too. Clearly the Node developers think request is a mistake. Well tough shit, you have to live with it. Sorry I didn't make the rules. 😄
  • Dave Gandy's company makes a product called Font Awesome. It's great. When it came out I knew I was going to use it. I had even been asking someone to do what it does. Anyway, when they came out with a new version, they broke lots of stuff. The conventional wisdom was if the new version is a "full point release," like you're going from version 4 to 5, you can break whatever you want. Well it was a huge setback for Font Awesome and it got users (like me) to fear upgrading to new versions. If they want to improve their product, Dave and his company learned, they would have to add functionality, they can never take functionality out. I wrote it up in February of this year, which feels like a decade ago! :-)

At UserLand we came up with the fundamental rule, so fundamental that we called it Rule 1. It was this: Don't break users. There's nothing more sacred in the relationship between platform vendors and the devs.

So with all that background, I wonder what the Node platform vendor thinks we should use in place of request? To make it as smooth as possible it should just be request, of course. 💥

17:49

Raphaël Hertzog: Freexian’s report about Debian Long Term Support, April 2020 [Planet Debian]

A Debian LTS logo Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In April, 284.5 work hours have been dispatched among 14 paid contributors. Their reports are available:
  • Abhijith PA did 10.0h (out of 14h assigned), thus carrying over 4h to May.
  • Adrian Bunk did nothing (out of 28.75h assigned), thus is carrying over 28.75h for May.
  • Ben Hutchings did 26h (out of 20h assigned and 8.5h from March), thus carrying over 2.5h to May.
  • Brian May did 10h (out of 10h assigned).
  • Chris Lamb did 18h (out of 18h assigned).
  • Dylan Aïssi did 6h (out of 6h assigned).
  • Emilio Pozuelo Monfort did not report back about their work so we assume they did nothing (out of 28.75h assigned plus 17.25h from March), thus is carrying over 46h for May.
  • Markus Koschany did 11.5h (out of 28.75h assigned and 38.75h from March), thus carrying over 56h to May.
  • Mike Gabriel did 1.5h (out of 8h assigned), thus carrying over 6.5h to May.
  • Ola Lundqvist did 13.5h (out of 12h assigned and 8.5h from March), thus carrying over 7h to May.
  • Roberto C. Sánchez did 28.75h (out of 28.75h assigned).
  • Sylvain Beucler did 28.75h (out of 28.75h assigned).
  • Thorsten Alteholz did 28.75h (out of 28.75h assigned).
  • Utkarsh Gupta did 24h (out of 24h assigned).

Evolution of the situation

In April we dispatched more hours than ever and another was new too, we had our first (virtual) contributors meeting on IRC! Logs and minutes are available and we plan to continue doing IRC meetings every other month.
Sadly one contributor decided to go inactive in April, Hugo Lefeuvre.
Finally, we like to remind you, that the end of Jessie LTS is coming in less than two months!
In case you missed it (or missed to act), please read this post about keeping Debian 8 Jessie alive for longer than 5 years. If you expect to have Debian 8 servers/devices running after June 30th 2020, and would like to have security updates for them, please get in touch with Freexian.

The security tracker currently lists 4 packages with a known CVE and the dla-needed.txt file has 25 packages needing an update.

Thanks to our sponsors

New sponsors are in bold.

No comment | Liked this article? Click here. | My blog is Flattr-enabled.

17:21

Pluralistic: 23 May 2020 [Pluralistic: Daily links from Cory Doctorow]


Today's links



Covid apps and false positives (permalink)

Covid apps don't do "contact tracing" – they do "exposure notification," a potentially useful (but unproven) adjunct to the labor-intensive, gold-standard "shoe leather" contact tracing.

https://pluralistic.net/2020/05/19/larval-pegasi/#shoe-leather

But both contact tracing and exposure notification are almost wholly dependent on public trust and confidence in the process. The privacy angle is easy to see here: if you think your app will expose your drug habit, extramarital affair, or other secret, you won't use it.

But reliability is just as important as confidentiality. Both contact tracing and exposure notification are only part of the puzzle: the mantra is "trace, test, contain." If you find out that you're at risk of infection, you need to get tested and then to act on the test.

That's a real problem, and not just because the reliable testing is still being perfected, but also because of the intractable laws of probability and uncertainty.

A test that is "90% accurate" might still only give a reliable answer 33% of the time, depending on the prevalence of the thing you're testing for. Don't blame me, blame Thomas Bayes.

https://pluralistic.net/2020/04/29/banjo-nazis/#uncertainty

Alas, both false positives and false negatives are the quickest way to drain public confidence in a process. Think of those "certificate error" dialogs you get from your browser. 99.99% of the time, they just mean that someone forgot to renew their certificate.

0.01% of the time, it's because your session has been hijacked by spies or criminals, and they get away with it, because we've all be trained to ignore those warnings (see also, e.g., Amber Alerts).

Likewise, burglars have long known that they can get their targets to switch off their alarms by repeatedly triggering the alarms and then running away.

https://pluralistic.net/2020/05/02/rewriting-our-imaginations/#exposure-notification

Writing in Wired, a trio of computer scientists – Elissa M Redmiles, Gabriel Kaptuck and Eszter Hargittai – recount a laundry list of technologies that struggled to gain credibility after a low-reliability launch, from the Roomba to Apple Maps.

https://www.wired.com/story/the-success-of-contact-tracing-doesnt-just-depend-on-privacy/

They move onto survey data that shows that Americans' adoption of apps (and, likely, their willingness to cooperate with contact tracers) will depend on their perception of both false positives and false negatives – of reliability.

https://www.microsoft.com/en-us/research/project/descriptive-ethics-for-covid19-apps/

Their concern seems to be that app designers are focusing on privacy protection to the exclusion of reliability (though trading one doesn't get you the other, obvs), and thus even if the privacy element is perfected, adoption may still suffer because of low reliability.



Casio censors calculator modder's Github project (permalink)

Neutrino (an "Electrical Engineer and a programming hobbyist") pulled off a virtuoso hacking stunt, modding a Casio calculator with an OLED screen and internet access, even a chat app, all designed to be undetectable to a casual observer.

https://www.youtube.com/watch?v=xGjS5958g1g

As Andrew Liszewski pointed out on Gizmodo, the mod would be a great cheating tool for the kinds of exams that allow calculators (but not phones, etc).

(though the mod is so intense that anyone who pulls it off should probably get an automatic A).

https://gizmodo.com/calculator-hacked-for-cheating-includes-a-secret-oled-s-1843314318

Perhaps that's why Casio's copyright enforcers, React, claimed that Neutrino had copied Casio's sourcecode, an act that allowed them to illegally censor the project's Github page using the DMCA's takedown mechanism.

https://github.com/Neutrino-1/Hack-Casio-Calculator

This appears to be a case of illegal copyfraud.

As Neutrino told Torrentfreak: "The code was written completely from scratch and all the libraries included in my source file were open-source."

https://torrentfreak.com/hacker-mods-old-calculator-to-access-the-internet-casio-files-dmca-complaint-200523/

"Everything was clearly mentioned in the [now removed] readme file of my GitHub repository. They also allegedly accuse me by stating that 'The entire repository is infringing', but in reality whatever the original content they pointed out has nothing to do with my code."

The DMCA provides for penalties against firms that make false copyright claims to effect improper takedowns. In practice, these penalties are rarely applied, which allows for this kind of fraud to take place with impunity.

However, the parties can't count on that. Back in 2018, after more than a decade of fighting, EFF forced Universal Music to pay out for its copyfraud in censoring a video of an adorable toddler dancing to a few seconds of a Prince song.

https://www.eff.org/deeplinks/2018/06/after-more-decade-litigation-dancing-baby-ready-move



Penguin poop turns into laughing gas (permalink)

In "Combined effects of glacial retreat and penguin activity on soil greenhouse gas fluxes on South Georgia, sub-Antarctica," an international team of King Penguin researchers solve the mystery of why they get goofy and buzzed when "nosing in guano."

https://www.sciencedirect.com/science/article/pii/S0048969719352477?via%3Dihub

Turns out that when the nitrogen-rich penguin poop is digested by Antarctic soil bacteria, one of the waste products is nitrous oxide (AKA laughing gas).

"After nosing about in guano for several hours, one goes completely cuckoo," lead author Bo Elberling noted in a statement. "It is truly intense."

https://arstechnica.com/science/2020/05/penguin-poop-creates-a-buttload-of-laughing-gas-researchers-find/

Here's a Sci Hub mirror of that paper:

https://sci-hub.tw/downloads/2019-11-18/868a/wang2019.pdf#view=FitH



This day in history (permalink)

#15yrsago Pat York: dear friend, writer, Boing Boing guestblogger, RIP https://boingboing.net/2005/05/23/pat-york-dear-friend.html

#15yrsago Dutch mayor wants to ban hacker con https://web.archive.org/web/20050525160551/https://www.whatthehack.org/news/index_html

#10yrsago Mark Twain's autobiography to be finally published, 100 years after his death https://www.independent.co.uk/arts-entertainment/books/news/after-keeping-us-waiting-for-a-century-mark-twain-will-finally-reveal-all-1980695.html

#10yrsago Mechanical irising peephole mechanism http://www.talkshopbot.com/forum/showthread.php?795-More-mechanical-wooden-silliness

#5yrsago Amazon will finally start paying tax in the UK https://www.theguardian.com/technology/2015/may/23/amazon-to-begin-paying-corporation-tax-on-uk-retail-sales

#5yrsago Hedge funds buy swathes of foreclosed subprimes, force up rents, float rent-bonds https://www.motherjones.com/politics/2014/02/blackstone-rental-homes-bundled-derivatives/

#1yrago The Oliver Twist workhouse is becoming a block of luxury flats with a "poor door" https://www.homesandproperty.co.uk/property-news/controversial-separate-entrance-planned-for-affordable-homes-at-oliver-twist-workhouse-luxury-flat-a112431.html

#1yrago The Reality Bubble: how humanity's collective blindspots render us incapable of seeing danger until it's too late (and what to do about it) https://boingboing.net/2019/05/23/blind-spots-vs-biology.html

#1yrago Study attributes mysterious rise in CFC emissions to eastern Chinese manufacturing https://www.bbc.com/news/science-environment-48353341

#1yrago Big Tech: "If the USA enforces antitrust laws against us, it means China will win!" https://www.wired.com/story/big-tech-breaking-will-only-help-china/

#1yrago Federal lawsuit calls college textbook/ebook packages a "scam" https://www.vice.com/en_us/article/pajze9/people-are-finally-fighting-back-against-the-college-textbook-industrys-scam

#1yrago To chase out low-waged workers, Mountain View is banning overnight RV and van parking https://www.bloomberg.com/news/features/2019-05-21/silicon-valley-s-shame-living-in-a-van-in-google-s-backyard



Colophon (permalink)

Currently writing: My next novel, "The Lost Cause," a post-GND novel about truth and reconciliation. Friday's progress: 543 words (18963 total).

Currently reading: Adventures of a Dwergish Girl, Daniel Pinkwater

Latest podcast: Someone Comes to Town, Someone Leaves Town (part 03) https://craphound.com/podcast/2020/05/18/someone-comes-to-town-someone-leaves-town-part-03/

Upcoming appearances: Discussion with Nnedi Okorafor, Torcon, June 14 https://www.torforgeblog.com/torcon-2020/

Upcoming books: "Poesy the Monster Slayer" (Jul 2020), a picture book about monsters, bedtime, gender, and kicking ass. Pre-order here: https://us.macmillan.com/books/9781626723627

"Attack Surface": The third Little Brother book, Oct 20, 2020. https://us.macmillan.com/books/9781250757531

"Little Brother/Homeland": A reissue omnibus edition with a new introduction by Edward Snowden: https://us.macmillan.com/books/9781250774583


This work licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commerically, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/web/accounts/303320

Twitter (mass-scale, unrestricted, third-party surveillance and advertising):

https://twitter.com/doctorow

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
When life gives you SARS, you make sarsaparilla -Joey "Accordion Guy" DeVilla

17:07

Today in GPF History for Saturday, May 23, 2020 [General Protection Fault: The Comic Strip]

Sharon's search for her biological mother leads her to the FBI's "most wanted" database and "twenty or more" suspicious aliases...

15:56

Link [Scripting News]

Horserace journalism has never seemed less relevant.

Link [Scripting News]

Opening churches could flush out the last of Trump's supporters who'd be ok if he shot someone on Fifth Avenue. The key assumption was that he was shooting someone else, not them. Maybe George Soros or Al Sharpton. I don't think they stick with him if shoots their neighbor from church.

Link [Scripting News]

Read this quote from the Republican governor of North Dakota about masks. A silver lining to the pandemic is the only way out of it is to cut the level of insanity to zero and start acting according to science. There is no other way out of it, assuming you don't want to bet exclusively on a miracle. Either we stay collectively insane, we'll all get the virus, sooner than later, and a shitload of us will die, and the survivors will have a new Dark Ages. If we could only apply the objective brainpower to this problem that we do to a sports game like football or basketball. There is a winning strategy but it requires teamwork.

Link [Scripting News]

I've heard reports of people having trouble unsubscribing from the nightly email. If you've been having trouble, please let me know by respoinding to the email.

15:07

Link [Scripting News]

When you hear someone you love and think is smart and literate say Oh it's no big deal if I catch the virus, say "I love you and you're smart and literate, and please read this story, because you're wrong about it not being a big deal." Perfect example of save my life story-telling.

Riding the State Unemployment Fraud ‘Wave’ [Krebs on Security]

When a reliable method of scamming money out of people, companies or governments becomes widely known, underground forums and chat networks tend to light up with activity as more fraudsters pile on to claim their share. And that’s exactly what appears to be going on right now as multiple U.S. states struggle to combat a tsunami of phony Pandemic Unemployment Assistance (PUA) claims. Meanwhile, a number of U.S. states are possibly making it easier for crooks by leaking their citizens’ personal data from the very websites the unemployment scammers are using to file bogus claims.

Last week, the U.S. Secret Service warned of “massive fraud” against state unemployment insurance programs, noting that false filings from a well-organized Nigerian crime ring could end up costing the states and federal government hundreds of millions of dollars in losses.

Since then, various online crime forums and Telegram chat channels focused on financial fraud have been littered with posts from people selling tutorials on how to siphon unemployment insurance funds from different states.

Denizens of a Telegram chat channel newly rededicated to stealing state unemployment funds discussing cashout methods.

Yes, for roughly $50 worth of bitcoin, you too can quickly jump on the unemployment fraud “wave” and learn how to swindle unemployment insurance money from different states. The channel pictured above and others just like it are selling different “methods” for defrauding the states, complete with instructions on how best to avoid getting your phony request flagged as suspicious.

Although, at the rate people in these channels are “flexing” — bragging about their fraudulent earnings with screenshots of recent multiple unemployment insurance payment deposits being made daily — it appears some states aren’t doing a whole lot of fraud-flagging.

A still shot from a video a fraudster posted to a Telegram channel overrun with people engaged in unemployment insurance fraud shows multiple $800+ payments in one day from Massachusetts’ Department of Unemployment Assistance (DUA).

A federal fraud investigator who’s helping to trace the source of these crimes and who spoke with KrebsOnSecurity on condition of anonymity said many states have few controls in place to spot patterns in fraudulent filings, such as multiple payments going to the same bank accounts, or filings made for different people from the same Internet address.

In too many cases, he said, the deposits are going into accounts where the beneficiary name does not match the name on the bank account. Worse still, the source said, many states have dramatically pared back the amount of information required to successfully request an unemployment filing.

“The ones we’re seeing worst hit are the states that aren’t asking where you worked,” the investigator said. “It used to be they’d have a whole list of questions about your previous employer, and you had to show you were trying to find work. But now because of the pandemic, there’s no such requirement. They’ve eliminated any controls they had at all, and now they’re just shoveling money out the door based on Social Security number, name, and a few other details that aren’t hard to find.”

CANARY IN THE GOLDMINE

Earlier this week, email security firm Agari detailed a fraud operation tied to a seasoned Nigerian cybercrime group it dubbed “Scattered Canary,” which has been busy of late bilking states and the federal government out of economic stimulus and unemployment payments. Agari said this group has been filing hundreds of successful claims, all effectively using the same email address.

“Scattered Canary uses Gmail ‘dot accounts’ to mass-create accounts on each target website,” Agari’s Patrick Peterson wrote. “Because Google ignores periods when interpreting Gmail addresses, Scattered Canary has been able to create dozens of accounts on state unemployment websites and the IRS website dedicated to processing CARES Act payments for non-tax filers (freefilefillableforms.com).”

Image: Agari.

Indeed, the very day the IRS unveiled its site for distributing CARES Act payments last month, KrebsOnSecurity warned that it was very likely to be abused by fraudsters to intercept stimulus payments from U.S. citizens, mainly because the only information required to submit a claim was name, date of birth, address and Social Security number.

Agari notes that since April 29, Scattered Canary has filed at least 174 fraudulent claims for unemployment with the state of Washington.

“Based on communications sent to Scattered Canary, these claims were eligible to receive up to $790 a week for a total of $20,540 over a maximum of 26 weeks,” Peterson wrote. “Additionally, the CARES Act includes $600 in Federal Pandemic Unemployment Compensation each week through July 31. This adds up to a maximum potential loss as a result of these fraudulent claims of $4.7 million.”

STATE WEB SITE WOES

A number of states have suffered security issues with the PUA websites that exposed personal details of citizens filing unemployment insurance claims. Perhaps the most galling example comes from Arkansas, whose site exposed the SSNs, bank account and routing numbers for some 30,000 applicants.

In that instance, The Arkansas Times alerted the state after hearing from a computer programmer who was filing for unemployment on the site and found he could see other applicants’ data simply by changing the site’s URL slightly. State officials reportedly ignored the programmer’s repeated attempts to get them to fix the issue, and when it was covered by the newspaper the state governor accused the person who found it of breaking the law.

Over the past week, several other states have discovered similar issues with their PUA application sites, including Colorado, Illinois, and Ohio.

11:56

Hacker Mods Old Calculator to Access the Internet, CASIO Files DMCA Complaint [TorrentFreak]

Hobbyist electronics hacker and YouTuber ‘Neutrino’ only has 10 videos on his channel but many are extremely popular.

Back in April he constructed his own interactive and contactless handwash dispenser to help people avoid the coronavirus and earlier this month published an absolute gem, transforming an old CASIO scientific calculator into something better.

After a not inconsiderable amount of work, Neutrino’s device was able to communicate with similar devices nearby and even connect to the Internet. Pretty impressive for a supposed amateur.

As standard, the CASIO calculator chosen for the project can be picked up on eBay for just a few dollars but other components are also required, as listed on Neutrino‘s YouTube channel. After desoldering the solar panel and various other steps, Neutrino managed to squeeze an OLED display into the space, along with a WiFi module and other goodies.

“Since we were in lockdown I wanted to do something really fun, which can keep me occupied for a week or two,” Neutrino informs TF.

“I did not have many components to work with so using this calculator (CASIO fx-ms991) was not a problem, because it was roughly 5+ years old and it was given by my uncle.”

Gizmodo published an article on the invention earlier this month, highlighting that it could potentially be used to cheat in exams. Neutrino says he doesn’t want that but does hope that the hack will inspire others to learn and participate in the ‘maker community’.

But now, just a couple of weeks after winning plenty of praise, the project has also attracted the attention of an anti-counterfeiting organization working for CASIO.

REACT describes itself as a not-for-profit organization with over 30 years experience in fighting counterfeit trade. “One of our main objectives is to keep the costs of anti-counterfeiting actions affordable,” its site reads. A wide range of high-profile companies are listed as members, from Apple to Yves Saint Laurent and dozens in between.

This week REACT wrote to Github, where Neutrino has his ‘Hack-Casio-Calculator‘ repository, with a demand that it should be completely taken down for infringing its client’s intellectual property rights.

“I am writing on behalf of CASIO, which is a member of REACT (also known as the Anti-Counterfeiting Network ). REACT actively fights the trade-in counterfeiting products on behalf of its members,” the complaint reads.

“It came to our attention that the below-mentioned repository is using copyrighted source code in order to modify Casio’s copyrighted program.

“The code the repository contains is proprietary and not to be publicly published. The hosted content is a direct, literal copy of our client’s work. I hereby summon you to take expeditious action: to remove or to disable access to the infringing content immediately, but in any case no later than ten days as of today.”

The full DMCA notice submitted to Github is available here and claims that the “entire repository is infringing” and that hosted content is a “direct, literal copy of [CASIO’s] work.

The repository has been disabled by Github in response to the complaint so validating the notice’s claims is not straightforward. That being said, Neutrino informs TF that the claim is nonsense and all work is his own.

“They accuse me of using copyrighted source code in order to modify CASIO’s copyrighted program. But my code has nothing to do with it,” he explains.

“The code was written completely from scratch and all the libraries included in my source file were open-source. Everything was clearly mentioned in the [now removed] readme file of my GitHub repository. They also allegedly accuse me by stating that ‘The entire repository is infringing’, but in reality whatever the original content they pointed out has nothing to do with my code.”

Neutrino informs us that he has already filed a DMCA counternotice with Github to get his project back. While he may yet be successful, this is just the type of action that has ‘freedom-to-tinker’ proponents throwing their hands up in despair wondering why big corporations have nothing better to do.

Unfortunately, these types of complaints can discourage people from being innovative or sharing their ideas and knowledge, the exact opposite of what Neutrino hoped to achieve. CASIO may somehow feel it’s in the right here but it does seem just a little bit petty.

From: TF, for the latest news on copyright battles, piracy and more.

A community of practice [Seth's Blog]

Learning happens mostly outside the classroom.

Learning is the difficult work of experiencing incompetence on our way to mastery.

And learning opens the door to identity.

When someone says, “I am a nurse”, they’ve taken their learning and certification, combined it with their livelihood and announced it as their identity.

And this all happens from community. The standards and practices, the support, the status roles. People like us do things like this.

If you’re a Maine wooden-boat builder, you do things a certain way. The ocean is the same water that a boat builder in Manila would put their boat on, but the boat is different because the community is different.

Even the way we think about formal education, accreditation and contribution is driven by the community of practice we are part of.

Communities have often been an accident of birth. Built by geography and parentage, you established your identity and your learning long before you went to school. Now, of course, this is changing.

Communities of practice have been written about for decades, but they’re being transformed and amplified by the persistent and permeable nature of the net. When we surround ourselves with a community, it’s inevitable that it changes our identity.

Too often, we choose our community by default. The social network sucks us in, or we’re picked for a certain dodgeball team or cadre at school. We have the chance, though, to do it with intention instead.

I’ve come to realize that the circles that we’re building at Akimbo are in fact communities of practice. A powerful, productive identity that people can choose to seek out. Click here to see a preview our next one–for people who are ready to write.

And here’s a bonus video, a short rant for the Akimbo podcast that I filmed last summer. In whichever hemisphere you’re in, enjoy the new season and the possibility it brings.

Our latest launches in a week or two. Find out more here.

07:42

Microplastic toxins climb up the food chain. [Richard Stallman's Political Notes]

Microplastics accumulate in sea sediment. In some areas, layers just under the surface can contain 2 million crumbs of plastic per square meter. Animals that crawl through the sediment to feed eat the microplastics, and the toxins climb up the food chain.

The fish humans eat may become dangerously toxic, or perhaps they already are.

Pandemic likely to boost the pace of automation. [Richard Stallman's Political Notes]

The pandemic is likely to boost the pace of automation, which could eliminate a substantial fraction of all today's jobs in a couple of years.

I don't understand how it could possibly work to buy clothing without trying it on. When I buy pants, I know which size I need — but not all the pants of that size fit me. Would I have to buy six pairs of pants, then return five of them or six of them? Would I have to buy six of them and give away those that don't fit me?

Urgent: Investigation of Pompeo [Richard Stallman's Political Notes]

US citizens: call on Congress to pick up where the ex-Inspector General's investigation of Pompeo left off.

The Capitol Switchboard numbers are 202-224-3121, 888-818-6641 and 888-355-3588.

If you call please spread the word!

02:42

macOS 10.15: slow by design [OSnews]

Apparently, Apple is making macOS Catalina phone home so much it’s making the operating system slow, laggy, and beachbally, as Allan Odgaard details.

Apple has introduced notarization, setting aside the inconvenience this brings to us developers, it also results in a degraded user experience, as the first time a user runs a new executable, Apple delays execution while waiting for a reply from their server. This check for me takes close to a second.

This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay!

Aside from the obviously terrible design and privacy implications of your computer phoning home to Apple every time you execute something, this is also another case of Apple only designing for the absolutely optimal use-cases – i.e., people working and living in Cupertino – and that’s it. The less optimal your internet connection or the farther away you are, the worse your experience will be.

Apple has a few file system locations that require user permission to access them, for example ~/Desktop, ~/Documents, and ~/Downloads.

Surprisingly though, just obtaining the display name or icon for one of these folders will trigger Apple’s code to verify that the client is allowed to access the location.

This is done by sending a message to the sandboxd process which sends a message to tccd which calls SecCodeCheckValidityWithErrors and seems to communicate with yet another process, but I can’t find which, and this takes around 150 ms per location.

It may not seem like much, but this adds up, and can add more than half a second of delay when opening an application.

Like with privileged folders, keychain items also require permission for applications to access them.

But again, something is wrong. Specifically calling SecKeychainFindGenericPassword can cause noticeable delays, on a bad internet day I had this call stall for 3.3 seconds and this was with System Integrity Protection disabled!

And on other delays in launching applications in general:

This is the worst issue, sometimes, things will stall for 5-30 seconds.

Mostly though it is when launching applications. Sampling the application during launch shows stalls in ImageLoaderMachO::loadCodeSignature, SLSMainConnectionID, and many references to Skylight and CGS in the stack trace.

The current best way to “address” this issue is disabling System Integrity Protection and disconnecting from the internet (!), and especially that second one is of course entirely unreasonable. I wouldn’t touch macOS with a ten-foot pole even before Catalina – it always felt slow and sluggish to me, even on faster Macs, and Mac hardware is terrible value right now – but with all the general complaints about Catalina, and now this, it’s getting ever clearer I’m not missing out on anything by sticking to Linux.

At least my computer isn’t calling home to Clement Lefebvre every time I run a tiny script.

Friday, 22 May

23:27

Microsoft’s new Fluid Office document is Google Docs on steroids [OSnews]

Microsoft is creating a new kind of Office document. Instead of Word, Excel, or PowerPoint, the company has created Lego blocks of Office content that live on the web. The tables, graphs, and lists that you typically find in Office documents are transforming into living, collaborative modules that exist outside of traditional documents.

Microsoft calls its Lego blocks Fluid components, and they can be edited in real time by anyone in any app. The idea is that you could create things like a table without having to switch to multiple apps to get it done, and the table will persist on the web like a Lego block, free for anyone to use and edit.

This is quite awesome, but I hope Microsoft won’t be tying functionality like this to its Chromium-based browsers, leaving others in the dust.

22:35

Friday Squid Blogging: Squid Can Edit Their Own Genomes [Schneier on Security]

This is new news:

Revealing yet another super-power in the skillful squid, scientists have discovered that squid massively edit their own genetic instructions not only within the nucleus of their neurons, but also within the axon -- the long, slender neural projections that transmit electrical impulses to other neurons. This is the first time that edits to genetic information have been observed outside of the nucleus of an animal cell.

[...]

The discovery provides another jolt to the central dogma of molecular biology, which states that genetic information is passed faithfully from DNA to messenger RNA to the synthesis of proteins. In 2015, Rosenthal and colleagues discovered that squid "edit" their messenger RNA instructions to an extraordinary degree -- orders of magnitude more than humans do -- allowing them to fine-tune the type of proteins that will be produced in the nervous system.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Read my blog posting guidelines here.

21:56

New Books and ARCs, 5/22/20 [Whatever]

As we begin the Memorial Day weekend, here’s a stack of the new books and ARCs that have come to the Scalzi Compound. Anything here that speaks to you as we head into the long weekend? Share in the comments!

21:49

US Copyright Office’s Proposed DMCA Fine-Tuning Could Be Bad News for Pirates [TorrentFreak]

In 2016, the U.S. Government launched a public consultation to evaluate the impact and effectiveness of the DMCA’s Safe Harbor provisions.

In response, the Copyright Office received a lot of input, including more than 92,000 comments. Various rightsholders weighed in, as expected, and so did technology companies, law scholars and civil rights groups.

This week, the Copyright Office released its long-awaited report (pdf), summarizing the public input, while offering several recommendations to lawmakers on how to move forward.

The overall conclusion is that there’s a clear discrepancy between how copyright holders and online services view the DMCA. Online service providers (OSPs) are quite pleased with it, while rightsholders see it as outdated and ineffective.

This imbalance comes as no surprise. However, the task of the Copyright Office is to find a way forward. To that end, the report provides some guidance to ‘fine-tune’ a variety of issues but doesn’t propose any broad changes.

“The Office is not recommending any wholesale changes to section 512, instead electing to point out where Congress may wish to fine-tune section 512’s current operation in order to better balance the rights and responsibilities of OSPs and rightsholders in the creative industries.”

This fine-tuning also applies to the ‘repeat infringer’ issue, which has become a hot topic in recent years. Repeat infringers are at the center of several lawsuits between copyright holders and ISPs, which most recently resulted in a billion-dollar damages award against Cox.

The Copyright Office recognizes that there is quite a lot of uncertainty in this area. One problem is the lack of transparency, as ISPs are not required to have a published, or even written repeat infringer policy.

A repeat infringer policy that exists merely in someone’s head is good enough at the moment. This is not ideal, and Congress could address this.

“Given the broad scope of the safe harbors, having a clear, documented, and publicly available repeat infringer policy seems like the appropriate minimum requirement in order to comply with the statute, as well as to act as a deterrent to infringement,” the Office notes.

In addition, it also recommends Congress to provide more clarity on when a user’s account should be terminated. There is currently no clarity on when ISPs should take action and if that requires a takedown notice from a copyright holder.

Another very relevant topic addressed in the report highlights the current restrictions on DMCA subpoenas. At the moment, these suboenas are regularly used to request details of website owners from third-party intermediaries such as Cloudflare or domain name registrars.

These subpoenas are cheap and quick, as they are signed off by a court clerk and don’t require any oversight from a judge. However, they come with restrictions as well, as courts previously concluded that they can’t be used to identify pirating subscribers.

The Copyright Office wonders whether this should change. In mentions that, at the moment, the tool is rarely used, also because the current interpretation doesn’t allow it to be used against regular ISPs to identify pirating subscribers.

“This provision has proven to be little-used by rightsholders, in part because of how restrictively courts have interpreted it and in part because the information gleaned from such subpoenas is often of little use,” the Office notes.

The report recommends Congress to clarify the language of this section. While it understands that some companies might abuse a broader interpretation to extract settlements from file-sharers (i.e. copyright trolls), that shouldn’t hold back lawmakers from considering it.

[“T]he Office does not countenance stripping rightsholders from any realistic ability to enforce their rights, even if doing so may prevent some bad actors from abusing the primary mechanism by which rightsholders may vindicate those rights,” it notes.

The Copyright Office says that it favors “a legislative fix” to address ambiguity in this section of the DMCA to clarify whether this applies to regular ISPs, or not. At the same time, however, the “litigation tactics” of “certain companies” deserve a proper discussion.

“To properly address these concerns, however, the conversation should focus on the actual tactics at issue, rather than using section 512(h) as a proxy to wage those battles,” the report reads.

This is an important recommendation, as making DMCA subpoenas available to identify pirating subscribers will change piracy enforcement drastically. The RIAA tried to use this method over a decade ago and failed. However, if the DMCA language is changed, rightsholders could go after hundreds of thousands of pirates at minimal cost and without judicial oversight.

The report runs to nearly 200 pages and it’s impossible to summarize it all. What is worth mentioning, however, is that the Copyright Office is not sold on two of the top demands from copyright holders. Those are, a ‘notice and staydown’ requirement and ‘site blocking.’

The Copyright Office understands that rightsholders would like a requirement to prevent pirated content from being uploaded, as is also required in the EU by Article 17 of the new Copyright Directive. However, it’s not yet convinced that this is right for the US.

First of all, it would require a “fundamental shift of intermediary liability” in the country. In addition, it is not clear what effect a filtering requirement would have on speech and competition. Those issues would need more research for Congress to consider it at all.

“[I]t is the opinion of the Office that a general staydown requirement and/or mandatory OSP filtering should be adopted, if at all, only after significant additional study, including of the non-copyright implications they would raise,” the report reads.

The same is true for pirate site blocking. While there is some evidence on the effectiveness and implications in other countries, this is not always consistent, and more research is needed.

“While some of these studies report statistically significant reductions in piracy, other studies have shown smaller or no reductions,” the Copyright Office writes.

“Thus, it is difficult to weigh the benefit of such orders against the potential speech impacts, arguing in favor of additional, dedicated study before adopting such a proposal.”

Overall, the report includes some positive and some negative elements for both sides. This was unavoidable, as rightsholders and online service providers have opposing views on how the DMCA safe harbors should function.

The Copyright Office believes that more balance can be achieved by file-tuning the current language. While this sounds mild, the implications for the repeat infringer and DMCA subpoenas could be far-reaching.

That said, the report just provides recommendations. Whether these will be turned into amendments and new legal requirements is up to Congress.

From: TF, for the latest news on copyright battles, piracy and more.

21:07

[$] Imbalance detection and fairness in the CPU scheduler [LWN.net]

The kernel's CPU scheduler is good at distributing tasks across a multiprocessor system, but does it do so fairly? If some tasks get a lot more CPU time than others, the result is likely to be unhappy users. Vincent Guittot ran a session at the 2020 Power Management and Scheduling in the Linux Kernel summit (OSPM) looking into this issue, with a focus on detecting load imbalances between CPUs and what to do with a workload that cannot be balanced.

20:56

Page 13 [Flipside]

Page 13 is done.

News Post: S-Tier [Penny Arcade]

Tycho: Now, more than ever, extroverts need our help. Social interactions have never come especially easily to me. I've always had the sense that I was separated from people by some invisible field that selectively apportioned the band of interpersonal data, truncated it, crushed the waveform down so far that I was always missing something fundamental. I don't like talking about it, because it only emphasizes this gulf. I feel observed, now, just typing about it; it's like an itch. I run a human-compatible persona in a Virtual Machine to interface with society because it is required.…

18:35

Link [Scripting News]

I have a Subaru Forester. Nice car. But every so often the rear door refuses to open. Three beeps. So I search, have trouble finding an answer. So confusing, they talk about buttons my car doesn't seem to have. Anyway it turns out if you hold the touch point for six seconds it'll open the rear door. Software glitch of some kind. From then on it works as normal. Wonder what the logic is. If it has the means to reset itself why doesn't it just reset itself without me having to jump through hoops?

18:21

No Covid-19 support for tax-dodgers [Richard Stallman's Political Notes]

*Scotland bans Covid-19 support to firms based in tax havens.*

If your government fails to take this obvious step, that shows it is controlled by tax-dodging rich parasites.

Second wave [Richard Stallman's Political Notes]

Science advisors of the Obama administration say the US will face a second wave of Covid-19 around September, and must stockpile medical equipment for it.

It is lunacy to have wasted the first stay-at-home period without building up the capacity to follow it with test, trace and isolate. The bullshitter appears to have made this choice this intentionally.

Low herd immunity [Richard Stallman's Political Notes]

Despite Sweden's high Covid-19 death rate, a survey in Stockholm found that it has gone only 10% of the way to herd immunity (7% have antibodies).

Reaching herd immunity without a vaccine entails lots of deaths.

Hiding their pay [Richard Stallman's Political Notes]

Rich people hide their pay as capital gains to pay less taxes. They mostly do not give much to charity, and they have not lost much in the stock market's decline.

Contact-tracing for medical workers [Richard Stallman's Political Notes]

The big obstacle to contact-tracing in the UK is that the contacts of infected medical workers and nursing home workers are mostly other medical workers and nursing home workers — and if they all self-isolate for a week or two as a precaution, the system will fail immediately.

The first step in fixing this is obvious — give them all sufficient protective equipment — but the UK hasn't got its act together to do that.

FDA on hydroxychloroquine [Richard Stallman's Political Notes]

*FDA appears to soften stance on hydroxychloroquine* after the numskull announced he was taking it.

This suggests that he is attacking the independence of its regulation of drugs.

As a separate matter, the FDA has been undermining inspection of production medicines since Obama's day. Obama could do some good things, but only when business wasn't interested.

Entitled governor [Richard Stallman's Political Notes]

Georgia Governor Kemp cancelled a special election for the state supreme court. The Republican-dominated state supreme court ruled that he was entitled to appoint a Republican judge instead of holding an election.

Kemp was previously the state official in charge of elections, which gave him the opportunity to rig the election for governor so he would "win."

Much larger depression [Richard Stallman's Political Notes]

Economists warn that if the US government refuses to bail out state governments for the costs of dealing with Covid-19, it will push the US into a much larger depression.

Either the conman or Republican senators (I don't recall which) have talked about doing this.

Removing another inspector general [Richard Stallman's Political Notes]

The corrupter removed another inspector general, this one for the Department of Transportation.

That IG was investigating Ellen Chao, the head of that department, for favoritism in favor of the business interests of her husband, Senator McConnell.

17:14

Today in GPF History for Friday, May 22, 2020 [General Protection Fault: The Comic Strip]

"Should I really be hearing about the future?" "If you value your friends and all they stand for, absolutely."

17:00

Link [Scripting News]

New version of publicFolder, a Node app that runs on your desktop and keeps an Amazon S3 location in sync with a folder on a local disk. It's available as an NPM package and an Electron app. I use it to publish this.how, and am starting to use it in place of Dropbox. Much lighter weight, and I have all the source (and so do you).

16:35

Pluralistic: 22 May 2020 [Pluralistic: Daily links from Cory Doctorow]


Today's links



Oh Joy Sex Toy's new teen sex-ed book (permalink)

Oh Joy Sex Toy is Erika Moen and Matthew Nolan's superb webcomic that started as a sex-toy review site but has branched out to cover every element of human sexuality and sexual health with comedy, pathos, and wisdom.

https://www.ohjoysextoy.com

After kickstarting a string of outstanding collections, they branched into sex-ed books for young readers. The first volume was "Drawn to Sex," a book so good I DIDN'T give it to my daughter (which would have guaranteed that she wouldn't read it).

https://www.kickstarter.com/projects/erikamoen/drawn-to-sex-the-basics

(Instead, I left it where I knew she'd find it on her own!)

Now – great news! – there's a second volume in the works, called "Our Bodies and Health," which deals with "the science-y, biology-y side of things" and is up for preorder:

https://www.ohjoysextoy.com/pre-order-drawn-to-sex-our-bodies-and-health/

Subjects covered: "genital construction to pregnancy to abortion to STIs to the various ways your reproductive organs can go haywire and what you can do to deal with it." These are comics "designed to help the reader learn about difficult topics without shame or judgement."

Here's that Kickstarter. The book is $8 for a PDF, $20 for a hardcopy, and $36 for a bundle with volume 1 – delivery is Nov, in time for Xmas!

https://www.kickstarter.com/projects/erikamoen/drawn-to-sex-our-bodies-and-health

I ordered one!



Torcon: Gaiman, Okorafor, Kowal, Schwab (permalink)

I have literally lost count of the number of sf cons I was supposed to attend that have cancelled, but there's one NEW con that I've signed up for that I'm SO STOKED about: Torcon, the sf con from Tor Books, which runs online Jun 11-14.

https://www.torforgeblog.com/torcon-2020/

What.

A.

Lineup.

Neil Gaiman. VE Schwab. Brandon Sanderson. Nnedi Okorafor. Christopher Paolini.

Me!

I'm speaking with Nnedi Okorafor on 6/14 at 19h Eastern/16h Pacific!

There are online screenings, brunch with Mary Robinette Kowal, a live storytelling session with an all-star lineup, panels… It's all in collaboration with @denofgeek, featuring some of their best-loved hosts…

The pandemic sucks. Missing cons sucks. This will NOT suck.



Copyright bots are slaughtering classical musicians' performances (permalink)

During the pandemic, classical musicians and orchestras are reliant on streaming their performances to maintain their profile and solicit donations. That's a problem, because the platforms' copyright bots hate classical music.

https://www.washingtonpost.com/entertainment/music/copyright-bots-and-classical-musicians-are-fighting-online-the-bots-are-winning/2020/05/20/a11e349c-98ae-11ea-89fd-28fb313d1886_story.html

Once a record label like Sony Music or Naxos claims a performance that they have released, the bots scour the services for anything that sounds even remotely like that performance and either deletes it, mutes it, or steals the money it generates.

And on the platforms, users are considered guilty until proven innocent. An automated takedown is virtually instantaneous, while a human review that reverses it can take twenty-eight months.

https://pluralistic.net/2020/05/17/cheap-truthers/#robot-sez-no

The fascinating thing about this is that it is entirely predictable. It's a known failure mode for filters. Either you narrow the matching so that they only catch precise matches (in which case they are easy to trick by making trivial changes); or you broaden the matching, in which case they take down innocent musicians' own performances.

The fact that they've chosen the latter tells you that this is not "copyright protection," because the musicians whose performances are removed are also copyright holders.

Indeed, the majority of classical music copyright holders are not large companies like Naxos or Sony – they're the musicians whose performances Sony and Naxos have removed.

These filters are not for copyright protection: they're for corporate protection.

What do Naxos and Sony say? Duncan Hammons from Naxos blames the filters: "We're at the mercy of automation in order to uphold our obligations to our clients."

Translation: Naxos chose not to manually review the filters' results, rather, they run the system on full autopilot, and anyone who gets censored in the process is an unavoidable consequence of Naxos's decision.

He doesn't raise the possibility of making a different decision.

Instead, he proposes that Naxos can be in charge of who is allowed to make classical music even if they don't have a relationship with Naxos: "[arrangements can be made for channel owners to prove] the legitimacy of their status as a performing arts entity."

In March 2019, the EU passed its new Copyright Directive, whose Article 13 (now Article 17) mandates copyright filters like Facebook's for all platforms.

At the time, critics like me argued that this would allow giant entertainment corporations to decide when and whether an indie musician could perform online.

After all, these companies don't fear being trapped in the filternet: they have direct lines to the online appeals court. It's only the indie musicians who have to get in the queue to have the robot's judgment reviewed by a human, who might take 28 months to get to it.

And of course, now that every online platform has to find the money to build these filters – Youtube's Contentid, which only does a tiny fraction of the filtering required, cost $100m – only the biggest tech players will remain.

So here we are, headed for a future in which only giant tech platforms are allowed to operate, and where giant media companies are given a veto over who can make art on those platforms.

This is not a good situation for artists. Even if you want to sign to Sony or another label, the fact that Sony (and the other two giant labels) are the only game in town means that they will squeeze their talent, giving them less of the money their art generates.

Once, online platforms constituted an escape valve on this pressure-cooker, an alternative to the abusive label system. Now it is captured by them.

"The creatures outside looked from pig to man, and from man to pig, and from pig to man again; but already it was impossible to say which was which."

(Image: Cryteria, CC BY, modified)



Coronavirus has made the super-rich MUCH richer (permalink)

In "Tale of Two Crises: Billionaires Gain as Workers Feel Pandemic Pain," a new report from Americans for Tax Fairness and the Insitute for Policy Studies, we learn that America's billionaires have added $434B to their fortunes during the crisis.

https://ips-dc.org/us-billionaire-wealth-surges-434-billion-as-unemployment-filers-top-38-million/

America's 5 richest billionaires – Jeff Bezos, Bill Gates, Mark Zuckerberg, Warren Buffett and Larry Ellison – grew their fortunes by $40B.

Bezos alone made $35B. He is canceling the $2/hour "hazard pay" for Amazon warehouse workers effective Jun 1.

https://www.commondreams.org/news/2020/05/21/underscoring-grotesque-nature-unequal-sacrifice-richest-americans-have-added-434

36 million Americans have filed for unemployment in the same period.

https://www.nytimes.com/2020/05/14/business/economy/coronavirus-unemployment-claims.html



How to start a platform co-op (permalink)

The problem with the gig economy isn't that it makes it easy for workers, customers and businesses to find each other: it's that the platforms are parasitic grifts who ruin everyone, lose money, and get flogged off to suckers during the IPO.

https://pluralistic.net/2020/05/18/code-is-speech/#schadenpizza

There's a better way: "platform co-operativism," in which workers clone the apps – a trivial task – and then turn them into nonpredatory, worker-owned businesses that support the real economy instead of annihilating it to enrich Saudi oil families.

https://pluralistic.net/2020/05/18/code-is-speech/#platform-cooperatvism

The biggest co-op success story is Spain's Mondragon Co-Op. They've teamed up with NYU's New School (which has a major platform co-op project) and the Institute for the Cooperative Digital Economy to offer courses in platform co-op entrepreneurship.

https://platform.coop/blog/a-pcc-mondragon-course-helps-to-incubate-platform-co-ops/

It runs Jun 1-Jul 24.

"In moments of crisis like this, things that had been considered impossible can become common sense: The Great Depression gave rise to the original New Deal. We need to show possibilities for how the world could be better."



Mum uses GDPR to force Gran to take down pics (permalink)

A Dutch court has sided with a woman who sued her mother to force her to remove pictures of her grandchildren from social media, finding that the images violated the GDPR.

https://www.bbc.com/news/technology-52758787

The mum said that she had repeatedly asked the grandmother to remove the pictures. The court found that the "purely personal" exception to the GDPR does not apply when large commercial platforms like Facebook and Pintrest are involved.

If the grandmother doesn't remove the photos, she'll be fined €50/day to a max of €1000. If she posts more images in the future, these, too, will incur €50/day fines.

I'm not sure how I feel about this, to be honest. I do think that kids (and therefore, by extension, their guardians) should have autonomy over their personal info, and also that the polite thing to do when asked by your daughter to remove her kids' photos is to comply.

But the GDPR is a gnarly hairball of law that's hard to understand, even for experts. I'm all for having complex, purpose-suited rules for complex industries, but I'm sceptical that they will carry over well to resolving disputes between private individuals.

Certainly, this feels like a scorched-earth approach that would likely create a permanent rift between Gran and Mum.



Physical BLINK tag (permalink)

My favorite terrible outcome of the browser wars is the BLINK tag, which Netscape introduced as a nonstandard HTML extension in a bid to tempt web authors to optimize their sites for Netscape instead of Microsoft's Internet Explorer.

https://en.wikipedia.org/wiki/Blink_element

The tag lingered long after the browser wars ended. I went through a period around 2013 where I used it (and its many variations, like the "marquee" argument a lot). Eventually (and not coincidentally, I believe), Firefox nuked it.

https://www.mozilla.org/en-US/firefox/23.0/releasenotes/

So I was delighted to wake up this morning and discover that @edent is making good use of quarantine time to commission a lenticular BLINK tag sticker from a Chinese manufacturer.

https://shkspr.mobi/blog/2020/05/building-a-physical-blink-tag/

You can order your own! It's £100 for 100, with a 10% discount at this link:

http://i.refs.cc/jSbp0NlI?smile_ref=eyJzbWlsZV9zb3VyY2UiOiJzbWlsZV91aSIsInNtaWxlX21lZGl1bSI6IiIsInNtaWxlX2NhbXBhaWduIjoicmVmZXJyYWxfcHJvZ3JhbSIsInNtaWxlX2N1c3RvbWVyX2lkIjpudWxsfQ%3D%3D

(which also pays a commission to Eden).



This day in history (permalink)

#15yrago Official French translation for "weblog" https://web.archive.org/web/20051123210140/http://www.loiclemeur.com/english/2005/05/want_to_say_web.html

#10yrsago Infoladies of Bangladesh revolutionize rural life https://www.theguardian.com/journalismcompetition/professional-two-wheel-triumph

#5yrsago The Man Who Sold The Moon https://boingboing.net/2015/05/22/the-man-who-sold-the-moon.html

#1yrago A self-appointed wing of the American judicial system is about to make it much harder to fight terms of service https://www.vice.com/en_us/article/a3x79a/new-proposal-would-let-companies-further-screw-you-over-with-terms-of-service

#1yrago Exploitation of workers becomes more socially acceptable if the workers are perceived as "passionate" about their jobs https://pubmed.ncbi.nlm.nih.gov/30998042/

#1yrago The "Uber of Live Music" will charge you $1100-1600 to book a house show, pay musicians $100 https://www.jwz.org/blog/2019/05/the-uber-of-live-music/

#1yrago In less than one second, a malicious web-page can uniquely fingerprint an Iphone, Pixel 2 or Pixel 3 without any explicit user interaction https://www.ieee-security.org/TC/SP2019/papers/405.pdf

#1yrago Americans believe that they should own the mountains of data produced by their cars, but they don't https://www.nytimes.com/2019/05/20/opinion/car-repair-data-privacy.html



Colophon (permalink)

Today's top sources: Timothy Haas, Naked Capitalism (https://nakedcapitalism.com/), JWZ (https://www.jwz.org/blog/), Slashdot (https://slashdot.org/), Trebor Schulz.

Currently writing: My next novel, "The Lost Cause," a post-GND novel about truth and reconciliation. Yesterday's progress: 500 words (18420 total).

Currently reading: The Case for a Job Guarantee, Pavlina Tcherneva

Latest podcast: Someone Comes to Town, Someone Leaves Town (part 03) https://craphound.com/podcast/2020/05/18/someone-comes-to-town-someone-leaves-town-part-03/

Upcoming appearances:

Upcoming books: "Poesy the Monster Slayer" (Jul 2020), a picture book about monsters, bedtime, gender, and kicking ass. Pre-order here: https://us.macmillan.com/books/9781626723627

"Attack Surface": The third Little Brother book, Oct 20, 2020. https://us.macmillan.com/books/9781250757531

"Little Brother/Homeland": A reissue omnibus edition with a new introduction by Edward Snowden: https://us.macmillan.com/books/9781250774583


This work licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commerically, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/web/accounts/303320

Twitter (mass-scale, unrestricted, third-party surveillance and advertising):

https://twitter.com/doctorow

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
When life gives you SARS, you make sarsaparilla -Joey "Accordion Guy" DeVilla

15:42

The Big Idea: Nancy Kress [Whatever]

In today’s Big Idea, Hugo and Nebula Award winner Nancy Kress takes a look at controversy, science, and change — Sea Change, as a matter of fact.

NANCY KRESS: 

At parties in my city—environmentally conscious, crunchy-granola, high-tech and socially activist Seattle—it is easy to start a flaming argument. Just walk up to a group, tilt your head, and say inquiringly, “What do you think of GMOs?” Then stand back to avoid being scorched.

Genetically modified organisms have passionate denouncers and equally passionate supporters. This is especially true for GMO crops, since the genemod bacteria and animals are usually hidden away in labs, ranches, or manufacturing facilities. But there is GMO food right out front on your table, plated in front of your kids. Everybody has an opinion.

Including me.

But I didn’t want my new novella from Tachyon, Sea Change, to be a polemic for one side of the controversy. I wanted to explore in a balanced way both sides of the myriad questions involved.  In this corner of the boxing ring: GMOs aren’t natural! We don’t know what they do to the human body long-term! GMO crops will contaminate wild flora and/or kill animals, possibly including us!  There are studies! Look at the science!

And in the opposite corner: Neither is most of medical science “natural” to the human body, from Tylenol to heart transplants! There are decades of research already! Not one person has ever died from a GMO! If we don’t engineer crops, climate change and a growing world population will starve billions of people! Those studies have been invalidated! Look at the science!

The pugilistic metaphor is a deliberate choice. It isn’t only in Seattle that “GMO” is a fighting word, and with reason. There is a lot at stake: money, scientific reputations, food security, perhaps the future of the planet. The politics of genetic engineering, of agribusiness, of food regulation are all more complicated than they first appear. Both sides have waged wars of disinformation. Sometimes the war of words has spilled over into actual violence, with test farms attacked and crops destroyed, or Monsanto employees bodily threatened.

I am not a scientist. I think I would make a very bad scientist: not detail-oriented enough, or patient enough, or logical enough. Science fascinates me (forget rock stars and movie actors—I’ve always been a science groupie, sometimes embarrassingly so). But what I find really compelling are people. Why does a given person believe, act, love as they do? This is fortunate, because a writer cannot make a story solely out of controversial arguments. The science needs to happen to characters.

Sea Change happens to Renata Black. As I age, my protagonists get older (eventually I expect to be writing about octogenarians), partly because I get tired of brash, young, badass heroines. So Renata is a middle-aged woman in a near-future Seattle. Her life is not going as expected. She is a mother, a wife in a difficult marriage, an activist in a secret organization. An idealist, but one who recognizes that realizing ideals happens slowly, with effort, imperfectly, and sometimes at great personal cost.

Sea Change also happens to Jake, Renata’s actor husband. To their chess-loving son, Ian. To thirteen-year-old Lisa, a member of the Quinalt Nation. To Kyle, an ex-NFL wide receiver turned teen counselor, who has the unenviable task of trying to hold together a revolutionary cell of talented, utopian-minded misfits.

Finally, the novella is about other things as well as GMOs. Ocean blobs. Legal jurisdiction fights. Love and loss (if I hadn’t thought of it too late, I would have called my story Sea Change: A Love Story). The Quinalt Peninsula northwest of Seattle, which contains the world’s only temperate rainforest: wild, coastal, and beautiful.

A section of the Peninsula belongs to a Native American tribe, the Quinalt Nation, and so they, too, are part of my story.  For this, I had the help of a Native American sensitivity reader. The Quinalt, who have occupied their land for 1,000 years, depend heavily on salmon fishing, which is threatened by modern agricultural run-off, in addition to the host of other threats the outside world poses to Native American cultures.

Sea Change spans twenty-eight years. It begins in 2005, the year that Switzerland banned genetically modified foods and the United States added sugar beets to the GMO foods available to consumers, which already included summer squash, soybeans, papayas, and tomatoes. Renata is in college. When the novella ends, she and the world are both very different. But the battles over science go on.

And, as I read the news each day, it seems that they always will.

—-

Sea Change: Amazon|Barnes & Noble|Indiebound|Powell’s

Visit the author’s site.

15:28

On the various ways of constructing a C++/WinRT com_array [The Old New Thing]

The C++/WinRT com_array<T> represents a C-style conformant array of data where the underlying buffer is allocated via the COM task allocator. It is typically used to represent a C-style conformant array which is allocated by one component and freed by another.

You will probably need to make one of these things when you are returning a projected array to the caller, either as the return value or through an output parameter. Here are your choices of constructor, with names that I made up.

com_array(); (1)
com_array(uint32_t count); (2)
com_array(uint32_t count, T const& value); (3)
template<typename InIt>
com_array(InIt first, InIt last)
(4)
com_array(std::vector<T> const& value) (5)
template<size_t N>
com_array(std::array<T, N> const& value)
(6)
template<size_t N>
com_array(T const(&value)[N])
(7)
com_array(std::initializer_list<T> value) (8)
com_array(void* ptr, uint32_t count,
  take_ownership_from_abi_t);
(9)
com_array(com_array&& other) (10)

1) Default constructor: Creates an empty buffer.

2) Capacity constructor (default value): Creates a buffer of count elements, all containing copies of a default-constructed T.

3) Capacity constructor (explicit value): Creates a buffer of count elements, each of which is a copy of the provided value.

4) Range constructor: Creates a buffer that is a copy of the range [first, last).

5) Vector constructor: Creates a buffer that is a copy of the contents of the vector.

6) Array constructor: Creates a buffer that is a copy of the contents of the array.

7) C-style array constructor: Creates a buffer that is a copy of the contents of the C-style array.

8) Initializer-list constructor: Creates a buffer that is a copy of the contents of the initializer list.

9) ABI constructor: Takes ownership of a buffer of specified length.

10) Move constructor: Moves the resources from another com_array of the same type, leaving the original empty.

Remarks for capacity constructor with default value (2)

Constructor (2) is almost but not quite the same as creating a buffer of count elements each of which is a default-constructed T. Consider:

auto players = com_array<MediaPlayer>(50);

The MediaPlayer object’s default constructor creates a reference to a new media player object, and its copy constructor copies the reference. Therefore, the above line of code creates an array of 50 references to the same media player object, not an array of 50 different media player objects.

Bonus weirdness: If you pass a count of zero, the com_array will still default-contruct a T, even though it doesn’t use it for anything.

Remarks for capacity constructor with explicit value (3)

com_array(2, 42) is interpreted as an attempt to use the range constructor (4), which fails because 2 and 42 are not iterators. To get this to be interpreted as a capacity constructor with explicit int32_t value, use an explicitly unsigned integer as the first parameter: com_array(2u, 42).

Remarks for range constructor (4)

Sadly, there is (as of this writing)¹ no deduction guide for the range constructor (4), so you will have to state the underlying type T explicitly:

auto a = com_array<T>(source.begin(), source.end());

Bonus trick: If you want to move the range rather than copy it, use the std::move_iterator iterator adaptor:

auto a = com_array<T>(std::move_iterator(source.begin()),
                      std::move_iterator(source.end()));

Remarks for vector (5), array (6), and C-style array (7) constructors

For constructors (5) through (7), the contents of the container are copied. You can use the range constructor (4) with the move_iterator iterator adaptor to move the contents into the com_array instead of copying.

Remarks for ABI constructor (9)

The ABI constructor (9) is the lowest-level constructor. Use it when you have a block of memory already allocated via Co­Task­Mem­Alloc and you want the com_array to assume responsibility for it. To emphasize the special requirements for this constructor, the final parameter must be take_ownership_from_abi.

¹ Hint hint. Add a deduction guide and create a PR. While you’re at it, fix the range constructor so it doesn’t inadvertently trigger for com_array(2, 42).

The post On the various ways of constructing a C++/WinRT <CODE>com_array</CODE> appeared first on The Old New Thing.

15:07

[$] The deadline scheduler and CPU idle states [LWN.net]

As Rafael Wysocki conceded at the beginning of a session at the 2020 Power Management and Scheduling in the Linux Kernel summit (OSPM), the combination of the deadline scheduling class with CPU idle states might seem a little strange. Deadline scheduling is used in realtime settings, where introducing latency by idling the CPU tends to be frowned upon. But there are reasons to think that these two technologies might just be made to work together.

Security updates for Friday [LWN.net]

Security updates have been issued by CentOS (firefox, ipmitool, kernel, squid, and thunderbird), Debian (pdns-recursor), Fedora (php and ruby), Red Hat (dotnet and dotnet3.1), SUSE (dom4j, dovecot23, memcached, and tomcat), and Ubuntu (clamav, libvirt, and qemu).

14:42

Link [Scripting News]

On Maddow last night an interesting observation as to why meat packing plants are even worse than we thought. Recall that enclosed spaces with lots of humans present for long periods of time are bad. The virus has plenty of time to become dense, which it needs to be infectious. But meat packing plants are also loud, lots of machinery, so people have to yell to be heard. And when an infected person yells they emit more virus, contributing to greater density, therefore more transmission.

Virus in summertime? [Scripting News]

My longtime friend Matt Ocko says it's hot in Brazil and they have a lot of virus there, so the virus must do okay in heat, so therefore no reprieve during the summer in the US.

I don't know whether the virus does better or worse in summer months, but saying it's doing fine in Brazil doesn't add much data about how it will do in the US in the summer.

Maybe the virus doesn't care about the heat, but humans behave differently when it's warm. We spend more time outdoors, and the virus isn't as infectious outdoors, because it's the virus load that determines how infectious it is. At least that's what we currently think.

Human bodies are generally in better shape in the summer. That might make us better able to fight the virus.

Brazil is a different place from the US and is responding socially to the virus differently, so it's hard to conclude anything about what happens in the US based on what happens in Brazil.

And of course the US is a very varied country, so what happens in NYC is different from what happens in Calif, is different from other parts of New York State for that matter.

12:28

Four short links: 22 May 2020 [Radar]

  1. COVID-19 Contact Tracing Data Standard — Possibly the fastest-created government standards. New Zealand’s aiming to have all the contact tracing apps support the actions of the contact tracers, and standards are a part of that.
  2. Why No One Uses Functional LanguagesCompared to users of C, “no one” is a tolerably accurate count of the users of functional languages. 1998 paper by Phil Wadler.
  3. Quantum Computing Lecture Notes 2.0 — Scott Aaronson’s 260-page introductory quantum computing textbook in beta form, covering similar material as many other introductory quantum computing textbooks, but in my style for those who like that.
  4. Deno: A Simple Guide — A nice surface introduction to how Deno differs from Node.js, and the rationale for those differences. A quick read, but it really gives you a sense of Deno. This is great.

12:14

Error'd: Rest in &;$(%{>]$73!47;£*#’v\ [The Daily WTF]

"Should you find yourself at a loss for words at the loss of a loved one, there are other 'words' you can try," Steve M. writes.   "Cool! I can still use the premium features...

Waiting and worrying [Seth's Blog]

It’s easy for us to choose to worry. The world is upside down, the slog continues, a tragedy unevenly but widely distributed.

Worry takes a lot of effort. And worry, unlike focus, learning or action, accomplishes nothing of value.

And, at the same time, due to the time-horizon of the pandemic, it’s also tempting for us to simply wait. To wait for things to get back to normal. But all the time we’re spending waiting (for a normal that is unlikely to be just like it was) is time we’re not spending learning, leading and connecting.

Waiting is, sort of by definition, a waste of time. But time is scarce, so wasting it is a shameful act.

If we decided to simply reduce our waiting and worrying allocation by 50%, just imagine how much we could discover, how many skills we could learn, how dramatically attitudes could shift.

We can still wait (even though time will pass either way). And we can still worry (even though it doesn’t do any good). But perhaps we can figure out how to do it less.

11:14

Andrew Cuomo is no hero. [Richard Stallman's Political Notes]

*Andrew Cuomo is no hero. He's to blame for New York's coronavirus catastrophe. His record was terrible before coronavirus, but his abysmal handling of the crisis should get him thrown out of office.*

Many Americans have somehow got the idea that he is progressive. More Information Further information

10:07

YouTube Faces Permanent ISP Blocking in Repeat Copyright Infringer Lawsuit [TorrentFreak]

Sad YouTubeFive years ago, YouTube CEO Susan Wojcicki revealed that 400 hours of video were being uploaded to the platform every minute. Today that volume has increased to a staggering 500 hours per minute, a vast amount of content by any standard.

While the majority of the video uploaded to YouTube isn’t problematic for the company or third-parties, some users breach copyright law by uploading content that infringes on the rights of others. When that content is discovered by YouTube’s Content ID system or is manually claimed by a rightsholder it can be monetized or removed, but not everything goes smoothly.

In 2018, Russia-based HR-solutions company OnTarget obtained a ruling from the Moscow City Court which compelled Google-owned YouTube to remove some of its content uploaded without permission. Among other things, the company creates personnel assessment test videos and some of these had been uploaded to YouTube by channels that reportedly assist people to obtain jobs by gaming the system.

According to a report from Kommersant, Google appealed in 2019, stating that the content was no longer on YouTube. However, the court dismissed the case, stating that the platform had “not eliminated the threat” of the plaintiff’s rights being violated in the future. It now appears that prediction has come to pass.

OnTarget has now filed another copyright infringement complaint against Google at the Moscow City Court. Founder and CEO of the company Svetlana Simonenko says that YouTube channels informing job seekers on how to “trick future employees and pass tests for them” has posted video tests developed by OnTarget to the platform in breach of copyright.

Speaking with Kommersant, Simonenko says that the lawsuit demands that YouTube should be completely blocked by local ISPs as the violations against her company continue. She claims that Google has not deleted the infringing content and this means YouTube should be considered a repeat infringer under Russia’s anti-piracy laws.

The permanent blocking of websites is a measure only usually taken against the most blatant of infringing platforms, such as massive torrent site RuTracker that despite repeated warnings, fails to remove any copyrighted content following complaints.

As written, Russia’s copyright laws require that sites that repeatedly infringe copyright should be completely blocked in the country but according to experts, demands to have a site like YouTube blocked across Russia over a few videos are likely to fail under pressure.

“It is clear that the requirement to block the whole of YouTube due to several videos is excessive, and the Moscow City Court should reject the normal course of events due to the fact that it is not proportional to the violation,” says Anatoly Semenov, Deputy Head of the IP Committee of the Russian Union of Industrialists and Entrepreneurs (RSPP).

Semenov says that due to the way the law is written the Court isn’t in a position to push aside the requirement to block the entire site and replace that with a requirement to block individual links to content. However, it could simply refuse to apply it in this case or even refer the matter to the Constitutional Court.

From: TF, for the latest news on copyright battles, piracy and more.

08:42

Comic: S-Tier [Penny Arcade]

New Comic: S-Tier

08:35

Bits from Debian: Debian welcomes the 2020 GSOC interns [Planet Debian]

GSoC logo

We are very excited to announce that Debian has selected nine interns to work under mentorship on a variety of projects with us during the Google Summer of Code.

Here are the list of the projects, students, and details of the tasks to be performed.


Project: Android SDK Tools in Debian

  • Student(s): Manas Kashyap, Raman Sarda, and Samyak-jn

Deliverables of the project: Make the entire Android toolchain, Android Target Platform Framework, and SDK tools available in the Debian archives.


Project: Packaging and Quality assurance of COVID-19 relevant applications

  • Student: Nilesh

Deliverables of the project: Quality assurance including bug fixing, continuous integration tests and documentation for all Debian Med applications that are known to be helpful to fight COVID-19


Project: BLAS/LAPACK Ecosystem Enhancement

  • Student: Mo Zhou

Deliverables of the project: Better environment, documentation, policy, and lintian checks for BLAS/LAPACK.


Project: Quality Assurance and Continuous integration for applications in life sciences and medicine

  • Student: Pranav Ballaney

Deliverables of the project: Continuous integration tests for all Debian Med applications, QA review, and bug fixes.


Project: Systemd unit translator

  • Student: K Gopal Krishna

Deliverables of the project: A systemd unit to OpenRC init script translator. Updated OpenRC package into Debian Unstable.


Project: Architecture Cross-Grading Support in Debian

  • Student: Kevin Wu

Deliverables of the project: Evaluate, test, and develop tools to evaluate cross-grade checks for system and user configuration.


Project: Upstream/Downstream cooperation in Ruby

  • Student: utkarsh2102

Deliverables of the project: Create guide for rubygems.org on good practices for upstream maintainers, develop a tool that can detect problems and, if possible fix those errors automatically. Establish good documentation, design the tool to be extensible for other languages.


Congratulations and welcome to all the interns!

The Google Summer of Code program is possible in Debian thanks to the efforts of Debian Developers and Debian Contributors that dedicate part of their free time to mentor interns and outreach tasks.

Join us and help extend Debian! You can follow the interns' weekly reports on the debian-outreach mailing-list, chat with us on our IRC channel or reach out to the individual projects' team mailing lists.

08:28

The Cut [Ctrl+Alt+Del Comic]

Look, if this Snyder Cut actually turns Justice League into a good movie, I’ll be thrilled to eat crow here. But I think the past few years of blind-faith hype over this thing has written a check that no amount of unused footage, or the man behind the camera, can possibly cash. Slice it up, rearrange it, add some new effects… I don’t think the core vision for this franchise was ever on solid footing to begin with.

I guess we’ll see, though.

The post The Cut appeared first on Ctrl+Alt+Del Comic.

07:35

Feeds | CW20 speed blog: Carrot and stick approaches to promoting research software as a community [Planet GridPP]

CW20 speed blog: Carrot and stick approaches to promoting research software as a community g.law 22 May 2020 - 7:16am

07:00

Steve Kemp: Updated my linux-security-modules for the Linux kernel [Planet Debian]

Almost three years ago I wrote my first linux-security-module, inspired by a comment I read on LWN

I did a little more learning/experimentation and actually produced a somewhat useful LSM, which allows you to restrict command-execution via the use of a user-space helper:

  • Whenever a user tries to run a command the LSM-hook receives the request.
  • Then it executes a userspace binary to decide whether to allow that or not (!)

Because the detection is done in userspace writing your own custom rules is both safe and easy. No need to touch the kernel any further!

Yesterday I rebased all the modules so that they work against the latest stable kernel 5.4.22 in #7.

The last time I'd touched them they were built against 5.1, which was itself a big jump forwards from the 4.16.7 version I'd initially used.

Finally I updated the can-exec module to make it gated, which means you can turn it on, but not turn it off without a reboot. That was an obvious omission from the initial implementation #11.

Anyway updated code is available here:

I'd kinda like to write more similar things, but I lack inspiration.

Girl Genius for Friday, May 22, 2020 [Girl Genius]

The Girl Genius comic for Friday, May 22, 2020 has been posted.

06:49

Republicans plan to let extended unemployment insurance end in July. [Richard Stallman's Political Notes]

Republicans plan to let extended unemployment insurance end in July, when the depression will still be getting worse.

That will, I expect, increase the depression, but not for billionaires, who will receive handouts.

Big corporations planning to sue countries for taking Covid-19 measures that cut into profits. [Richard Stallman's Political Notes]

Big corporations are planning use ISDS clauses (I Sue Democratic States) to sue many countries for taking Covid-19 emergency measures that cut into their profits.

Governments may be able to argue that the losses were due to Covid-19 and its consequences, rather than to the government actions themselves. But that is not reliable.

We must abolish the business-supremacy treaties.

Insolvent Wall Street banks bailed out again. [Richard Stallman's Political Notes]

*Insolvent Wall Street banks have been quietly bailed out again. Banks made risk-free by the government should be public utilities.*

Apple Siri recorded and saved people's speech. [Richard Stallman's Political Notes]

Former Apple worker Thomas le Bonniec reports that Apple Siri recorded and saved people's speech at random and is not being investigated for this.

Increase of powerful hurricanes near Australia. [Richard Stallman's Political Notes]

Hurricanes near Australia (peculiarly called "tropical cyclones" though they are the same phenomenon) show a trend over the past 40 years that the number of the most powerful ones is increasing — in line with what climate models forecast.

The US is forecast to get a lot of hurricanes this year, and it will be hard to give people shelter without their catching Covid-19 from each other.

The US needs to be making lots of masks to give them, and goggles. Republicans in their contempt for the non-rich will choose not to do it.

Urgent: Pentagon's Revolving Door. [Richard Stallman's Political Notes]

US citizens: call on your Senator not to reopen the Pentagon's revolving door.

The Capitol Switchboard numbers are 202-224-3121, 888-818-6641 and 888-355-3588.

If you call please spread the word!

04:42

Emotional Belaboring [Diesel Sweeties webcomic by rstevens]

this is a diesel sweeties comic strip

How’s quarantine treating you? (Honestly)

02:21

THEM [QC RSS]

!!

01:56

Link [Scripting News]

Or a drug that prevents the virus that is not a vaccine?

Link [Scripting News]

Poll: You see a friend on Facebook doing something ridiculously unsafe. His barber made a house call. A picture shows them in a selfie, touching, breathing presumably, no masks. Comments say how nice he looks with new haircut.

Thursday, 21 May

23:49

Ohio’s Opening Up But I’m (Still) Staying In [Whatever]

So, Ohio is on its way to opening up entirely — restaurants can open their inside dining areas today, and by June first places like banquet halls and bowling alleys can be back in business. This is all presuming social distancing, etc, inside those halls and alleys. A lot of people around here are thrilled, and I can’t say I blame them; it’s difficult to be away from the world for two months, even in the best-case scenario where your job and well-being are miniminally impacted by these events. A lot of people are ready to go back into the world, or at least the bit of it encompassed by Ohio.

I’m probably not going to be one of them. And, briefly, here’s why:

1. Because the virus wasn’t (and isn’t) actually contained.

2. Because lots of people think the virus was contained, when it wasn’t (and isn’t).

3. As a result, they’re not really paying attention to things like masks or social distancing.

4. Or they think that things like masks/social distancing make you look weak and/or like a Democrat.

5. And I live in a county that went 78% for Trump in 2016, so you do the math here.

Sooooo, yeeeeeah. My plan is to stay home for most of June and let other people run around and see how that works out for them. The best-case scenario is that I’m being overly paranoid for an extra month, in which case we can all laugh about it afterward. The worst case scenario, of course, is death and pain and a lot of people confused about why ventilator tubes are stuck down their throats, or the throats of their loved ones, when they were assured this was all a liberal hoax, and then all of us back in our houses until September. Once again, I would be delighted to be proved overly paranoid.

I do plan to leave my house. I have a dentist appointment in June, and it’s likely at some point or another I will go to the grocery store, or the post office, or run some errands. When I do, I’ll wear a mask (well, probably not in the actual dentist chair, but right up until then) and I’ll keep my distance from most folks. You know, like I have done for the last few months anyway. Mind you, even if I stay at home there’s a chance I’ll still get exposed, because people are becoming more mobile in general, so there are more potential vectors for infection, etc. So I’m not under the illusion that I’m safe. Just safer.

(I could go on about all the political/social dimwittery that caused us as a nation to waste the time all of us were inside, and how we could have been in a better place vis-a-vis this virus if we had better leaders, but, honestly, you already know where I would go with all that, and I don’t want to bother right now. I’m angry about it, but mostly at the moment I’m just exasperated. And tired. Possibly mildly depressed. Meh.)

I am of course immensely privileged to have the resources to stay at my (objectively nice and comfortable) home, a job that allows me to work from that home, and a temperament that mostly doesn’t consider staying at home a hardship. As far as dystopias go, mine is quite cozy and it won’t be exactly onerous to hunker down for another month (or two! Possibly three!). I feel sorry for the people who would like to able to do what I can, but cannot, for various financial and personal reasons. And again, I have sympathy for the people who are all, the hell with this, I’ll risk getting sick, just let me out of my fucking apartment. I get where you’re coming from. You probably don’t actually know what you’re asking for. I hope that you never have to learn.

In any event: Hi, I’m still staying home. Probably. Mostly.

22:49

40% Off Choice Premium for a Limited Time [Humble Bundle Blog]

Hey Humble fans, Have we got a deal for you! For a super-limited time, get Humble Choice Premium for a

Continue reading

The post 40% Off Choice Premium for a Limited Time appeared first on Humble Bundle Blog.

22:28

Anti-Piracy Lawyer Sues Torrent Sites for ‘YTS’ Trademark Infringement [TorrentFreak]

YTS logoThe Hawaiian company ’42 Ventures’ doesn’t immediately ring a bell with most torrent users. However, when we say that it owns the trademarks for ‘YTS’ and ‘Popcorn Time,’ interests will pique.

Founded last year, the company doesn’t operate a pirate site. On the contrary, it’s represented by Kerry Culpepper, a well-known anti-piracy lawyer who works with several Hollywood film companies.

Following its inception, 42 Ventures registered several piracy-related trademarks which it uses to target pirate sites and apps, including a popular Popcorn Time fork. The lawyer has used trademark complaints to suspend Twitter accounts, offering to lift the claims in return for a settlement.

As the trademark owner 42 Ventures can do this. However, the method is unusual, to say the least, and some wonder whether it would hold up in court. The Popcorn Time dispute was never litigated though and the developers didn’t pay a settlement either. The Twitter handle remains suspended.

A few days ago another trademark issue popped up. This time, 42 Ventures went directly to court where it filed an infringement lawsuit against the operators of YTS.ws, YTS.ms, YST.lt, YTS.tl, YTSag.me, YTS.ae, YTSmovies.cc and YTS-ag.com.

“Defendants distributed and/or streamed motion pictures in violation of US Copyright law to numerous individuals in Hawaii and the United States via their interactive websites under names identical and/or confusingly similar to Plaintiff’s registered trademark,” 42 Ventures writes.

The Hawaiian company obtained the YTS trademark earlier this year but wasn’t the first to use the YTS name of course. The name was first used by the original YIFY group which shut down years ago. Since then, others have used the brand, with YTS.mx turning it into one of the most-visited torrent sites.

YTS trademark

Interestingly, YTS.mx is not mentioned in this lawsuit. This is noteworthy not just because it’s by far the largest YTS site, but also because 42 Ventures’ lawyer previously reached settlements with the torrent platform.

TorrentFreak contacted the lawyer to ask why YTS.mx was not targeted, but he prefers not to comment on the matter. We also asked how 42 Ventures uses the YTS trademark, but this question remains unanswered as well.

The legal paperwork doesn’t provide any further detail either. 42 Ventures simply write the following: “Plaintiff distributes licensed content to the public from a plurality of means including, but not limited to, websites.”

We previously learned that the company owns and operates Popcorntime4u.com through which it licenses and promotes YouTube videos. This site also includes a YTS link at the bottom, which links to the free app generator Appsgeyser. Perhaps that how 42 Ventures ‘uses’ the trademark.

Whether any of the defendants will show up in court is uncertain. The complaint lists them as being in Serbia, Russia, India and China, and all face a damages claim of $2 million for willful trademark infringement.

In addition to the damages, 42 Ventures also requests an injunction to prevent third-party intermediaries from facilitating access to the domains. This also applies to hosting companies, search engines, and domain registrars, which makes it likely that these sites will disappear if the injunction is granted.

A copy of the trademark infringement lawsuit filed by 42 Ventures at a Hawaii federal court is available here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

22:21

22:00

Alexander Artemenko: cl-who [Planet Lisp]

Today we continue to investigate poftheday's dependencies and will look at the well known cl-who library. CL-Who is a library Edmund Weitz and provides a DSL for HTML generation.

For those who are not familiar with cl-who, here is a quick example:

POFTHEDAY> (cl-who:with-html-output-to-string (s)
             (:body
              (:p "Hello world!")))
"<body><p>Hello world!</p></body>"

If you want to insert a variable, you have to use a local macro esc. There is also another macro - str, and it very easy to misuse it. That is one of the reasons why I don't like cl-who and prefer spinneret.

Let's pretend we want to output a username in the comment list on our page. The correct way to do so will be:

POFTHEDAY> (defclass user ()
             ((name :initarg :name
                    :reader get-name)))

POFTHEDAY> (let ((user (make-instance
                        'user
                        :name "Bob <script>alert('You are hacked')</script>"))
                 (comment-text "Hello from Bob!"))
             (cl-who:with-html-output-to-string (s nil :indent t)
               (:div :class "comment"
                     (:div :class "username"
                           (cl-who:esc (get-name user)))
                     (:div :class "text"
                           (cl-who:esc comment-text)))))
"
<div class='comment'>
  <div class='username'>Bob &lt;script&gt;alert(&#039;You are hacked&#039;)&lt;/script&gt;
  </div>
  <div class='text'>Hello from Bob!
  </div>
</div>"

As I said, this was a correct way, but it is very easy to misuse cl-who and make your beautiful site open for XSS attacks. You only have to use str instead of esc:

POFTHEDAY> (let ((user (make-instance
                        'user
                        :name "Bob <script>alert('You are hacked')</script>"))
                 (comment-text "Hello from Bob!"))
             (cl-who:with-html-output-to-string (s nil :indent t)
               (:div :class "comment"
                     (:div :class "username"
                           (cl-who:str (get-name user)))
                     (:div :class "text"
                           (cl-who:str comment-text)))))
"
<div class='comment'>
  <div class='username'>Bob <script>alert('You are hacked')</script>
  </div>
  <div class='text'>Hello from Bob!
  </div>
</div>"

Here script tag that was not escaped. This way, any code an evil user will enter as his name will be executed in other users browsers.

Another inconvenience of cl-who is that you have to use htm macro if want to mix HTML pieces with lisp forms. For example, if you want to output a list of items, this will not work:

POFTHEDAY> (let ((list (list 1 2 3 4 5)))
             (cl-who:with-html-output-to-string (s nil :indent t)
               (:ul
                (loop for item in list
                      do (:li (cl-who:esc
                               (format nil "Item number ~A"
                                       item)))))))
; in: LET ((LIST (LIST 1 2 3 4 5)))
;     (:LI (CL-WHO:ESC (FORMAT NIL "Item number ~A" POFTHEDAY::ITEM)))
; 
; caught STYLE-WARNING:
;   undefined function: :LI
; 
; compilation unit finished
;   Undefined function:
;     :LI
;   caught 1 STYLE-WARNING condition

You have to wrap :li form with a htm macro, like that:

POFTHEDAY> (let ((list (list 1 2 3 4 5)))
             (cl-who:with-html-output-to-string (s nil :indent t)
               (:ul
                (loop for item in list
                      do (cl-who:htm
                          (:li 
                           (cl-who:esc
                            (format nil "Item number ~A"
                                    item))))))))
"
<ul>
<li>Item number 1
</li>
<li>Item number 2
</li>
<li>Item number 3
</li>
<li>Item number 4
</li>
<li>Item number 5
</li>
</ul>"

The Common Lisp Project of the Day's blog uses cl-who only because this is a dependency of the cl-bootstrap. Personally, I prefer spinneret and probably will rewrite #poftheday site to use it.

US government trying to bully the WHO. [Richard Stallman's Political Notes]

The US government is trying to bully the WHO into bowing to Christian prudery by removing references to sexual and reproductive health.

Every time the bully succeeds in intimidating someone, he presents that as a triumph, and his fanatical supporters feel stronger. The WHO should show strength by sticking to what it considers right.

Boosting China's global power. [Richard Stallman's Political Notes]

The numskull's churlish threats are boosting China's global power.

China applies its power in a way that is less stupid than the US, but no less evil.

Refusing to hand over phone password. [Richard Stallman's Political Notes]

A UK right-wing extremist was convicted of the crime of refusing to hand over his phone password for an arbitrary, no-grounds-required, no-legal-advice-allowed search when entering the UK.

This is the same law that was used to make Glenn Greenwald's mate hand over the some of the Snowden leaks. They just have to call you a "terrorist" — never mind whether there is any truth in that.

21:35

Pre-Order Drawn to Sex: Our Bodies and Health! [Oh Joy Sex Toy]

Pre-Order Book Here Yessss it’s ready for pre-orders! Reserve your copy now for a November 2020 delivery! Pre-Order Here Drawn to Sex is our series of books collecting just the educational comics from Oh Joy Sex Toy. While The Basics, our first book in this line, was all about, y’know, the basics of doin’ it, […]

21:28

05/21/20 [Flipside]

I've been working on fixing up the website, something which is long overdue. Many things have been broken since the redesign in 2015. As of right now, I have spruced up the Book 0 Archives and I have finally added all of the Holiday Comics to the Misc Comics section.

Also, I have added a whole bunch of new vote incentives to the Top Webcomics page. Mostly it's repeats of the many old ones I've done over the years, of which there's a ton... but some of these haven't been posted in ages. There will be some new ones, too. You can vote for me here.

Finally, I have decided to close down the Flipside Forums as they are completely broken, and it doesn't seem to be worth fixing them. The Forum link in the menu has been replaced with a new link for the Discord. I want to try to encourage Flipside Discussion to take place there, from now on! You can also get info about my streaming schedule in there too. We will be expanding the Discord a bit in the near future, so please feel free to use it!

Link [Scripting News]

Pretty remarkable. Is the common cold a vaccine for Covid-19?

Link [Scripting News]

All you have to do is write an article that says RSS is Dead and you'll get lots of clicks, and I'm not sure if anyone will believe you or think you're smart, but you are wrong. Those articles have been written for decades, and my friends RSS is built-in, like HTTP and HTML, DNS, SMTP, POP and all the other michegas that makes up the net. The stack never gives up anything. Also since it never was alive, how can it be dead, n'est-ce pas?

18:28

Lying for half a million dollars [Richard Stallman's Political Notes]

Jane Roe, plaintiff in the Roe v Wade case, famously recanted her support for abortion rights. Just before dying she confessed that her recantation was a sham — she lied in exchange for half a million dollars from Operation Rescue.

Lifelong punishments without trial [Richard Stallman's Political Notes]

The UK plans once again to impose lifelong punishments on people accused of terrorism, without troubling to give them a trial first.

This would be on top of the deviously evil UK laws that make it a crime to arouse suspicion.

All cooperation cancelled [Richard Stallman's Political Notes]

The Palestinian Authority has cancelled all cooperation with Israel, anticipating annexation of Palestine's farm land.

Four-day week [Richard Stallman's Political Notes]

New Zealand's prime minister proposes a four-day work week so as to get more people employed quickly.

Fired for refusing to censor [Richard Stallman's Political Notes]

Florida fired scientist Rebekah Jones who had developed a system for online fast access to statistics about Covid-19 in the state. She said she was fired for refusing to censor the data.

Hero tax [Richard Stallman's Political Notes]

(satire) *Amazon Institutes New ‘Hero Tax’ Charging Essential Workers Additional $2 Per Hour For Honor Of Bravely Performing Job*

Reducing military budget [Richard Stallman's Political Notes]

29 progressive Democrats call for reducing the US military budget this year.

I hope they present a target for this reduction, because a minuscule reduction of ten dollars or ten million dollars won't make much difference against the recent increase of a hundred billion dollars.

Opposing available vaccines [Richard Stallman's Political Notes]

The UK is opposing the campaign to make Covid-19 vaccines available to everyone in the world — and without that, billions of people will be unable to afford it.

Kelp farming [Richard Stallman's Political Notes]

Kelp farming absorbs CO2, so it can locally slow the inexorable advance of ocean acidification.

To really end ocean acidification, we must drastically cut our CO2 emissions.

Sending asylum seekers [Richard Stallman's Political Notes]

The US sends Hondurans and Salvadoreans seeking asylum to Guatemala saying they should try to find safety there.

They could replace the Guatemalans who are fleeing the violence of their country for the US.

Temporary decline [Richard Stallman's Political Notes]

The temporary decline in CO2 emissions, due to staying home and not traveling, is not enough to affect global heating in the long run.

We still desperately need a Green New Deal.

Handy opportunity for racists [Richard Stallman's Political Notes]

A black man and his mother was accused of stealing a TV set after he bought it. Then he tried to return it and was accused again of stealing it. This time, the thugs beat him and his mother, gravely injuring them both.

The thugs said they mutilated him for "failing to comply". That is a handy opportunity to elevate their subjective impression to the status of fact — handy for racists.

18:21

Link [Scripting News]

Gatekeepers pass on ideas from people they respect and not people they don't. It's natural. I do it too. But I've been wrong a number of times this way, and then missed out on important ideas. So I try to pay attention to unusual thinking whether or not I like the person doing the talking. It can be hard to overcome judgement, but it's often worth trying.

18:07

[$] Saving frequency scaling in the data center [LWN.net]

Frequency scaling — adjusting a CPU's operating frequency to save power when the workload demands are low — is common practice across systems supported by Linux. It is, however, viewed with some suspicion in data-center settings, where power consumption is less of a concern and there is a strong emphasis on getting the most performance out of the hardware. At the 2020 Power Management and Scheduling in the Linux Kernel summit (OSPM), Giovanni Gherdovich worried that frequency scaling may be about to go extinct in data centers; he made a plea for improving its behavior for such workloads while there is still time.

17:35

Today in GPF History for Thursday, May 21, 2020 [General Protection Fault: The Comic Strip]

"Alt-Trudy", Trudy's "Negaverse" counterpart, convinces Nick she is her alternate self and begs him to help the "real" Trudy adjust to her "new life" in the "prime" universe...

17:21

Pluralistic: 21 May 2020 [Pluralistic: Daily links from Cory Doctorow]


Today's links



Walt's grandson calls for Disney execs' bonuses to be canceled (permalink)

On its face, Disney's announcement that it was furloughing workers and cutting exec salaries made it seem like execs and workers were in it together – but as heiress Abigail Disney pointed out, top execs' compensation is mostly stock based:

https://pluralistic.net/2020/04/22/filternet/#castmembers

Things are looking increasingly dire for the front line Disney workers who are going without salary.

Now, another Disney family member has raised similar concerns: Walt Disney's grandson Brad Lund told The Daily Beast that total exec compensation should be cut further and the sums distributed to financially insecure workers:

https://www.thedailybeast.com/disney-grandson-slams-bonuses-for-execs-who-axed-workers

To its credit, Disney has cancelled plans to pay dividends to shareholders (another source of executive compensation) and has not ruled out cancelling bonuses at the end of the year.

https://www.cnn.com/2020/05/20/business/walt-disney-grandson-bonuses/index.html



The Lost Cause and MMT (permalink)

Last summer, I recorded a two-part interview with the MMT podcast, discussing how my activism and science fiction intersect with Modern Monetary Theory, a lens for understanding the role of money in our economies:

https://pileusmmt.libsyn.com/26-cory-doctorow-radicalize-this-part-1
https://pileusmmt.libsyn.com/27-cory-doctorow-radicalize-this-part-2

I was delighted to be invited back on to talk about the novel I'm writing, "The Lost Cause," in which MMT has enabled a just climate transition to a Green New Deal, but without getting rid of reactionary elements who stood in its way.

https://www.patreon.com/posts/new-decameron-36398964

The episode is just out and it's awfully fun and funny, and we talk about a lecture I'm planning to give to a World Economic Forum AI workshop on why I think technological unemployment is a distraction.

https://pileusmmt.libsyn.com/51-cory-doctorow-the-first-days-of-a-better-nation-vs-the-flu-klux-klan

The climate emergency will demand full employment for all of us and our children and their children for hundreds of years, doing things like relocating every coastal city in the world several kilometers inland.

That's just for starters.

Keynes once proposed a thought experiment for kickstarting a moribund economy by paying half of the unemployed workers to dig holes and the other half to fill them in.

We spent 150 years subsidizing our ancestors to dig up fossil fuels, and now we have to pay our descendants to spend 200-300 years getting them back into the ground.

Image: Molly Crabapple/The Intercept
https://www.youtube.com/watch?v=d9uTH0iprVQ



Patent troll sues ventilator makers (permalink)

What's the lowest, scummiest thing a patent troll could do? How about suing a bunch of ventilator manufacturers during the coronavirus pandemic, for violating a bullshit patent that never should have been granted in the first place?

https://www.eff.org/deeplinks/2020/05/new-low-bad-patent-patent-troll-sues-ventilator-company

Swirlate IP is a patent troll (its whose sole product is lawsuits) that filed suit against five ventilator companies: Resmed, Livongo Health, Corning Optical Communications, Badger Mete and Continental Automotive, claiming they infringed on US patents 7,567,622 and 7,154,961.

These are classic bullshit software patents, claiming ownership to most forms of data-transfer. Panasonic (to its shame) applied for the patent in 2002, the heyday of bullshit software patents. Now it's owned by Swirlate (Panasonic has a history of selling patents to trolls).

Swirlate asserts that anyone who uses LTE data-transfer needs to license its patents.

Swirlate itself has no office except for a Pack and Mail Shoppe mailbox in a stripmall in Plano, Texas, home to America's most patent-troll friendly courthouse.

United Patents says Swirlate is a front for IP Edge, a notorious firm of patent trolls owned by three IP lawyers that controls a vast swathe of shell companies that engage in this kind of shakedown.

https://www.unifiedpatents.com/insights/2020/5/4/3000-cash-prize-for-prior-art-on-former-panasonic-owned-patent



Private equity's healthcare playbook is terrifying (permalink)

I was really struck by a biting insight on the state of US healthcare in a recent episode of the excellent Arm and a Leg podcast: America funds healthcare like a restaurant (dependent on optional "Sunday brunches" AKA elective procedure)…

https://armandalegshow.com/episode/the-severe-very-weird-recession-in-health-care-and-what-it-means-to-our-wallets/

But we really need healthcare that's funded like a fire-department (lots of reserve capacity to cope with rare, but catastrophic problems).

Where did the reserve capacity in US healthcare go? Into the pockets of private equity, an "investment" system that loads up useful, functioning real-economy businesses with debt, extracts all their value, and then leaves them to fail.

https://pluralistic.net/2020/04/04/a-mind-forever-voyaging/#prop-bets

The private equity playbook is slippery and hard to get your head around because it combines out-and-out fraud with incredibly dull financial minutiae. It's like the Softbank/Uber/Doordash grift.

https://pluralistic.net/2020/05/18/code-is-speech/#schadenpizza

First, you have to overcome the scheme's stultifying complexity, and then you find yourself questioning your own comprehension because once you cut through the performative dullness of the scheme, it seems like a naked fraud. Could all these billions REALLY just be fraud?

Yup.

Today's must-read long-read is Heather Perlberg's pitiless biopsy of the role of private equity in destroying the US health-care system, a metastatic cancer that has left it weak and unable to cope.

https://www.bloomberg.com/news/features/2020-05-20/private-equity-is-ruining-health-care-covid-is-making-it-worse

Here's how the con works. The American Medical Association prohibits non-doctors from profiting from medicine, so PE maintains the pretense that what it owns is a practice's "nonclinical" assets – administration, supplies, support staff, etc.

Externally, PE companies swear they're not involved in medical decisions. But when PE barons like Matt Jameson (BlueMountain Capital) pitch doctors behind closed doors, they say things like "It's not going to be something where clinical is completely not touched."

Here's what that looks like: Doctors are pressured to advise patients to get more lucrative procedures. They see more patients/day. Patients are sent home with open wounds and come back the next day for stitches so they generate two bills.

Doctors are replaced with "physicians' assistants" – the pretence is that they're under a docs' supervision, even when the doc is in another city. These non-docs miss deadly skin cancers (when my daughter went to a PE-owned ER for a broken collarbone, she never saw a doc).

Docs are nickel-and-dimed on both procedures and administration: "A doctor at Advanced Dermatology says that waiting for corporate approvals means his office is routinely left without enough gauze, antiseptic solution, and toilet paper."

PE management is supposed to create economies of scale by merging mulitple practices and hospitals. In practice, these are actually diseconomies of scale: every lab, hospital and doctor's office in my neighborhood is owned by one PE group.

They've merged all the privacy and conset docs. Here's how that works: when you go to any medical facility, you get a "consent" form that covers everything any of the practices nationwide do. Getting blood drawn? You have to give blanket consent to all of it.

Literally. They asked me to consent to being involuntarily sedated, put in restraint, having surgery performed without my further consent, having the procedures videoed, and having those videos used "for any purpose."

And the privacy policy? You get a mag-strip to sign on.

"What's this?"

"It says you've read the privacy policy."

"Where's the privacy policy?"

Sighs, prints a doc, hands me a sheet. It has one sentence: I HAVE READ THE PRIVACY POLICY.

"This is the privacy policy"

The one administrative task PE excels at is negotiating higher rates with insurers.

But even with those higher rates, the practices lose money. But that's a feature, not a bug.

The practices lose money because they're heavily indebted, because PE companies take out huge loans against the practice's future incomes, and pay their investors giant special dividends out of the debt. When the practices default, they're sold to other PE companies.

Those companies take out even more debt, leaving the practices even more desperate, cutting more corners. Advanced Dermatology, a giant, PE-backed dermatology chain, had a pathological pathologist, Matt Leavitt, who gobbled meth while misdiagnosing medical conditions.

Dermatologists are hard hit by the crisis. They're prime targets for PE looting (apart from skin cancer, dermatology is almost all "Sunday brunch" medicine – elective, inessential, and thus not allowed to operate during lockdown).

So they're debt-loaded and shuttered, with payments to make. That's why Dr.Greg Morganroth, CEO of California Skin Institute, gave a webinar telling docs that they should consider themselves "essential" during the crisis and keep administering botox to boomers.

Eventually, it's crumble, just like all the other PE success stories, from Sears to Toys R Us. As U Connecticut prof Dr Jane Grant-Kels said, "There's a limit to how much money you can make when you're sticking knives into human skin for profit."

And when it does, the US health system will be where the US restaurant system is: totally dependent on Sunday brunches that cannot resume for years to come, and circling the drain waiting for them to come back.



On Madame Leota's side-table (permalink)

One of the things that makes Disney's Haunted Mansion such a classic of the form is the wealth of fine details that seem coherent, even though it's hard to pin down exactly how they all join up.

Like the wee side-table in Madame Leota's seance room.

https://longforgottenhauntedmansion.blogspot.com/2020/05/rap-on-table.html

Long Forgotten has a (characteristically) excellent history of this tiny detail and how it changed through the years. It was likely a projector housing for a version of the show where Leota's face was on the other side of the crystal ball (this was scrapped prior to opening).

But it's also a great atmospheric piece, a version of the "Moroccan side table" (AKA a "Moorish," "Turkish," "Ottoman," "Syrian," "Anglo Indian" and "Arabesque" table) – a Victorian ubiquity that beautifully conjures up the era.

The tables are worked with the Star of Solomon, a bit of mysticism that also fits beautifully.

Disneyland's side table eventually proliferated to other Haunted Mansions around the world, subtle transformed for each environment.

Florida's version of the table was added in 2007: "According to production designer Neil Engel, who installed it, they found the table at a swap meet."

Alas, Florida's Mansion has since lost the beloved table/lamp/chair tableau from its load area.

https://pluralistic.net/2020/04/30/day-and-date/#long-forgotten



Black Americans' covid mortality is 2.5X white mortality (permalink)

Black Americans are dying of coronavirus at 2.5 times the rate of white Americans, according to APM's Color of Coronavirus report. In Kansas, Black people are dying at 7 times the rate of white people.

https://www.apmresearchlab.org/covid/deaths-by-race

"Senior Trump administration officials have blamed the disparities on the high incidence among black people of underlying health conditions such as diabetes, hypertension and obesity."

https://www.theguardian.com/world/2020/may/20/black-americans-death-rate-covid-19-coronavirus

The CDC has dragged its feet on releasing race-based coronavirus stats, which is why APM has released its own report.

Coronavirus is an accelerant, making the slow process of systemic bias so fast that it can't be denied.

As Alissa Walker wrote, the disparity in NYC's and SF's death tolls can be explained by San Francisco's ethnic cleansing: "people who were most at risk from dying from covid [were pushed] to its surrounding counties long before the pandemic arrived."

https://www.curbed.com/2020/5/20/21263319/coronavirus-future-city-urban-covid-19

Any discussion of how to redesign our living spaces after the pandemic that doesn't explicitly address racial disparities is totally non-credible.



Spotify's trying to kill podcasting (permalink)

Joe Rogan is getting $100m in exchange for putting his podcast behind Spotify's paywall.

https://mattstoller.substack.com/p/on-the-spotify-joe-rogan-deal-and

Spotify has been on an extraordinary, acquisition- and exclusivity-driven spending spree, buying 15 companies, and doing deals like this one with Rogan. Wall Street loves this, and the Rogan deal sent Spotify's share price soaring.

Why does Wall Street like this? Because acquisition-driven growth is a great way to establish a monopoly in which rents are extracted from suppliers and customers to the benefit of shareholders.

That's why traditional, pre-Reagan antitrust banned "mergers to monopoly" and acquisitions of nascent competitors. Growth through acquisition means that companies succeed by having more money, not by having better products or prices. It's a winner-take-all death spiral

As Matt Stoller points out, even Rogan admits there are no consumer benefits from this deal: "It will be the exact same show. I am not going to be an employee of Spotify. We're going to be working with the same crew doing the exact same show."

In other words, the only difference is enclosure: taking something from the federated, open, competitive web and sticking it inside a walled garden. It's the App Store strategy, the Facebook strategy, the AOL strategy, the MSN strategy.

The internet is running out of open, federated platforms. There's the web (those parts of it that Facebook hasn't swallowed), email (same, but Gmail), RSS, and some Fediverse tools like Mastodon.

They're like national parks, tiny preserves for the open spaces that once dominated the landscape. And like national parks, every time they are discovered to have something good, a plute comes along to enclose them and charge admission.



Monopolies killed corporate R&D; (permalink)

Corporate R&D; was once an engine of American progress and competition. Because antitrust rules banned growth through buying competitors, companies had to invest in bold R&D; in order to grow.

https://ftalphaville.ft.com/2020/05/05/1588690507000/American-innovation-through-the-ages/

As antitrust enforcement waned, so did R&D.; Research moved into universities, while companies specialized in "Development" – but tech transfer offices and other efforts to turn academic research into businesses were far less effective than in-house R&D.;

https://static1.squarespace.com/static/593d9b08be65945a2e878544/t/5d31ac9b33ae9b0001d88216/1563536539717/c14259.pdf

In-house labs had a dual role: they researched general purpose technologies, while solving practical problems. They had deep pockets and interdisciplinary teams – and often the research they did rippled out through the rest of industry (Xerox PARC and the GUI, AT&T; and Unix).

But as antitrust scrutiny was relaxed, companies could capture the same growth without the (society-benefiting) inefficiencies of in-house research. Rather than growing by doing stuff, they grew by buying stuff.

https://blog.dshr.org/2020/05/the-death-of-corporate-research-labs.html



How spy agencies targeted Snowden journalists (permalink)

As explosive as the Snowden leaks were in their original reportage, some of their most fascinating and enduring legacies were the longer-form, analytical stories and memoirs of the events.

They started with Glenn Greenwald's excellent 2014 book "No Place to Hide," which focused on the case for privacy and the technical ins-and-outs of the revelations, describing both how the spying worked and how it eroded our democracy.

https://boingboing.net/2014/05/28/greenwalds-no-place-to-hid.html

Then came Laura Poitras's stunning, Academy-Award-winning doc Citizenfour, which manages to be a technothriller, a portrait of Snowden, and a political call to arms, all at once.

https://www.newyorker.com/news/amy-davidson/is-citizenfour-worth-celebrating

Last year, Snowden published Permanent Record, his own memoir, which uses the incredible tradecraft details as an engine to drive a political manifesto that emerges from his autobiography.

https://boingboing.net/2019/09/24/pardon-snowden-now.html

There are oddities like Snowden's Box, which uses the tale of how Snowden got a hard drive from his home in Hawaii to Laura Poitras. It's a gorgeous little book, like a Ninety Nine Percent Invisible episode about privacy and surveillance, told by examining a single object.

https://boingboing.net/2020/03/31/94-1054-eleu-st.html

The latest addition to the canon is Barton Gellman's Dark Mirror, which is excerpted at length in The Atlantic:

https://www.theatlantic.com/magazine/archive/2020/06/edward-snowden-operation-firstfruits/610573/

Gellman was already a multiple Pulitzer winner when Snowden contacted him, but (IMO) he did his best work after that moment.

So it's fascinating to read just this short excerpt – which has that awesome technothriller business going on, as Gellman discovers his devices are getting systematically hacked by (multiple?) spy agencies.

Gellman tries to protect himself, going to ever-greater lengths, though, as Schneier says, the Snowden journalists for all their trying were vastly outmatched:

https://www.schneier.com/blog/archives/2020/05/bart_gellman_on.html

For me, this excerpt demonstrates the adage that security favors attackers over defenders. There's a scene in the third Little Brother book, Attack Surface (which comes out on Oct 12), where a former surveillance contractor explains this to a protest group:

"I can show you how their spy shit works, and I can show you how to do spy shit of your own, but you're going to lose. They get paid a lot of money to spy on you and they use that money to pay people like me to pay very, very close attention to you. If you keep them from spying on you, they don't get paid. But neither do you. Not getting spied on is a serious job, a second job or maybe a third job, and it's unpaid work, and you're not very good at it.

"They need to use the money they get to find one tiny mistake you've made and then they get to crack your life wide open. You need to make zero mistakes in your unpaid second job. Third job. You are going to lose. And it's a team sport. When you get compromised, the bad guys don't just get to spy on you, they get to spy on everyone who communicates with you, everyone who trusts you."

For me, this is the central question of the Snowden revelations: is the reality of computers that they will always be easier to use as tools of oppression, or can they be used as tools of liberation, too?

Snowden was kind enough to write an intro for the omnibus reissue of Little Brother and Homeland that comes out this July where he digs into this issue.

https://us.macmillan.com/books/9781250774583

Attack Surface – Little Brother III – is also available for pre-order, and pre-orderers get a free Marcus Yallow story as an ebook and audiobook when it comes out:

https://read.macmillan.com/promo/attacksurfacepreordercampaign/



This day in history (permalink)

#10yrsago Google offers encrypted search https://googleblog.blogspot.com/2010/05/search-more-securely-with-encrypted.html

#10yrsago Google and Viacom blend high-profile copyright suits with extreme profanity, as nature intended https://arstechnica.com/tech-policy/2010/05/f-those-mother-f-ers-youtubeviacom-lawsuit-gets-dirty/

#10yrsago Scientology raid uncovers dossiers on local "enemies": sexual habits, health info, political opinions https://www.ansa.it/web/notizie/rubriche/english/2010/05/20/visualizza_new.html_1794804082.html

#10yrsago Secrets of a suitcase-packing ninja https://www.nytimes.com/slideshow/2010/05/06/business/businessspecial/20100506-pack-ss.html

#10yrsago The Boneshaker: magic, latter-day Bradburian novel for young adults https://boingboing.net/2010/05/21/the-boneshaker-magic.html

#5yrsago NSA wanted to hack the Android store https://www.cbc.ca/news/canada/spy-agencies-target-mobile-phones-app-stores-to-implant-spyware-1.3076546

#5yrsago GM says you don't own your car, you just license it https://consumerist.com/2015/05/20/gm-that-car-you-bought-were-really-the-ones-who-own-it/

#5yrsago Paper on changing peoples' minds about marriage equality retracted https://retractionwatch.com/2015/05/20/author-retracts-study-of-changing-minds-on-same-sex-marriage-after-colleague-admits-data-were-faked/

#1yrago Facebook's Dutch Head of Policy lied to the Dutch parliament about election interference https://www.bitsoffreedom.nl/2019/05/21/facebook-lies-to-dutch-parliament-about-election-manipulation/

#1yrago The empirical impact of Lyft and Uber on cities: congestion (especially downtown, especially during "surges"), overworked drivers https://www.sfgate.com/technology/article/Uber-Lyft-San-Francisco-pros-cons-ride-hailing-13841277.php

#1yrago The government of Baltimore has been taken hostage by ransomware and may remain shut down for weeks https://arstechnica.com/information-technology/2019/05/baltimore-ransomware-nightmare-could-last-weeks-more-with-big-consequences/

#1yrago Massive, careful study finds that social media use is generally neutral for kids' happiness, and sometimes positive https://www.pnas.org/content/116/21/10226



Colophon (permalink)

Today's top sources: Tiest Vilee, Naked Capitalism (https://nakedcapitalism.com/), Bruce Schneier (https://schneier.com/).

Currently writing: My next novel, "The Lost Cause," a post-GND novel about truth and reconciliation. Yesterday's progress: 532 words (17919 total).

Currently reading: The Case for a Job Guarantee, Pavlina Tcherneva

Latest podcast: Someone Comes to Town, Someone Leaves Town (part 03) https://craphound.com/podcast/2020/05/18/someone-comes-to-town-someone-leaves-town-part-03/

Upcoming appearances: Controlled Digital Lending: Getting Books to Students During the Pandemic & Beyond, Friday May 22 https://www.publicknowledge.org/event/controlled-digital-lending/

Upcoming books: "Poesy the Monster Slayer" (Jul 2020), a picture book about monsters, bedtime, gender, and kicking ass. Pre-order here: https://us.macmillan.com/books/9781626723627

"Attack Surface": The third Little Brother book, Oct 20, 2020. https://us.macmillan.com/books/9781250757531

"Little Brother/Homeland": A reissue omnibus edition with a new introduction by Edward Snowden: https://us.macmillan.com/books/9781250774583


This work licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commerically, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/web/accounts/303320

Twitter (mass-scale, unrestricted, third-party surveillance and advertising):

https://twitter.com/doctorow

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
When life gives you SARS, you make sarsaparilla -Joey "Accordion Guy" DeVilla

16:00

Link [Scripting News]

I wrote this piece in the month after my father's death in 2009. I call that event Father's Day on my blog. Anyway, I know someone who lost her father last week, to CV, and wanted to share my writeup of a talk by Bruce Sterling. It's about the big moments in our life when change is more than something we dream about. It seems this is a door that's opening for all of us now, so why not post it publicly. And thanks to Sterling for putting this idea out there, so eloquently.

15:49

[$] The pseudo cpuidle driver [LWN.net]

The purpose of a cpuidle governor is to decide which idle state a CPU should go into when it has no useful work to do; the cpuidle driver then actually puts the CPU into that state. But, at the 2020 Power Management and Scheduling in the Linux Kernel summit (OSPM), Abhishek Goel presented a new cpuidle driver that doesn't actually change the processor's power state at all. Such a driver will clearly save no power, but it can be quite useful as a tool for evaluating and debugging cpuidle policies.

GNOME resolves Rothschild patent suit [LWN.net]

The patent suit filed against the GNOME Foundation last September has now been resolved. "In this walk-away settlement, GNOME receives a release and covenant not to be sued for any patent held by Rothschild Patent Imaging. Further, both Rothschild Patent Imaging and Leigh Rothschild are granting a release and covenant to any software that is released under an existing Open Source Initiative approved license (and subsequent versions thereof), including for the entire Rothschild portfolio of patents, to the extent such software forms a material part of the infringement allegation." There is no mention of what the foundation had to give — if anything — for this settlement,

A review of open-source software supply chain attacks [LWN.net]

Here's a preprint paper from Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier looking at attacks on language-specific repositories. "Recent years saw a number of supply chain attacks that leverage the increasing use of open source during software development, which is facilitated by dependency managers that automatically resolve, download and install hundreds of open source packages throughout the software life cycle. This paper presents a dataset of 174 malicious software packages that were used in real-world attacks on open source software supply chains, and which were distributed via the popular package repositories npm, PyPI, and RubyGems. Those packages, dating from November 2015 to November 2019, were manually collected and analyzed. The paper also presents two general attack trees to provide a structured overview about techniques to inject malicious code into the dependency tree of downstream users, and to execute such code at different times and under different conditions."

Security updates for Thursday [LWN.net]

Security updates have been issued by Arch Linux (keycloak, qemu, and thunderbird), Debian (dovecot), Fedora (abcm2ps and oddjob), Red Hat (java-1.7.1-ibm, java-1.8.0-ibm, and kernel-rt), SUSE (ant, bind, and freetype2), and Ubuntu (bind9 and linux, linux-aws, linux-aws-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3,linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2 ).

15:22

A noinline inline function? What sorcery is this? [The Old New Thing]

You can declare a noinline inline function.

void g();

// gcc
__attribute__((noinline)) inline void f()
{
    g();
}

// MSVC
__declspec(noinline) inline void f()
{
    g();
}

void tryme()
{
    f();
    f();
}

What sorcery is this, a function that is both inline and not-inline?

The two keywords are not contradictory because they describe different senses of the word “inline”.

The C++ language keyword inline means “can be defined in multiple translation units without triggering an ODR violation.” In other words, it lets you put the function definition in a header file that is included by multiple C++ files.

The function attribute/declaration specifier noinline means “do not inline this function during code generation.” It is a directive to the optimizer not to perform inline substitution during code generation.

Historically, the inline C++ keyword was originally an optimizer hint, but optimizers were given permission to ignore it and make their own decisions about inline substitution during code generation. Nowadays, compilers pretty much ignore the optimization aspect of the inline keyword. The only thing that remains of the inline keyword is the ability to have multiple definitions without violating ODR.

You could say that the modern sense of the C++ keyword inline is “defined right here.” It’s a statement about the source code, not the object code.

In the above example, the function f is a noinline inline function. The inline keyword allows the definition of f to go into a header file that is consumed by multiple translation units. The noinline attribute/declaration specifier tells the optimizer to emit code for f and call it, rather than embedding the body of f into its call sites. The function tryme will call the function f twice, instead of optimizing out the call and just calling g twice.

The post A noinline inline function? What sorcery is this? appeared first on The Old New Thing.

15:14

Link [Scripting News]

I don't see the point of a presidential campaign. There's no way it can rise above our focus on the virus. Everything in the campaign should go to saving lives, just as journalism wastes our attention on the horse race. The war is in American now. This isn't some far-away thing. It's killing Americans. Now.

14:25

State of the virus [Scripting News]

Here's where we're at with the virus in mid-May 2020.

Top line: It makes no sense to "reopen" from the lockdown in the US.

The purpose of the lockdown was to freeze everything so we could get our act together. To monitor outbreaks of the virus the same way we track the weather. It's not the testing itself that's so important, it's the weather report. There are other methods, like sampling the sewage a community creates. We have to know where the trouble spots are so we can respond. It's like the map of battlefields in a war. We can't respond if we don't know where the outbreaks are, and right now, we don't.

Once an outbreak happens we lock that community down, the same way people would shelter if there were tornoados forecast or a blizzard, or fires like the ones they have in California and Australia. How long do they stay locked down? Until the outbreak is over. People need to be ready for this and that's accomplished through communication and trust. In the US our leaders are not trustworthy and they are removing channels of communication.

We need to isolate people who are infected. Sending them back to their family just means the family members are likely to get infected, feeding the outbreak.

In the US, none of this is working. We can't track outbreaks, there is no weather report. We can't isolate people who are infected. We're still at the beginning, more or less where we were in March, though the virus is distributed all around the country now. Most people don't know how dangerous the virus is. The communication field is flooded with lies from the government.

We're going to have to hit the wall repeatedly until the people understand how this works. Countries in Asia had an advantage, they had to deal with recent pandemics that never made it to the US, presumably because our health systems and political leaders kept us safe without us being aware. We can't seem to learn from their experience, we will have to go through it ourselves.

We're reopening because we don't know better. Our government included. There will be new spikes, more sickness, suffering, incapacity, death. The economy will go into a deeper recession, which will be harder to recover from.

14:07

Smart-adjacent [Seth's Blog]

You may have seen the miracle sudoku video that spread this week–a good sort of virus, one based on an idea. About half a million people have watched Simon spend nearly half an hour solving a puzzle. No anger, no violence, no innuendo. Merely applied thinking about numbers.

How did it spread?

There are millions of people who aren’t doing important medical research, creating (or solving) fascinating puzzles or writing breakthrough Broadway shows–but who are eager to find and amplify these ideas.

Culture is created by these amplifiers.

“People like us talk about things like this.” A good idea isn’t worth much if it doesn’t reach people who can benefit from it.

Instead of the quack doctor who goes on TV in a craven attempt to be famous at any cost, they’re willing to be the patient, thoughtful doctor who reads the research and shares useful information, even if the ratings aren’t as high. This is the long-term influencer who earns the trust of a small circle of people. Mostly, it’s people who care enough to model the behavior they’d like to see from those around them.

Three days ago, Google once again used its monopoly power and opaque methods to shut down a much-beloved podcast app for ridiculous reasons. Only the outcry from smart-adjacent voices got them to back down. We get what we talk about and we talk about what we pay attention to.

Or consider this 14-minute documentary about how Harley-Davidson has relentlessly made bad decisions in serving its customers. Nearly a million people have watched it (that’s as many as a typical cable TV show) because people who didn’t make it cared enough to spread it.

We keep seeing proof that cable news and other media don’t simply report the culture, they create it. Each of us now has our own microphone and network, and we get to decide what to program and what to consume.

It turns out that spreading the news about things that are smart is, in itself, smart.

13:39

Four short links: 21 May 2020 [Radar]

  1. Fuzzing: On the Exponential Cost of Vulnerability DiscoveryGiven the same non-deterministic fuzzer, finding the same bugs linearly faster requires linearly more machines. Yet, finding linearly more bugs in the same time requires exponentially more machines. Similarly, with exponentially more machines, we can cover the same code exponentially faster, but uncovered code only linearly faster. In other words, re-discovering the same vulnerabilities (or achieving the same coverage) is cheap but finding new vulnerabilities (or achieving more coverage) is expensive. This holds even under the simplifying assumption of no parallelization overhead.
  2. Code from Comments — Demo of a system that writes code based on a function signature and a comment. I’m always on the lookout for systems that automate code production, because they’ll be a big part of how we code in a few years’ time.
  3. C&C Open Sourced — EA are open-sourcing (GPL!) some Real-Time Strategy classics: Tiberian Dawn, and Red Alert. After discussing with the council members, we made the decision to go with the GPL license to ensure compatibility with projects like CnCNet and Open RA. Our goal was to deliver the source code in a way that would be truly beneficial for the community, and we hope this will enable amazing community projects for years to come.
  4. The Coming Death of Independent PodcastingFirst, Spotify is gaining power over podcast distribution by forcing customers to use its app to listen to must-have content, by either buying production directly or striking exclusive deals, as it did with Rogan. This is a tying or bundling strategy. Once Spotify has a gatekeeping power over distribution, it can eliminate the open standard rival RSS, and control which podcasts get access to listeners. The final stage is monetization through data collection and ad targeting. Once Spotify has gatekeeping power over distribution and a large ad targeting business, it will also be able to control who can monetize podcasts, because advertisers will increasingly just want to hit specific audience members, as opposed to advertise on specific shows.

11:35

CodeSOD: Checking Your Options [The Daily WTF]

If nulls are a “billion dollar mistake”, then optional/nullable values are the $50 of material from the hardware store that you use to cover up that mistake. It hasn’t really fixed anything, but if...

10:49

Pirate IPTV Reseller Boom Media Ordered to Pay $3.3m in Damages [TorrentFreak]

Last October, DISH Network filed a lawsuit in the United States targeting Boom Media LLC, a reseller of IPTV services sourced from a number of well-known ‘pirate’ suppliers.

Filed in a New York district court, the complaint also named John Henderson of New York and Debra Henderson of North Carolina as defendants, stating that the LLC was operated from John’s home (with him as the sole member) while his mother provided key support for the operation by receiving customer payments.

“The codes [DISH terminology for subscriptions] are designed and produced to enable a set-top box or other Internet-enabled device to access servers used to transmit DISH programming to customers of the MFG TV, Beast TV, Nitro TV, Murica Streams, Epic IPTV, Vader Streams and OK2 services,” the complaint read.

DISH claimed that subscriptions were sold to customers for between $10 and $20 per month with an option to buy a “pre-loaded” set-top box for $150. Boom Media’s sales efforts were high-profile, with DISH pointing to YouTube videos of John Henderson telling his customers that “[y]ou guys are buying pirated streams, this shit is not Hulu, it’s not Netflix, it’s pirated f**cking streams. It’s no different than buying f**king knockoff shoes. It’s black market shit.”

As reported in November 2019, John Henderson said he would take the case all the way to trial but to finance that he would need at least $250,000 in donations. In the end his fundraiser made just $1,029.

The case has simmered along in the background ever since but for all parties the show is now over after Boom Media and the Hendersons failed to mount a defense.

In a memorandum decision and order handed down yesterday by District Court Judge Mae D’Agostino, the Court found that the defendants violated Section 605(a) of the Federal Communications Act after they “retransmitted DISH Programming originating from DISH’s satellite communications to customers of the Services, or worked closely with others to do so.”

Additionally, the defendants were found liable under Section 605(e)(4), which makes it unlawful to distribute “any electronic, mechanical, or other device or equipment”, knowing or having reason to know that the device or equipment is primarily of assistance in the unauthorized decryption of direct-to-home satellite services.

“The Device Codes [IPTV subscriptions], which Defendants sold individually and preloaded onto a set-top box, were designed and produced for purposes of allowing access to the servers that support the Services, and thus are a ‘device; or ‘equipment’ for purposes of Section 605(e)(4),” the judgment reads.

Having established defendants’ liability in response to DISH’s request for default judgment, Judge D’Agostino turns to the question of appropriate damages.

Statutory damages of between $1,000 and $10,000 are available for each violation of Section 605(a) and up to $100,000 if the violation was committed willfully and for financial gain. Section 605(e)(4) allows for statutory damages of between $10,000 and $100,000 for each violation.

In the event, DISH sought statutory damages of ‘just’ $1,000 for each violation of Section 605(e)(4) but given that amount relates to each subscription, that figure was always set to explode. However, since DISH didn’t have access to enough information to put a precise figure on the number of subscriptions, it was forced to get creative.

Back in June 2019, John Henderson took to YouTube to complain that a credit card processor Boom used between February 2019 and May 2019 had refused to release $50,000 owed to Boom following the sale of IPTV subscriptions. Hoping to get revenge on the processor, he asked Boom subscribers to initiate chargebacks with their credit card issuers to get a refund, without risking the accounts they had with Boom.

“Defendants sold Device Codes [IPTV subscriptions] for an average price of $15.00 for each month of service. Accordingly, Defendant John Henderson’s statement that Defendants were waiting for $50,000 in payments owed to them for Device Codes previously distributed to customers is evidence of 3,333 Device Codes sold by Defendants,” the judgment reads.

“Given that Plaintiffs ‘are entitled to all reasonable inferences from the evidence they presented’ when seeking damages against a party in default…the Court finds that this number represents a fair approximation of the total number of Device Codes sold during this time frame (February through May of 2019).”

Multiplying 3,333 device codes by $1,000 damages per violation, the Court awarded DISH $3.33 million in statutory damages, with Boom Media LLC and John and Debra Henderson held jointly and severally liable.

The Court found this to be a reasonable amount, given that the $50,000 represented a fraction of Boom Media’s sales. Also, the Court acknowledged that DISH could’ve demanded much more, given the willfulness of John Henderson’s behavior generally and his comments posted to YouTube mentioning DISH.

Boom Media - Henderson comments

While DISH did not seek attorneys’ fees or costs, it did demand a permanent injunction.

The Court was happy to oblige, enjoining all defendants and anyone acting in concert with them from “conducting the Rebroadcasting Scheme, or otherwise receiving or assisting others in receiving DISH’s satellite communications or the television programming that comprises such communications without authorization from DISH.”

The Court also ordered the defendants to stop selling IPTV subscriptions granting unauthorized access to DISH programming.

The memorandum decision and order can be downloaded here (pdf)

From: TF, for the latest news on copyright battles, piracy and more.

10:22

Bill to allow broader and more absurd patents [Richard Stallman's Political Notes]

The greediest of US businesses are pushing a bill to allow broader and more absurd patents, even in medicine.

Patents do little good for society, and in some fields a lot of harm. They are especially harmful in agriculture, medicine and computing. All in all it would be better to eliminate patents entirely.

Thousands of Californian prisoners have Covid-19 [Richard Stallman's Political Notes]

Thousands of prisoners in California have Covid-19, and some are getting no medical care.

Bureau of Land Management doing the opposite of its job [Richard Stallman's Political Notes]

The saboteur in charge of the Bureau of Land Management is not only ordering it to do the opposite of its job. He is trying to make it fall apart.

A plan to put an end to Covid-19 in the US [Richard Stallman's Political Notes]

A plan to put an end to Covid-19 in the US, and reopen much of the economy, with lots of testing and tracing.

Feeds

FeedRSSLast fetchedNext fetched after
XML 04:44, Monday, 25 May 05:25, Monday, 25 May
a bag of four grapes XML 04:44, Monday, 25 May 05:26, Monday, 25 May
A Smart Bear: Startups and Marketing for Geeks XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Anarcho's blog XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Ansible XML 04:44, Monday, 25 May 05:24, Monday, 25 May
Bad Science XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Black Doggerel XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Blog – Official site of Stephen Fry XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Broodhollow XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Charlie Brooker | The Guardian XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Charlie's Diary XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Chasing the Sunset - Comics Only XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Clay Shirky XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Coding Horror XML 04:44, Monday, 25 May 05:31, Monday, 25 May
Cory Doctorow – Boing Boing XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Cory Doctorow's craphound.com XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Ctrl+Alt+Del Comic XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Cyberunions XML 04:13, Monday, 25 May 05:02, Monday, 25 May
David Mitchell | The Guardian XML 04:13, Monday, 25 May 04:56, Monday, 25 May
Debian GNU/Linux System Administration Resources XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Deeplinks XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Diesel Sweeties webcomic by rstevens XML 04:13, Monday, 25 May 04:56, Monday, 25 May
Dilbert XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Dork Tower XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Edmund Finney's Quest to Find the Meaning of Life XML 04:13, Monday, 25 May 04:56, Monday, 25 May
Eerie Cuties XML 04:44, Monday, 25 May 05:31, Monday, 25 May
EFF Action Center XML 04:13, Monday, 25 May 04:56, Monday, 25 May
Enspiral Tales - Medium XML 04:44, Monday, 25 May 05:29, Monday, 25 May
Erin Dies Alone XML 04:44, Monday, 25 May 05:31, Monday, 25 May
Events XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Falkvinge on Liberty XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Flipside XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Free software jobs XML 04:44, Monday, 25 May 05:24, Monday, 25 May
Full Frontal Nerdity by Aaron Williams XML 04:13, Monday, 25 May 05:01, Monday, 25 May
General Protection Fault: The Comic Strip XML 04:13, Monday, 25 May 05:01, Monday, 25 May
George Monbiot XML 04:13, Monday, 25 May 04:56, Monday, 25 May
Girl Genius XML 04:13, Monday, 25 May 04:56, Monday, 25 May
God Hates Astronauts XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Graeme Smith XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Groklaw XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Hackney Anarchist Group XML 04:13, Monday, 25 May 05:02, Monday, 25 May
http://calendar.google.com/calendar/feeds/q7s5o02sj8hcam52hutbcofoo4%40group.calendar.google.com/public/basic XML 04:44, Monday, 25 May 05:24, Monday, 25 May
http://dynamic.boingboing.net/cgi-bin/mt/mt-cp.cgi?__mode=feed&_type=posts&blog_id=1&id=1 XML 04:44, Monday, 25 May 05:29, Monday, 25 May
http://eng.anarchoblogs.org/feed/atom/ XML 04:44, Monday, 25 May 05:30, Monday, 25 May
http://feed43.com/3874015735218037.xml XML 04:44, Monday, 25 May 05:30, Monday, 25 May
http://feeds2.feedburner.com/GeekEtiquette?format=xml XML 04:13, Monday, 25 May 04:56, Monday, 25 May
http://fulltextrssfeed.com/feeds2.feedburner.com/uclick/doonesbury?format=xml XML 04:13, Monday, 25 May 04:56, Monday, 25 May
http://london.indymedia.org/articles.rss XML 04:44, Monday, 25 May 05:31, Monday, 25 May
http://pipes.yahoo.com/pipes/pipe.run?_id=ad0530218c055aa302f7e0e84d5d6515&amp;_render=rss XML 04:44, Monday, 25 May 05:30, Monday, 25 May
http://the-programmers-stone.com/feed/ XML 04:44, Monday, 25 May 05:31, Monday, 25 May
http://thecommune.co.uk/feed/ XML 04:44, Monday, 25 May 05:29, Monday, 25 May
http://ubuntuweblogs.org/atom.xml XML 04:44, Monday, 25 May 05:30, Monday, 25 May
http://www.airshipentertainment.com/buck/buckcomic/buck.rss XML 04:13, Monday, 25 May 05:02, Monday, 25 May
http://www.airshipentertainment.com/growf/growfcomic/growf.rss XML 04:35, Monday, 25 May 05:19, Monday, 25 May
http://www.airshipentertainment.com/myth/mythcomic/myth.rss XML 04:44, Monday, 25 May 05:26, Monday, 25 May
http://www.baen.com/baenebooks XML 04:35, Monday, 25 May 05:19, Monday, 25 May
http://www.dcscience.net/feed/medium.co XML 04:13, Monday, 25 May 05:02, Monday, 25 May
http://www.feedsapi.com/makefulltextfeed.php?url=http%3A%2F%2Fwww.somethingpositive.net%2Fsp.xml&what=auto&key=&max=7&links=preserve&exc=&privacy=I+accept XML 04:35, Monday, 25 May 05:19, Monday, 25 May
http://www.freedompress.org.uk/news/feed/ XML 04:13, Monday, 25 May 05:01, Monday, 25 May
http://www.steampunkmagazine.com/inside/feed/ XML 04:44, Monday, 25 May 05:25, Monday, 25 May
http://www.tinycat.co.uk/feed/ XML 04:44, Monday, 25 May 05:24, Monday, 25 May
https://hackbloc.org/rss.xml XML 04:44, Monday, 25 May 05:25, Monday, 25 May
https://kajafoglio.livejournal.com/data/atom/ XML 04:13, Monday, 25 May 05:02, Monday, 25 May
https://philfoglio.livejournal.com/data/atom/ XML 04:44, Monday, 25 May 05:31, Monday, 25 May
https://studiofoglio.livejournal.com/data/atom/ XML 04:44, Monday, 25 May 05:30, Monday, 25 May
https://twitter.com/statuses/user_timeline/22724360.rss XML 04:44, Monday, 25 May 05:24, Monday, 25 May
https://web.randi.org/?format=feed&type=rss XML 04:13, Monday, 25 May 04:56, Monday, 25 May
https://www.goblinscomic.com/category/comics/feed/ XML 04:44, Monday, 25 May 05:24, Monday, 25 May
https://www.hackneysolidarity.info/rss.xml XML 04:44, Monday, 25 May 05:29, Monday, 25 May
https://www.newstatesman.com/feeds/blogs/laurie-penny.rss XML 04:44, Monday, 25 May 05:25, Monday, 25 May
https://www.patreon.com/graveyardgreg/posts/comic.rss XML 04:44, Monday, 25 May 05:31, Monday, 25 May
https://www.rightmove.co.uk/rss/property-for-sale/find.html?locationIdentifier=REGION^876&maxPrice=240000&minBedrooms=2&displayPropertyType=houses&oldDisplayPropertyType=houses&primaryDisplayPropertyType=houses&oldPrimaryDisplayPropertyType=houses&numberOfPropertiesPerPage=24 XML 04:13, Monday, 25 May 04:56, Monday, 25 May
Humble Bundle Blog XML 04:44, Monday, 25 May 05:31, Monday, 25 May
I, Cringely XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Irregular Webcomic! XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Joel on Software XML 04:44, Monday, 25 May 05:30, Monday, 25 May
Judith Proctor's Journal XML 04:44, Monday, 25 May 05:24, Monday, 25 May
Krebs on Security XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Kubet24h XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Lambda the Ultimate - Programming Languages Weblog XML 04:44, Monday, 25 May 05:24, Monday, 25 May
LLVM Project Blog XML 04:44, Monday, 25 May 05:29, Monday, 25 May
Looking For Group XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Loomio Blog XML 04:44, Monday, 25 May 05:30, Monday, 25 May
LWN.net XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Menage a 3 XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Mimi and Eunice XML 04:44, Monday, 25 May 05:29, Monday, 25 May
Neil Gaiman's Journal XML 04:44, Monday, 25 May 05:24, Monday, 25 May
Nina Paley XML 04:44, Monday, 25 May 05:31, Monday, 25 May
O Abnormal – Scifi/Fantasy Artist XML 04:44, Monday, 25 May 05:29, Monday, 25 May
Oglaf! -- Comics. Often dirty. XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Oh Joy Sex Toy XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Order of the Stick XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Original Fiction – Tor.com XML 04:44, Monday, 25 May 05:26, Monday, 25 May
OSnews XML 04:44, Monday, 25 May 05:29, Monday, 25 May
Paul Graham: Unofficial RSS Feed XML 04:44, Monday, 25 May 05:29, Monday, 25 May
Penny Arcade XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Penny Red XML 04:44, Monday, 25 May 05:29, Monday, 25 May
PHD Comics XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Phil's blog XML 04:13, Monday, 25 May 05:01, Monday, 25 May
Planet Debian XML 04:44, Monday, 25 May 05:29, Monday, 25 May
Planet GridPP XML 04:44, Monday, 25 May 05:31, Monday, 25 May
Planet Lisp XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Pluralistic: Daily links from Cory Doctorow XML 04:44, Monday, 25 May 05:24, Monday, 25 May
Property is Theft! XML 04:44, Monday, 25 May 05:24, Monday, 25 May
PS238 by Aaron Williams XML 04:13, Monday, 25 May 05:01, Monday, 25 May
QC RSS XML 04:44, Monday, 25 May 05:31, Monday, 25 May
Radar XML 04:44, Monday, 25 May 05:26, Monday, 25 May
RevK®'s rants XML 04:44, Monday, 25 May 05:30, Monday, 25 May
Richard Stallman's Political Notes XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Scenes From A Multiverse XML 04:44, Monday, 25 May 05:31, Monday, 25 May
Schneier on Security XML 04:44, Monday, 25 May 05:24, Monday, 25 May
SCHNEWS.ORG.UK XML 04:35, Monday, 25 May 05:19, Monday, 25 May
Scripting News XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Seth's Blog XML 04:44, Monday, 25 May 05:30, Monday, 25 May
Skin Horse XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Starslip by Kris Straub XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Tales From the Riverbank XML 04:13, Monday, 25 May 05:02, Monday, 25 May
The Adventures of Dr. McNinja XML 04:44, Monday, 25 May 05:29, Monday, 25 May
The Bumpycat sat on the mat XML 04:44, Monday, 25 May 05:24, Monday, 25 May
The Command Line XML 04:44, Monday, 25 May 05:30, Monday, 25 May
The Daily WTF XML 04:44, Monday, 25 May 05:30, Monday, 25 May
The Monochrome Mob XML 04:44, Monday, 25 May 05:25, Monday, 25 May
The Non-Adventures of Wonderella XML 04:13, Monday, 25 May 04:56, Monday, 25 May
The Old New Thing XML 04:35, Monday, 25 May 05:19, Monday, 25 May
The Open Source Grid Engine Blog XML 04:44, Monday, 25 May 05:31, Monday, 25 May
The Phoenix Requiem XML 04:44, Monday, 25 May 05:24, Monday, 25 May
The Rogues Gallery XML 04:13, Monday, 25 May 05:01, Monday, 25 May
The Stranger, Seattle's Only Newspaper: Savage Love XML 04:44, Monday, 25 May 05:29, Monday, 25 May
TorrentFreak XML 04:13, Monday, 25 May 04:56, Monday, 25 May
towerhamletsalarm XML 04:44, Monday, 25 May 05:30, Monday, 25 May
Twokinds XML 04:44, Monday, 25 May 05:26, Monday, 25 May
UK Indymedia Features XML 04:44, Monday, 25 May 05:26, Monday, 25 May
Uploads from ne11y XML 04:44, Monday, 25 May 05:30, Monday, 25 May
Uploads from piasladic XML 04:13, Monday, 25 May 04:56, Monday, 25 May
Use Sword on Monster XML 04:44, Monday, 25 May 05:31, Monday, 25 May
Wayward Sons: Legends - Sci-Fi Full Page Webcomic - Updates Daily XML 04:44, Monday, 25 May 05:30, Monday, 25 May
What If? XML 04:44, Monday, 25 May 05:25, Monday, 25 May
Whatever XML 04:13, Monday, 25 May 05:02, Monday, 25 May
Whitechapel Anarchist Group XML 04:13, Monday, 25 May 05:02, Monday, 25 May
WIL WHEATON dot NET XML 04:35, Monday, 25 May 05:19, Monday, 25 May
wish XML 04:44, Monday, 25 May 05:29, Monday, 25 May
xkcd.com XML 04:13, Monday, 25 May 04:56, Monday, 25 May