Daily Tech News 8 August 2021

Top Story

• Scenes from the Sydney lockdown.
  

  Is this the harshest lockdowns @GladysB & @BradHazzard keep telling us about? Look at the suffering in their faces… pic.twitter.com/cHHUwr6EVk

  — Luke P Gavin (@LukePGavin) August 7, 2021

  
  My American friends might ask why we're not marching in the streets over this. Well, we are, in our own way.
  
  The little dog is emblematic of how Australian voters deal with government overreach.
  
  (I'm not convinced this is a recent photo. Not sure it's not, either. It's winter here, and it's chilly today, but we just had a couple of warm days so.... Maybe.)
  
  
  
• Another tame Apple press outlet weighs in and it's not good for Apple. (Tidbits)
  
  The writers go out of their way to afford Apple every courtesy, and still find themselves in line with the company's harshest critics:

  Apple's head of privacy, Erik Neuenschwander, told the New York Times, "If you're storing a collection of C.S.A.M. material, yes, this is bad for you. But for the rest of you, this is no different."
  
  Given that only a very small number of people engage in downloading or sending CSAM (and only the really stupid ones would use a cloud-based service; most use peer-to-peer networks), this is a specious remark, akin to saying, "If you're not guilty of possessing stolen goods, you should welcome an Apple camera in your home that lets us prove you own everything."

  Some readers are still drinking the Flavor Aid and one of the writers pushes back firmly in the comments:

  Correct. We don't know anything except they're building a system that they entirely control, offer no transparency into, and will not allow outside audits of.

  A system that is designed specifically to spy on children.

  The best way for totalitarian governments to implement surveillance is on the back of systems that people all agree are necessary.

  The most dangerous phrase in the world is "trust me."

  The tame Apple press can bark after all.
  
  
• Let me explain. No, there is too much. Let me sum up.
  

  It’s hard to not roll your eyes when it’s been the go-to excuse for privacy violations since the 90’s. It’s always ”save the children” with no real plan how it will actually help, next it’s stop the terrorists. After that comes stop the copyright violators. Always.

  — Fredrik (@fredhrson) August 7, 2021

  
  
  

Tech News

• Still pissed off about my dead HP Spectres. New laptop should arrive tomorrow though - the Dell Inspiron 14 7000.
  
  And I'll likely be getting an Inspiron 16 Plus as well. They're pretty much Dell's equivalent of the MacBook Pro 13" and 16" models - exactly the same screen resolutions and close to the same weights, though the 14" Dell is actually a few ounces lighter than the 13" Mac. Probably has worse battery life, but that's not the deciding factor for me.
  
  The Inspiron 16 is faster than my current desktop and will be my desktop system - plugged into a couple of 27" monitors - until graphics cards become affordable or there's a game more demanding than Minecraft that I want to play.
  
  
  
• Stop putting numeric keypads on gaming laptops, dammit. Or at least offer some with a sane keyboard layout, like HP.
  
  Gigabyte has some models that are priced similarly to the Inspiron 16 but with better specs - RTX 3070 and 4K OLED screen. But the Dell is 40% off and much easier to get sign-off on for a company purchase.
  
  If the Gigabyte had a sensible keyboard layout though, I might buy it with my own cash.
  
  
  
• You can now expand the storage on the PlayStation 5 you don't have because it's not available anywhere. (Tom's Hardware)
  
  You need a high-end PCIe 4.0 M.2 NVMe SSD, with a minimum read speed of 5.5GB per second. And a heatsink, since the expansion slot isn't cooled by the PS5's fan. But the Samsung 980 Pro was tested and works fine, loading as fast as the integrated storage, and writing much faster.
  
  Write speeds were probably not a priority when Sony designed the PS5 - even if you have gigabit internet and are downloading at full speed, the cheapest SATA SSDs from 2015 would cope just fine.
  
  
  
• EVGA is pushing a firmware patch for its GeForce RTX 3090 FTW3 graphics cards. (WCCFTech)
  
  These are the ones most often cited as being killed by Amazon's game New World. Problems extend to other Nvidia cards and even some AMD ones, but the 3090 and specifically EVGA 3090 cards are hardest hit.
  
  
  
• If your EVGA card has already died and you need a replacement right away, you might be in for a bad time. (WCCFTech)
  
  They asked for a deposit of €1,728.20 to replace a 3080. Which is double MSRP for the card itself.
  
  
  
• Why CAPTCHA photos are so unbearably depressing. (Clive Thompson)
  
  If we ever get general AI and put it in an autonomous vehicle, it will probably commit suicide.
  
  
  
• If you have one of the listed WiFi routers, either patch it right away or yeet that sucker straight out the window. (Bleeping Computer)
  
  The list includes models distributed by Verizon and Telstra so it might not even be one you bought yourself.
  
  
  
• Go and Rust are vulnerable to that weird mixed octal/decimal IP address thing. (Bleeping Computer)
  
  The problem is, decades ago when octal was still in use - I'm old enough to have seen an octal core dump, but I've never used one in anger - someone had the bright idea that the addresses 127.0.0.1 and 0127.0.0.1 would go to entirely different locations.
  
  It was never much used and pretty much all software gets it wrong. Except routers, which follow the spec to the letter and will send your packets to somewhere you never expected.
  
  
  
• It doesn't matter how secure your hashing algorithm is if your password is 123. (ZDNet)
  
  So... Don't do that.
  
  
  
• To sum up, again:
  
  Elasticsearch built a search server, based on the open source Lucene library, and released it as open source. So far, so good.
  
  They reserved certain features for paying customers. Okay, gotta make a living.
  
  This reservation extended to even the most basic security mechanisms, so anyone using the free version was left completely open to attack. And this led to a whole string of data breaches. I was reporting on them weekly for a year. Not so good.
  
  Amazon came along and offered their own paid Elasticsearch-as-a-service, even calling it Elasticsearch, which Elasticsearch had trademarked. Also not good.
  
  Elasticsearch responded by changing the licensing of their code so it was no longer open source. Double plus ungood.
  
  Amazon responded by taking the last open source release of Elasticsearch, forking it, and releasing it as OpenSearch. This is kind of a jerk move given where Amazon started out, and would have been better received if another party had done it, but here we are.
  
  Elasticsearch responded by breaking API compatibility so that code libraries for Elasticsearch no longer work with OpenSearch. (The New Stack)
  
  Elasticsearch uses semantic versioning - supposedly. Moving from 7.13 to 7.14 can add new features and can certainly fix bugs, but shouldn't break your code. They've always been bad at sticking to that, but this time the sole purpose of the update was to break things.
  

  Kudos to @elastic for making us all collateral damage in its war with @awscloud. It's my bad for pinning dependencies as >=7.0.0,<8.0.0 and getting this update automatically on a deploy. But still, pretty crappy to break the ES python package for anyone using AWS. #elasticsearch pic.twitter.com/Vb5VatOXdl

  — Brad Root (@amiantos) August 4, 2021

  
  
  And now Amazon has responded by forking the API clients as well to restore compatibility.
  
  It takes talent and determination to make Amazon look like the good guy. Congratulations, Elasticsearch.
  
  Curiously enough I was recently talking to one of the original developers of Lucene and he apologised to me when I mentioned using Elasticsearch extensively. But it's not Lucene I have a problem with.
  
  
  
• A network of 350 fake accounts has been spreading Chinese propaganda. (BBC)
  
  Tree fiddy, you say?