Karl Auerbach

@irene@discuss.systems - I took a look at your note "Slow Software". I felt that the general notion was quite rational - separating high impact code (and thus give it more care) from lesser impact code. I do testing - I break code. And I've noticed an increasing tendency of builders to presume ever-faster underlying processing, memory, and network resources. I work with the latter - network services going bad. I am seeing more and more code begin to break on low performance platforms - such as cheap Chromebooks - because the code being run presumes vast network resources rather than things like slow connections, intermittent connections, and support for only a few TCP connections at a time. This is exaberated by the new generation of "proof of work" challenges being presented to incoming clients in order to cull bots from humans. An exaple is Apple's Music App - it goes bad, often for quite a while, when the underlying network changes, such as when getting into a car and thus switching from wi-fi to 5G.

This headline ought to have been: "Texas Defunds Police" Instead of: "Texas police department ordered closed for failing to provide any benefit to community" https://www.theguardian.com/us-news/2026/sep/15/trinidad-texas-police-department-disbanded

It concerns me that so many in Congress feel that impeachment is a criminal law process subject to the same procedural and substantive limitations as our criminal law, or that impeachment may only be for crimes enumerated by our Federal and state laws. That is not true. Impeachment by the House and Trial/Conviction in the Senate are not criminal procedures. Indeed, our Constitution clearly allows for post-impeachment criminal and civil actions. Impeachment & Trial/Conviction are *political* processes bound by the vagaries of "due process" and our own ethical values. Impeachment is a political act. It would be completely within our Constitution to impeach/convict a Federal officer for "skylarking with intent to gawk" - which is not a crime (except perhaps in Texas.) The Constitution does not define "high Crimes and Misdemeanors" - that is because those are intended to be subject to political winds and the ethics of a given time. This is particularly necessary given SCOTUS grants of royal immunity.

@ghouston@mamot.fr @vanzick@mastodon.social @jwildeboer@social.wildeboer.net Rather than deleting top level domains, it can be much more "fun" usurping their contents, perhaps by taking over some root servers. By-the-way, people forget that of the 13 root server clusters, the US gov't operates something like four of those 13. That's enough to do some "interesting" stuff. I wrote a bit about that 20 years back... "What Could You Do With Your Own Root Server?" https://www.cavebear.com/old_cbblog/000232.html

I have been an opponent of the death penalty. Not because I feel that such punishment is unethical - I understand and often share the sense of utter revulsion that people have toward such criminals. I base my opposition on the fact that we spend far too much time (and resources) in courts in a never-ending dance against actually carrying out the penalty. Life without the possibility of parole is a good substitute. But here is a case and person about which I would have absolutely no objection to capital punishment. "Trump ally Stephen Miller leads sweeping push to accelerate removal of migrant children" https://www.theguardian.com/us-news/2026/sep/19/stephen-miller-trump-migrant-children

Here is an article well worth reading ... read all of it. I have similarly come to the conclusion that domestic white nationalist christendom is the greatest danger that our nation faces. "‘A Bible-sized blind spot’: congressman sounds alarm on rising Christian nationalism" https://www.theguardian.com/world/2026/aug/26/jared-huffman-rising-christian-nationalism-no-prophets-book

How many authenticator apps do I need?

I've got:

• Google Authenticator on my iPhone/iPads

• Authy (on some platforms)

• 2Stable

• RSA Authenticator (which seems incompatable with the Google one)

And now ID.me wants me to download their authenticator app.

Hey guys, can't we just have ONE standardized time-based authenticator that runs on Windows, Android, MacOS, iphone OS, iPad OS, Linux, and maybe *BSD?

And also, not cost $50/year - I'm looking at you 2Stable.

@gemelen@mammut.moe I found Ente Auth and so far it is working great on Mac OS. I'll try to add Linux and IOS tomorrow.

@gemelen@mammut.moe I just tried bitwarden, both the vault and the authenticator. They are clearly designed for Apple IOS or Android and are, for me, a big fail on MacOS (unless, perhaps, I buy the $$ monthly version.) I have now had it nailed into my head that when I set up a OTP that I need to save *both* the QR code *AND* the textual form. It appears that other OTP apps have trouble scanning the QR code generated by Google's authenticator's "transfer" function. Unfortunately for my existing OTP stuff I saved neither the QR nor the textual string. I couldn't believe how bad the OTP key extraction tool that people reference from Github is ... Just to compile it took more than two gigabytes of downloaded packages on my Fedora 44 system. And then it failed.

Wow, the Apple MacOS update to MacOS 27 is 26.5Gbytes. 26.5Gbytes!

@aka_pugs@mastodon.social When we gathered for a very early Unix users meeting (mid 1970s) at UC Santa Barbara the sign for the meeting read "Eunuchs Meeting".

@ufwupdates@union.place That is a very nice painting. And my thanks to all of the people I see working in the fields nearly every day (near Watsonville.)

I agree. There are so many who read our Constitution's supremacy clause incorrectly. Federal law is supreme only in those areas in which the Federal government has authority. Yet the 9th, 10, and Preamble make it clear that the scope of that Federal authority is limited. And all of the rest falls to the states and the people. Thus Hawaii - and every other state - has the right and power to tell SCOTUS to take a flying leap at a rolling donut when the matter in question is subject to State law and not Federal jurisdiction. "One Judge Has the Guts to Put the Horror of This Supreme Court Term in Context" https://slate.com/news-and-politics/2026/07/one-judge-supreme-court-horror-show.html

Who owns that 747 Bribe-plane? If it is owned by the US Federal government then trump doesn't get it when he leaves office, nor does his library, except perhaps as a loan. If it is owned by trump or his library there is a matter of things like income and property taxes. And why would the US spend $400,000,000 "upgrading" private property? And why is private property being used to ferry the US President hither and yon? And who is paying for fuel and maintenance and parking for that private airplane - taxpayers. All in all, were I the next Prez I'd seize *all* of trump's assets under the claim that it is government property.

When I was designing office support systems and networks for a rather large bank we had a cardinal rule: Never break the user's train of thought! I am amazed at how bad, even with massive increases in computer and network horsepower, that that role is broken with an almost virulent violence.

Saw an utterly wonderful production of MacBeth last night at Santa Cruz Shakespeare. I think they did the full text without major edits. The sets were minimalist - which is important these days when live theatre is struggling. Yes, it is Elizabethan-era English, but with the good acting and articulation, it's rather easy to understand. It runs through the end of August. (It's an outdoor venue and can get quite chilly.) There are several other plays going on in rep this summer - we are particularly looking forward to Private Lives. They also do "pay what you can" nights and have free staged readings of other plays - I really like the staged readings. https://santacruzshakespeare.org/performances/macbeth/

Another of the rules I'd put into place should I ever wake up to discover that I've become Emperor of the Universe... The Rule Against Digital Perpetuities: No Digital Rights Management (DRM) limitation or anti-copying mechanism may endure longer than the original copyright in the protected work. The Pledge: I pledge to neither specify nor standardize nor implement any system that does not conform to the Rule Against Digital Perpetuities. https://www.cavebear.com/old_cbblog/000272.html

Well, now that JD Vance is moving to the northern Virginia suburbs (a gated area I presume) he won't be using his official government provided residence at the Naval Observatory in DC. So they ought to open that DC house - it's kinda nice - to homeless families.

@vanzick@mastodon.social @jwildeboer@social.wildeboer.net Country code top level domains are generally considered somehow part of the sovereign aspects of a country as opposed to the more generic top level domains. That, however, leaves us wondering things like why .su (Soviet Union) still exists and why each state in the EU gets a ccTLD (while each state in the US does not.) Then there is my own top level domain proposal designed to break many of ICANN's rules: https://cavebear.com/eweregistry/

And my final (perhaps) ex cathedra bull (based on the possibility that I did wake up as Emperor of the Universe this morning but failed to notice): The pledge: I pledge to vote for no Republican candidate for any office - whether local, state, or federal - in any election held before 2037.

OK, if el trump wants to put tariffs on Canadian smoke then the rest of the world can impose tariffs and taxes on Starlinks' sky pollution and also that now approved system of big solar reflecting satellites. "Trump threatens to tariff Canada over wildfire smoke choking northern US cities" https://www.bbc.com/news/articles/cwyq93j34lgo

@mattblaze@federate.social @divVerent@misskey.de @alyx_woodward@universeodon.com Here in California our primaries tend to have many different ballots. When a voter checks in we verify the party registration records (and here in California voters can be independent of any party) and hand them the proper paper form ,,, or ... if they chose to use a ballot marking device, that device is configured to present the proper ballot to the voter. All of this is done with human oversight backed by paper registration records - voters don't get to pick which kind of paper ballot they get and they are not allowed to muck with the machines to chose which ballot they will vote. California does allow a lot of registration changes to made at the voting locations, but that generally involves a phone call and interaction with people at the central county clerk's office. I'd also mention that a lot of people who have various physical issues - such as bad eyesight, or my issue with holding a pen or pencil - prefer the ballot marking machines over hand marked paper.

Saudi Arabia with nuclear material that could readily be made into a dirty bomb and with a bit more work made into a Hiroshima style bomb. What a concept. Not a concept that fits well with the fact that most of the 9/11 hijackers were Saudis, as was Osama bin Laden. Not a concept that fits well with a country built around a ultra-fundamentalist religious system. Trump is a coin-operated marionette; whoever inserts enough coin gets to pull Trump's strings. And the Saudi's have probably inserted some very large coins into Trump's (or Kushner's) piggy bank to obtain this nuclear gift. "US announces nuclear deal with Saudi Arabia that could enable kingdom to enrich uranium" https://www.theguardian.com/us-news/live/2026/jul/22/us-politics-trump-arizona-primary-andy-biggs-hegseth-mamdani-netanyahu-latest-news-updates

I think we can pretty much conclude that it is the policy of the government of Israel to commit ethnic cleansing. I make a strong distinction between the people of Israel and the government of Israel. The people of Israel deserve to have their sovereign country, peaceful and secure My point about ethnic cleansing applies to the government of Israel not to its people (although some clearly support that goal.) I also believe that the Palestinians deserve their own country, peaceful and secure. "Israeli ministers announce plans for new illegal settlements in Gaza and West Bank" https://www.theguardian.com/world/2026/jul/18/israel-plan-new-illegal-settlements-gaza-west-bank-occupied-palestine

RE: https://mastodon.social/@jeffjarvis/116925266896337349 I agree with this - There is no reason to broadcast trump's rantings live, in real time. They can be captured and posted on places like youtube for later viewing. But why elevate what we know in advance will be lying propaganda? By-the-way, can the media stop posting billions of photos of trump - we all know what he looks like. Perhaps use a single image - using the old "hedcut" formats that were used by the Wall St. Journal. And let's stop endowing trump with the definitely not earned honorific title "Mr. President". Just call him "Donny". https://en.wikipedia.org/wiki/Hedcut

@mattblaze@federate.social During one hearing, a Senator got uppity with me - he was very condescending. I found a good way to shut him down - essentially using the Crocodile Dundee style of topic expansion to reverse condescend - i.e. by using the ""that's not a knife - *this* is a knife" approach. He got really ticked off. But I didn't mind; he was a jerk anyway and I was glad when he washed out on his bid to be President. My approach to testifying was to do as much work as possible beforehand with congress-critter staff to make sure we are speaking the same language - which is especially important when the topic is technical (or medical). This same approach works well with journalists. Sometimes this preparation can take months or even years. (I once got my company's DC lobbyist really angry at me because I was getting better access to various Senators than he did.)

For those among us who aspire to revive "the good old days" this little book should be required reading... "The Good Old Days: They Were Terrible!" (And yes, it is that Otto Bettmann, of the archives.) https://m.media-amazon.com/images/I/81ZinsA41VL._SL1375_.jpg

@SteveBellovin@infosec.exchange @spaf@mstdn.social Oy, the two great griefs of using statistical methods: The grief of defining the sample and then the grief of actually collecting it. On that second point, my mother and grandmother both worked for Princeton Research - Gallup Poll. I remember the complex methods that were defined for them to go forth and gather interviews and surveys - and how impossible it was for them to actually put that into accurate practice on the ground in the field. The in-the-field sampling problems are immense. E.g. sampling in an orthodox Jewish area will give significantly different results if taken on a Thursday vs a Saturday. And whether a husband is at home and listening or at work can greatly alter responses from work-at-home women (housewives.)

@tychotithonus@infosec.exchange I have trouble accepting anything rooted in a country code top level domain (ccTLD), such as .me or .it, as being secure for use identifying people in the US. ccTLD domains are effectively controllable by the political forces in the country they represent. Some countries have delegated operation of their ccTLD to private operators. (ccTLDs are run, to the main, reasonably well. I am speaking here of possibilities not necessarily present realities.) Because DNS queries typically contain the entire set of DNS labels, it is possible for a ccTLD operator to capture nearly all queries to that ccTLD (by setting very short TTL values) and feeding controlled (or manipulated) answers (even with DNSSEC enabled.) I wrote a bit about this twenty years ago, but more about root servers than ccTLD servers. "What Could You Do With Your Own Root Server?" https://www.cavebear.com/old_cbblog/000232.html

Ah Thunderbird (for email, mine is the Mac OS version) ... Mozilla foundation - do you ever test anything? Since the last update pretty much every sending of email ends up with a "filter complete" pop up that indicates that it is still trying to write the copy into my sent folders. (This happens with both Rackspace and Fastmail as mail providers.)

@cwgrody@mastodon.sdf.org I've had to abandon perfectly good (and expensive) test equipment. Why? The equipment was still completely usable - but only if one retained a laptop to control it, with that laptop running Windows 2000. Why? Because the equipment used the SSL/TLS security layer over TCP for its web control interface. SSL/TLS use "message digest" algorithms to check whether the data valid and authentic. But the Internet standards bodies have essentially written off use of the message digest algorithms used by my test gear, so modern browsers do not implement those algorithms, thus preventing me from using my gear except via ancient laptops that I've preserved. I am expecting this kind of problem to increase as Internet of Things devices get more deeply deployed for very long term use (decades) in very hidden locations.

Uh, this is ambiguous - did Blanche also withdraw the part giving the trumps immunity from tax audits (and thus effectively from paying taxes)? That immunity is what El Cheato really cares about. "Holdout senators back Blanche for AG after he formally withdraws Trump fund plan" https://www.bbc.com/news/articles/c3w05gx32d4o

@spacerog@mastodon.social My father fought a similar battle with Sony - he repaired TV's and often encountered a TV that could be repaired for a few cents but that Sony required an expensive replacement module. My father sued on behalf of TV repair people in California (and won.)

@tallship@public.mitra.social @tychotithonus@infosec.exchange Taking a bit of a detour - I remember when the ccTLDs were new. The folks who handled .TV set forth on an expedition to climb the tallest peak in Tuvalu. So they gathered their North Face and other mountaineering gear, down jackets, crampons, and ice axes and set forth to climb. And climb they did - to the peak of the highest point in Tuvalu - 15 feet above sea level.

Regarding a requirement for voter id: Voter ID is not a stupid idea. The trouble comes not from the ID itself (unless that ID becomes a national identity card). Rather the trouble comes from the difficulty in obtaining that ID, especially for poor people, young people, people who have trouble in remote locations or who have limited abilities to go to DMV offices or the like, or minorities. My sense is that the D-party is taking the wrong tack on voter ID (although the SAVE act methods of voter ID are repugnant and should be opposed.) Were I Emperor of the D-party would would spend less effort fighting the concept of ID and more on finding a good way of getting such ID's into the hands of eligible voters. By-the-way, my state, California, has a fairly nice voter rights policy: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=ELEC&division=2.&title=&part=&chapter=5.&article=

@warandpeas@mastodon.social Where's the Edith Piaf musical overlay?

Oh the judges on SCOTUS are concerned about security, even though they each have several full time bodyguards. They want more protection - from us. I would consider their concerns to have a lower priority than guaranteeing the security of people from our roving, masked death squads that we call ICE/CBP. Perhaps SCOTUS could open the bargaining by eliminating "Qualified Immunity" of police? "US Supreme Court seeks major boost in security funding over threat increase" https://www.bbc.com/news/articles/crkvkjddjd7o

Lauren W. has noted that trump is spending tends of thousands on taxpayer dollars on huge banners bearing his face that are hung from public buildings in DC. (Those banners do smack of the huge banners that were hung by Fascists, Nazis, and other dictators over the span of the 20th century.) The image on those banners is similar to his mug-shot. As a copyright lawyer that raised a question in my mind - Is trump (or the government) violating the copyrights of whoever took the original mug shot? Or is the banner image a new work? https://newrepublic.com/post/212990/trump-spending-giant-banners-face-federal-buildings-dc

@Alice@beige.party An American Warehouse in London? Oh my. Is its hair perfect? https://www.youtube.com/watch?v=qae25976UgA

A Firefox, the browser that is trying to commit suicide by becoming increasing incompatible and failing some rather basic functions. So what did I hit today? Printing. I have a website (using Grav as the foundation) that has some long-ish pages. Firefox prints only the first page. Chrome and Safari print the whole thing. This is apparently a known problem with Firefox.

@BrideOfLinux@mastodon.opencloud.lu Don't forget that under US Federal law your emails stored on an email-provider can be read/copied, without warrant, after 180 days: "Under ECPA, it is relatively easy for a government agency to demand service providers hand over personal consumer data stored on the service provider's servers. Email that is stored on a third party's server for more than 180 days is considered by the law to be abandoned. All that is required to obtain the content of the emails by a law enforcement agency is a written statement certifying that the information is relevant to an investigation, without judicial review." https://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act

@SteveBellovin@infosec.exchange All of these handwavings by Blanche and others reminded me of a line (quoted below) from a play I saw the other night because it essentially leaves the door open to similar self-to-self pay-out and tax immunity agreements while also leaving trump et fils with prodigious tax immunity, even if limited only to past tax evasions. It is a tale Told by an idiot, full of sound and fury, Signifying nothing.

@kcarruthers@infosec.exchange Which Russian asset in the White House are you thinking of?

Over the last 250 years Congress has been incredibly stupid by passing laws that do not self-destruct (i.e. require re-passage) after a period of time.) Those ancient laws have become land mines or weapons in the hands of a stupid vindictive president like trump. https://www.axios.com/2026/07/21/trump-smoot-hawley-tariffs-canada

@annehargreaves@ioc.exchange What means do they use in the UK to create an initial trustworthy binding between the human and the ID card? Here in the US that often requires a visit along with various ancillary identity-supporting materials (ranging from passports to utility bills). That visit often only needs to be made once - from that point on renewals tend to be easy. (Renewals are useful because people age and look different, and it is useful to have some means to "garbage collect" IDs when people move away or die.)

What a stupid idea.... "Google Search testing forcing searchers to sign in to get more search results" I propose that each of us create several fantasy Google accounts (or resurrect accounts previously used by dead people) and then we quietly exchange the credentials. https://searchengineland.com/google-search-testing-forcing-searchers-to-sign-in-to-get-more-search-results-484223

@BruceMirken@mas.to I am all for the California one-time tax on $billionaires. (Proposition 40). However, one of the Google Guys (and others) has cleverly put up two counter-initiatives (Propositions 41 and 42) that have merit but also carry poison pills to defeat the $billionaire tax even if it passes. So, I will be voting YES on Prop 40 but also voting NO on Props 41 and 42. https://calmatters.org/california-voter-guide-2026/propositions/

@CassandraVert@indieweb.social @aka_pugs@mastodon.social I never attended UC Santa Barbara (although my sister had a lab there.) For the Unix users meeting we drove up from Santa Monica for the day.

@deFractal@infosec.exchange I am thinking that such legal language could be really difficult. My sense is that we would want to allow certain image manipulations - such as color balance or dust removal. (My own skills at color balance are below abysmal, so I look at tools that do that as wonderfully assistive forms of magic.) Could cropping, creative lighting, or even compositional posing of a photo be considered improperly manipulative? Also, I saw someone mention that because many animals see a different range of color/frequencies than we humans do that image processing that constrains or changes non-human visible colors might be either "interesting", "objectionable", or "a new way to do steganography.

Here's something that may be a rather in-demand job for the post Trump/MAGA era: Forensic accountant (Not to be confused with a forensic anthropologist.)