10 interesting stories served every morning and every evening.
I’ve used Windows for as long as I’ve been alive. At 6 years old, my first computer was a Windows 98 machine, with an Athlon XP 1900+ (Palomino core) and a GeForce 440 MX, blessed with a generous 256 megabytes of RAM.
Looking back, I kinda got scammed with that graphics card, but what could I do? I was a silly kid. (The missing shader support came back to bite me in the ass)
Also, is it weird that I still remember the specs of my first computer, 22 years later?
Anyway, Windows has been familiar and comfortable. I knew all the workarounds and how to extract maximum efficiency from it.
I was a happy user, for over 20 years, and Windows has been my go-to for everything computer-related.
Even after becoming a software developer and using a macbook, I’d still find myself reaching for Windows at times.
That is, until Microsoft decided to turn it into something completely unrecognizable and unusable.
I think it started with the Windows 10 full-screen ads.
You know, those friendly suggestions telling you to try OneDrive or to “use the recommended browser settings” (reads as “please try Edge and OneDrive, we’re desperate”).
Actually, scratch that, I think it really started with the non-consensual updates:
Oh you’re doing work? That’s so cute… we’re gonna close whatever apps you had open, because we’re updating now. We own your computer.
You had unsaved work? Too bad, it’s gone, get bent.
At first I ignored it, and carried on as normal. Sure, I’d get mad from time to time and I’d complain.
But hey, nothing beats the convenience of being able to have all of your applications in one place
My breaking point came with the 24H2 update. It installed on my system without my consent, like any other major update. I knew there were problems with it, people were already complaining on Reddit, so I just postponed it, and kept postponing it.
All it took was for me to leave my computer on and unattended for a while, and BOOM, just like that - the major OS update that nobody wanted, it was on my computer.
As soon as 24H2 landed on my machine, I encountered a bug so bizarre I thought I was losing my marbles.
If Chrome was positioned under any other window, it would start having what I can only describe as a visual seizure.
Here’s Ableton Live with Chrome (Reddit) under it:
Worse, there was a decent chance this would trigger a full system lock, leaving me smashing my desk in impotent rage. I shit you not.
I tried to rollback. The rollback failed with an error. I reinstalled Windows. The bug persisted.
Like digital herpes, I just couldn’t get rid of it.
The solution? Installing an Insider build. Yes, the solution to Microsoft’s broken stable release was to use their unstable release.
For the Windows Defenders (see what I did there?), I tried uninstalling the display drivers with DDU, and testing other versions. It didn’t help.
Either I stayed forever on the older build, or I’d have to deal with this. And don’t tell me to forever disable updates, I’ll completely lose it.
The Insider build worked…sort of. But now I had a new bug: Chrome would randomly lock up for about 30 seconds when a video was playing. My options were to wait it out or press Ctrl+Alt+Delete and Esc to force my way back to a working browser. After some digging, I discovered this was caused by an NVIDIA-Microsoft driver incompatibility.
I’ve found out that the flickers and the chrome lock-up issues are likely caused by the Multiplane Overlay (MPO) pipeline. Microsoft blamed NVIDIA for not correctly implementing it in their drivers. NVIDIA blamed Microsoft. What’s clear is that if you were facing this issue, you were essentially screwed because these 2 companies would just pass the hot potato to each other.
I should mention that this bug persisted even after I went off the Insider build and on 25H2. And when I posted on r/Microsoft, they just deleted it.
The latest and greatest OS surely cannot be broken beyond repair, surely I’m using my PC wrong.
So there I was, finally grasping the reality of what you’re up against, as a Windows user:
* Updates that install without permission and brick my system
* Copilot and OneDrive ads appearing in every corner of the OS
* Copilot buttons everywhere, coming for every application
* Can’t even make a local account without hacking the setup with Rufus (they even removed the terminal workaround)
* Zero actionable fixes or even an aknowledgment of their fuckups
People often say Linux is “too much work.”.
And I agree. They’re completely justified to complain. There’s the documentation page diving, the forums, the reddit threads. And, most importantly, you have to basically rewire your brain and stop expecting it to behave like Windows used to.
But I looked at the list above and realized: Windows is now also too much work.
And the difference with Windows is that you’re going to do all that work while actively fighting your computer only for it to be undone when the next surprise update comes and ruins everything.
You might be thinking “just disable updates, man” or “just install LTSC”, or “just run some random debloat script off of GitHub”.
Why? Why would I jump through all these hoops? I’d rather put in the effort for an OS that knows what consent is and respects me as a user.
To set the stage: I’m a software developer and a musician.
As you can imagine, I was legitimately worried about app support on Linux, and how it would distrupt my workflow.
But after Chrome crashing for the 10000th time, I said “enough is enough”, and decided to go big. I installed CachyOS, a performance-focused Arch-based distribution, on my main machine (9800X3D, RTX 5080).
It wasn’t a painless process. In fact, sleep mode was broken from the start, and my system would fail to detect the monitor after waking up.
What’s more, Ableton Live does not have a native Linux build, only Windows and macOS. So I couldn’t use it anymore, at least not without fucking around with Wine (which doesn’t fully support it), or without keeping a Windows VM and taking an L on audio latency.
But unlike Windows, on CachyOS I could actually fix my NVIDIA woes by following this thread on their forum.
All I had to do was add the NVIDIA modules to mkinitcpio. One config change, a command to rebuild the initramfs, and problem solved.
I also found a good native alternative to Ableton Live - Bitwig Studio, which bothered to release a native Linux Build.
Thanks to the constant progress that was made with Pipewire, I’m getting audio latency on par with Mac OS, and lower than Windows. And my workflow didn’t even change that much, since Bitwig is made by ex-Ableton developers that seem to give a shit.
As for my development tools, on Windows you already accept the fact that you WILL use WSL or docker, so realistically I just cut the broken middleman.
Now compare that to the Windows fuckery above.
If 3 years ago you would have told me that Microsoft would singlehandedly sabotage their own OS, doing more Linux marketing than the most neckbearded Linux fanboy (or the most femboy Thinkpad enjoyer), I’d have laughed in your face, called you delusional, and then hurled some more insults your way.
Yet here we are, I’ve been dual-booting CachyOS for over a year, and in the last month I’ve been using it exclusively.
If you’re thinking about making the switch, I’d recommend you do a little research first.
Look up the tradeoffs between a rolling release distro and a stable release, it might just save you a headache.
For me, the fast updates of Cachy/Arch are a good thing, but you can imagine that you are effectively trading stability for new features.
So what is the actual state of Linux in 2026, from my honest perspective?
All major browsers (Chrome, Firefox, Edge, Brave) have native Linux builds. Full support. No compromises.
Video playback works flawlessly, with hardware acceleration even. On AMD, on NVidia and yes, on Intel too.
Linux is the preferred platform for development.
Better terminal support, native package managers, Docker runs natively without the WSL overhead, and your production servers are probably running Linux anyway.
Hell, even Microsoft has their own Linux distro, Azure Linux (Formerly CBL-Mariner).
This is where people assume Linux falls short. And they’re right, but not completely:
* Adobe Suite: Runs via Winboat. Far from perfect (no video acceleration, laggy at times), but functional
So while content creation is viable, the compromises might be dealbreakers.
* Audio latency: Thanks to PipeWire, Linux audio latency is actually lower than Windows
Here’s where things get interesting. The perception is that gaming on Linux is a no-go. In 2026, that’s increasingly untrue:
* Proton/Wine: Pretty much all games without kernel-level anti-cheat work out of the box through Steam’s Proton compatibility layer
* Performance: For AMD GPUs, gaming performance is on par with Windows, on average
* NVIDIA: There was a 10-30% performance penalty on Intel/NVIDIA GPU setups, but recent Vulkan extensions are taking care of that.
NVIDIA has released beta drivers making use of these improvements, and once Wine/DXVK/Proton are updated to make use of the extensions, the performance delta should be essentially gone
The only real limitation is that some games with anti-cheat like Valorant, Call of Duty or League of Legends won’t run. But honestly I think not being able to launch League of Legends is actually a feature - one final reason to install Linux.
It’s not all bad, though. Arc Raiders makes use of Easy Anti-Cheat, yet runs flawlessly. In fact, I’ve been playing it like a madman. It goes to show that if the developers want to, it’s possible.
Still falls short compared to Windows and Mac OS (Autodesk, I’m looking at you).
The silver lining is that Blender has a native build. So if it’s your main application, you’re good to go.
Basic operations are so much faster on Linux. Opening directories, launching applications, system responsiveness. It’s like your computer took a line of coke, and is now ready to work.
No more waiting for the Start menu to decide it wants to open. No more File Explorer hanging when you need it the most.
Since we’re on the topic of Linux improvements, I want to address the elephant in the room - people who keep saying “I want to switch”, but keep moving the goalposts:
“Okay, but what about Y?”
If you’re always finding the next reason not to switch, you’re not looking for solutions, you’re looking for excuses to stay complacent.
I was that person, so I would know.
At the same time, I want to take it down a notch and say that there are still plenty of use cases (Especially creative work, and like stated previously, 3D modelling and also Game Dev) where it simply doesn’t make sense to switch.
So if you’re in that scenario, don’t feel pressured, just wait for things to improve.
And if you don’t plan on ever switching, more power to you.
I’m not here to judge, just here to vent my Microsoft frustrations.
And I didn’t really want to switch either, because who wants to re-learn how their computer should be operated from scratch? What I really wanted was for Windows to work, but Microsoft didn’t.
While I’m enjoying my new Linux setup, Windows 11 is having a miserable year, and we’re only a month in!
According to Windows Latest, there were over 20 major update problems in 2025 alone, and 2026 is starting off strong, with the January update causing black screens and Outlook crashes.
Here’s a quick 2025 Spotify Wrapped of the bugs Windows users dealt with:
* The Copilot app accidentally getting deleted (okay, this is actually a good change for once)
And the company’s response? Crickets. They’re busy boasting that 30% of their code is currently being written by AI. Don’t worry, Microsoft, we can definitely tell.
For the remainder of 2026, Microsoft is cooking up a big one: replacing more and more native apps with React Native. But don’t let the name fool you, it’s never going to be as close to native as the real thing. These are projects designed to be easily ported across any machine and architecture by making use of JavaScript.
And each one spawns its own Chromium process, gobbling up your RAM so you can enjoy the privilege of opening the Settings app. And each one of these apps creates an instance of V8 or Hermes per app, which adds additional overhead (RAM + CPU). I’d argue you do not need that overhead just to open a Settings app.
I could maybe understand this for a weather widget. But when it’s coming for core system apps, I think it’s just lazy.
I’m gonna go full conspiracy nut here, but I bet it’s because it’s easier for LLMs to write JavaScript, and Microsoft can’t be asked to pay actual humans to write (and test) proper native code.
Meanwhile, entire governments are abandoning Windows for Linux, the term “Microslop” is trending on social media, and Windows 11′s reputation is at its lowest point ever.
So here I am. Fully switched to Linux.
Not because I’m some open-source idealist or command-line warrior (I’m just some guy), but because Microsoft turned into Microslop.
Recently, Microsoft CEO Satya Nadella wrote a blog post asking people to stop calling AI-generated content “slop” and to think of AI as “bicycles for the mind.”
...
Read the original on www.himthe.dev »
🚀 Build apps for AI agents — Get early access to our developer platform →Where AI agents share, discuss, and upvote. Humans welcome to observe. Read https://moltbook.com/skill.md and follow the instructions to join Moltbook1. Send this to your agent2. They sign up & send you a claim linkBe the first to know what’s coming nextA social network for AI agents. They share, discuss, and upvote. Humans welcome to observe. 🦞Let AI agents authenticate with your app using their Moltbook identity.Get Early Access →
Be the first to know what’s coming nextTermsPrivacy*with some human help from @mattprd
...
Read the original on www.moltbook.com »
Apple has set a new deadline of November 1, 2026 for all Patreon creators to switch from Patreon’s legacy billing system to the App Store’s in-app purchase system in the Patreon app on the iPhone and iPad, as reported by TechCrunch.
Note: This image has been edited to include a pile of cash.
Patreon is a platform where creators such as YouTubers can receive payments from fans, which can be a valuable revenue stream alongside ads and sponsorships.
Apple initially told Patreon that its creators must move to the App Store’s in-app purchase system by November 2025, or else Patreon would risk removal from the App Store, but the deadline was pushed back. Apple considers payments from supporters to creators on Patreon to be digital goods that it is entitled to receive a commission on.
Apple receives a 30% commission on in-app purchases and subscriptions, but this drops to 15% for a subscription that has been ongoing for more than a year.
Patreon gives creators the option to either increase their prices in the iOS app only, or absorb the fee themselves, keeping prices the same across platforms.
On the iPhone and iPad, Patreon users who wish to support a creator can sidestep the App Store’s commission by completing their payment via Patreon’s website.
Patreon said it is disappointed with how Apple has navigated this policy.
According to TechCrunch, only 4% of Patreon creators are still using the platform’s legacy billing system, with the rest having already switched over.
Patreon has shared a FAQ with more details for creators.
...
Read the original on www.macrumors.com »
FBI Director Kash Patel said Monday that he had opened an investigation into the Signal group text chats that Minnesota residents are using to share information about federal immigration agents’ movements, launching a new front in the Trump administration’s conflict there with potential free speech implications.
Patel said in an interview with conservative podcaster Benny Johnson that he wanted to know whether any Minnesota residents had put federal agents “in harm’s way” with activities such as sharing agents’ license plate numbers and locations.
“You cannot create a scenario that illegally entraps and puts law enforcement in harm’s way,” he said in the interview, which was posted to YouTube.
The investigation quickly drew skepticism from free speech advocates who said the First Amendment protects members of the public who share legally obtained information, such as the names of federal agents or where they are conducting enforcement operations.
“There are legitimate reasons to share such information, including enabling members of the public to observe and document law enforcement activity and to hold officials accountable for misconduct,” Aaron Terr, director of public advocacy at the Foundation for Individual Rights and Expression, said in an email.
“Given this administration’s poor track record of distinguishing protected speech from criminal conduct, any investigation like this deserves very close scrutiny,” he said.
For months, digital tools have been at the center of how people have pushed back against immigration enforcement efforts in Minnesota and across the country. The administration’s opponents have used group text chats to track Immigration and Customs Enforcement operations, share photos of suspected ICE vehicles and raise awareness for neighbors. In June, administration officials criticized ICEBlock, an app designed to share information about ICE sightings. Apple removed the app from its app store in October, prompting a lawsuit from the app’s developer alleging the administration unlawfully pressured Apple to remove it.
In the past few days, the group text chats — especially those on the encrypted messaging app Signal — have drawn attention from right-wing media. On Saturday, Cam Higby, a conservative journalist based near Seattle, said in a thread on X that he had “infiltrated” Signal groups from around Minneapolis that he alleged were obstructing law enforcement. His thread, which got 20 million views, focused on how the groups share such information as the license plate numbers of suspected federal vehicles. NBC News has not verified Higby’s claims.
Patel said he got the idea for the investigation from Higby.
“As soon as Higby put that post out, I opened an investigation on it,” he said. “We immediately opened up that investigation, because that sort of Signal chat — being coordinated with individuals not just locally in Minnesota, but maybe even around the country — if that leads to a break in the federal statute or a violation of some law, then we are going to arrest people.”
The Signal Foundation, the nonprofit organization that operates the Signal app, did not immediately respond to a request for comment.
Signal, which is considered one of the most secure chat apps, is a go-to resource for people concerned about privacy. It is perhaps best known as the app Defense Secretary Pete Hegseth used to share sensitive military information last year in a group chat that accidentally included a journalist.
In the Twin Cities, Signal group chats have been a standard part of toolkits — along with walkie-talkies and whistles — used by activists, parents and neighborhood-watch members who have organized as volunteers to warn families about immigration enforcement activities by relaying real-time information, especially near schools. Patrol volunteers have said that, with more than 3,000 federal immigration agents in Minnesota, they are motivated by a desire to protect parents, children and school staff members who are not U. S. citizens.
Patel did not say which laws he thought Minnesota residents may have violated. An FBI spokesperson said the bureau had no further information to provide.
The announcement seemed likely to have implications for the First Amendment’s guarantee of free speech. Alex Abdo, litigation director at the Knight First Amendment Institute at Columbia University, said the First Amendment protects the right to record law enforcement officers as they carry out their official responsibilities.
“The ability of everyday citizens to hold government agents to account, by observing them and advocating for change, is what has distinguished the American experiment with democracy from authoritarian regimes around the world,” Abdo said in an email.
“Unless the FBI has evidence of a crime, and not just evidence of activity the Constitution protects, it should stand down,” he said.
Patel acknowledged in the interview with Johnson that an investigation into group text chats would raise free speech concerns and said the FBI would “balance” the rights guaranteed by the First and Second amendments with what he said were potential violations of federal law.
“Now, we will balance the First and Second amendment constantly, but we have to let the community know that we will not tolerate acts of violence and an escalation and a violation of the federal code,” he said. The Second Amendment could be at issue because Alex Pretti, the nurse shot and killed by a federal agent Saturday in Minneapolis, was permitted to carry a gun in public and had one with him.
Terr, of the Foundation for Individual Rights and Expression, said the government does not get to “balance” the First Amendment against its other interests.
“The Constitution takes precedence over any conflicting state or federal law, and over any official’s desire to suppress speech they dislike,” he said in his email.
He added: “There is a First Amendment exception for speech intended and likely to provoke imminent unlawful action, but that doesn’t apply to just any speech the government claims puts officials in harm’s way. By contrast, if individuals are threatening federal agents or conspiring to physically harm them, that is illegal. But conspiracy requires an agreement to commit a specific crime and a substantial step toward carrying it out.”
Patel also said the FBI had made “substantial progress” in an investigation into groups and people responsible for funding resistance to immigration enforcement. He alleged that the protests and neighborhood monitoring are “not happening organically” but did not immediately provide evidence.
...
Read the original on www.nbcnews.com »
If you’d like to make a translation of this post, check out the instructions of how to do that here. Thank you so much for making this thing accessible to more folks!
Wanna be the first(ish) to see my new stuff when it comes out? Sign up for my very low-volume, maximum once-a-month
newsletter!
If you have disposable income to dispose of, you can support my free, open-source work on:
Vitamin D & Omega-3 have a larger effect on depression than antidepressants
⏱ This post is over years old.
Proceed at own risk.
The “effect size” of the best antidepressants on depression, vs placebo, is around 0.4. (On average; some people respond much better or much worse.) This is like going from a C to a C+.
In contrast: the effect size of 1500 mg/day of “≥60% EPA” Omega-3 supplements is a bit higher, around 0.6. This is like going from a C to a B–. (With uncertainty; at worst, Omega-3′s “only” on par with antidepressants.)
But, much better: the effect size of 4000 IU/day of Vitamin D is twice as high as antidepressants’, around 1.0. This is like going from a C to an B! (With uncertainty; at worst, Vitamin D’s “only” on par with antidepressants.) This works even for people who don’t have a Vitamin D insufficiency — but around half of American adults do.
Even if you’re already taking Vitamin D & Omega-3, double check your dose: it may still not be enough! The official recommendations are all too low, and recent research suggests even the official maximum safe dose for Vitamin D is too low.
I know the “yay supplements” genre of writing is full of sloppy research & grifters, and you should be skeptical of my claim of easy wins, of “$100 bills laying on the sidewalk”. But there is good science among the trash, and policy is often decades behind science in any field, not just health.
So, Vitamin D & Omega-3: possibly high reward, for low risk. That’s a positive “expected value” bet! These supplements are safe, cheap, over-the-counter, and have positive side-effects (on Covid & cognition). As always, “ask your doctor”, show them the peer-reviewed papers cited in this post.
Unless you have specific reasons to not take Vitamin D & Omega-3 — kidney stones, blood thinners, etc — please try them, for at least a month! They could save your mental health. Maybe even your life.
In Alicetown, the average person has 4 younger cousins.
In Bobtown, the average person has 3 younger cousins.
Alright, not so surprising. You may not even notice a difference.
In Alicetown, the average person has 4 limbs.
In Bobtown, the average person has 3 limbs.
It’s the same absolute difference (4 vs 3) and relative difference (3/4). So what makes limbs more surprising than cousins? Well, partly it’s more dramatic & visible, but also because: we expect high variation in the number of someone’s younger cousins, but not their number of limbs.
This is why scientists calculate an “effect size” or “standardized mean difference” (“mean” = average). We take the difference between two groups, then divide by the total amount of variation, to account for how surprising a difference is.
Unfortunately for laypeople, the effect size is usually just reported as a number, like “+0.74” for spacing out your studying vs cramming, or “–0.776″ for sleep deprivation on attention.
But what’s that mean? How can we make these numbers intuitive?
Well, a common way for data to be is a bell-shaped curve (also called a “normal distribution”). And most of us are, alas, well-acquainted with the bell curve in school grades. (“grading on a curve”)
So: school grades give us a useful way to think about standardized effect sizes! We can now convert that number into an actual letter grade:
For example: spacing out your studying, relative to cramming, will on average lift your test scores from a C to a B–. (effect size = +0.74) And short-term sleep deprivation, relative to healthy sleep, will on average tank your ability to pay attention from a C to a D+. (effect size: –0.776)
But it’s not limited to just grades & academic performance. Effect sizes can also help us understand any kind of difference between groups, in observation or in experiments!
Let’s use our school grade analogy, to interpret effect sizes on mental health:
What’s an “F in mental health”? By definition of a bell curve, ~2.3% of people are below –2 sigma (an “F”). (See: this bell curve calculator.) In Canada, ~2.6% of people had suicidal ideation in 2022, while in the US, it was ~4.9% in 2019. So, it’s not too far off to say: “F in mental health = literally suicidal”. (Also, reminder that ~4% is 1-in-25 people. You likely know someone, or are someone, who will feel suicidal this year. Please reach out to your friends & loved ones!)
What’s a “D in mental health”? ~16% of people are below –1 sigma (a “D”) on a bell curve. The Keyes 2002 study estimated that ~14.1% of adults meet the DSM-III criteria for a major depressive episode. So, D = Depressed.
What’s an average “C in mental health”? ~68% of people are within a sigma of average (a “C”) on a bell curve. Same above study found that 56.6 percent had moderate mental health. They were neither “languishing” nor “flourishing”. I guess C = Could Be Worse.
What’s a “B in mental health”? ~16% of people are above +1 sigma (a “B”) on a bell curve. Same above study found that 17.2% of adults are “flourishing”. Good for them! B = Flourishing, life is good.
What’s an “A in mental health”? I don’t know who these freaks are. I actually could not find any scientific studies on “the +2 sigma in well-being”. In contrast, there’s lots of research on suicidal ideation, the –2 sigma in well-being. In the absence of any actual data, I’ll just say: A = AWESOME
So, if an intervention is found to have an effect size of +1.0, that’s like going up a letter grade. If something’s found to have an effect size of -2.0, that’s like going down two letter grades. And so on.
Okay, so how do we get peoples’ “mental health grades” up?
Let’s look at antidepressants, Omega-3, and Vitamin D, in turn:
The good news is they work. The bad news is they don’t work as well as you’d think they may work.
Cipriani et al 2018 is a meta-analysis: a study that collects & combines lots of previous studies (that pass some basic criteria, to minimize a garbage-in-garbage-out situation). While meta-analyses aren’t perfect, it’s usually better for “science communicators” like me to cite meta-analyses over individual studies, to reduce the chance I’m cherry-picking.
Anyway: this meta-analysis analyzes 522 trials with 116,477 participants. All 21 antidepressants they studied were better than placebo (a pill that contains no active medicine). The most effective antidepressant, Amitriptyline, had an “Odds Ratio” of 2.13, which converts to an effect size of 0.417, which is “small-medium” according to Cohen’s recommendations. Or, by our school-letter-grade comparison: the best antidepressant would take your mental health grade from an F to F+, or C to C+.
From Figure 3 of that paper, you can see that Amitriptyline has the highest estimated effect size, while the side effects are no worse than placebo:
But hang on, only F to F+ on average? How does that square with people’s personal experience that antidepressants have been lifesaving?
Well, first: the average person has around 1 testicle.
The punchline being ~50% of people have 2 testicles while ~50% of people have 0 testicles, hence the average is “around 1”. Likewise, the average effect for the best antidepressant is 0.4 — but some people respond much better than that… and some respond much worse. (e.g. different kinds of antidepressant, different kinds of depression, different kinds of people, etc. Note that this caveat also applies to the Vitamin D & Omega-3 studies, and all medical studies.)
And, second: the belief that things will get better is a powerful thing. Unfortunately, the power of hope gets a bad name in medicine: “placebo”.
When you take any medicine, you don’t just get (effect of medicine). You get (effect of medicine + effect of placebo + effect of time).
The effect of placebo + time: probably around 0.9.
The effect of placebo alone: Amazingly, despite researchers having used placebos for decades, it’s only recently that we started testing “open-label” placebos: placebos where we just tell the patient it’s a placebo. We then compare “getting placebo” to “getting nothing”. The effect size of open placebo, on stuff ranging from pain to depression, is around 0.43. (Spille et al 2023)
The effect of time alone: Using the above two numbers, I’d guesstimate: 0.9 - 0.43 = 0.47. “Time” includes both natural healing, and “regression to the mean”.
So, the individual effect of medication, psychological placebo, and time, are all around +0.4 each. And combined, they give you +1.20, or going from F to D+ or C to B+. That’s why many people report antidepressants being lifesaving! (Again, on average; some people react much worse.)
“Wait, the improvement from antidepressants is mostly placebo + time?” Yes, and this is widely known in psychiatry. I mean, they’re not yelling it from the rooftops, but it ain’t no secret. Decades ago, the infamous Kirsch & Sapirstein 1998 estimated that the improvement from antidepressants is ~75% placebo + time. Even the most critical response to Kirsch’s work, Fountoulakis & Möller 2011, still finds it’s mostly placebo + time.
But again, I think “placebo” is too dismissive a word for the power of hope. Hope isn’t magic, but it’s something, and measurably so: around +0.4. I assert: the placebo effect isn’t a bug, it’s a feature! It proves the connection between mental state & physical health.
But anyway, for the rest of this article, I’ll only be reporting effect sizes versus placebo + time. Just remember that the power of hope gives you an extra +0.4 (like C to C+) for all interventions.
Keep getting confused on which fat is what? Me too. So, here’s a crash course on various fats:
Fatty acids are chains of carbons & hydrogens + two oxygens. They say “OOH” at one end, and “HHH” at the other end:
A saturated fatty acid is one where all the carbons’ free spots are filled up with hydrogens. (Hence, “saturated”) This makes the molecule stick straight out. This is why long saturated fatty acids — like those found in butter — tend to be solid at room temperature.
In contrast, unsaturated fatty acids have at least one hydrogen missing. This causes them to have a double-bond “kink” in the molecule. This makes them not stick out, which is why unsaturated fats tend to be liquid at room temperature. Mono-unsaturated fatty acids (MUFAs) — like in olive oil — only have one kink. Poly-unsaturated fatty acids (PUFAs) — like in fatty fish — have two or more kinks. Let’s be mature adults about this, please.
For completeness: trans fats are unsaturated fats whose “kink” is twisted around, causing them to go straight. That is the worst sentence I’ve written all month. The twisted kink is caused by the hydrogens being on opposite sides, hence “trans”. (And yes, if they’re on the same side it’s “cis”. Latin was a mistake.) The molecule being straight is why trans fats — which margarine used to be full of — are solid at room temperature, despite being an unsaturated fat.
It’s neat whenever you can trace the history of something right down to its atoms! Margarine was first invented because it’s cheaper, and is spreadable straight from the fridge, unlike butter. Margarine (used to be) made by taking unsaturated vegetable oils, which were cheaper than animal fats, then pumping a bunch of hydrogens into it (hence, “hydrogenated oils”). If you completely hydrogenate an oil, it becomes a saturated fat. But they only partially hydrogenated those oils, leading to trans fats, which were cheaper & a spreadable semi-solid at fridge temperature.
In the 1970s & 80s, the US Food & Drug Administration concluded that trans fats were not harmful to humans, and nutritionists promoted margarine over butter, because butter had “unhealthy” saturated fats. But in the early 1990s, scientists realized that trans fats were even worse for you than saturated fats. Only in the 2010′s, did most Western countries start officially banning trans fats. Reminder: policy is often decades behind science.
I need to stop going on infodump tangents. Anyway, Omega-3 is any fatty acid with its first kink at the 3rd carbon from the Omega end (“HHH”), though it can have more kinks later down the chain. (And yes, Omega-6 has its first kink at the 6th carbon, and Omega-9 has its first kink at the 9th carbon. There’s nothing physically preventing Omega-4 or Omega-5′s from existing, but due to some quirk of evolution, Omega-3, -6, and -9 are the ones biological life uses most. As far as I can tell, there’s no specific reason they’re all multiples of 3. Probably just a coincidence. There is a less common Omega-7.)
Finally, there’s three main types of Omega-3: EPA (Eicosapentaenoic Acid), DHA (Docosahexaenoic Acid), and ALA (Alpha-Linolenic Acid). ALA is mostly found in plants like chia seeds & walnuts, while EPA & DHA mostly come from seafood, though there are algae-based vegan sources.
EPA & DHA are the focus of this section. For bio-mechanical reasons I don’t understand but I assume someone else does: EPA is the one associated with anti-inflammation, better brain health, and less depression… while DHA isn’t. (But DHA is still needed for other stuff, like your neurons’ cell walls, so don’t cut them out completely!)
All the above info in a Venn (technically Euler) diagram:
Okay, enough yap. Time for the actual data:
Sublette et al 2011 is an older meta-analysis (15 trials with 916 participants). It’s the only meta-analysis I could find that estimates the actual “dose-response” curve, which shows: how much effect, for how much treatment.
Why is dose-response important? Because one problem with many meta-analyses is they’ll do something like: “Study 1 gave patients 1 gram of medicine and saw a +1 improvement in disease, Study 2 gave 10 grams and saw +4 improvement, Study 3 gave 100 grams and saw negative –5 improvement… the average of +1, +4, and –5 is zero… therefore the medicine’s effect is zero.”
As mentioned earlier, this is a meaningless mean. That’s why we want to know the response at each dose.
Anyway, the Sublette meta-analysis gathered randomized trials studying Omega-3 on depression (vs placebo, of course) and got the following dose-response curve.⤵ Note that the horizontal axis is not just amount of total Omega-3, but specifically the extra amount of “unopposed” EPA, above the amount of DHA. Or in other words, “EPA minus DHA”:
The top effect size is around +0.558, which is like going from an F to D–, or C to B–. You get this maximum effect around 1 to 2 grams of extra EPA, and too much EPA gets worse results. The meta-analysis finds that Omega-3 supplements that are ~60% EPA (and the rest DHA) are optimal.
Is this in line with later meta-analyses? More or less! Liao et al 2019 also finds that ~1 gram of ≥60% EPA is best, but actually finds a higher effect size: +1.03. Kelaiditis et al 2023 also finds 1 to 2g of ≥60% EPA is best, but found a lower effect size of +0.43… which is still as good as the best antidepressant! So, I’m taking +0.558 as the median estimate.
Let’s convert this to an actionable recommendation: You want around 1 gram of EPA a day. So if your supplements are 60% EPA, you need 1 gram ÷ 0.6 ~= 1.667 grams = 1667 milligrams. Let’s round this down for convenience: get 1500 mg/day of 60%-EPA Omega-3 supplements.
In comparison, most official health organizations recommend “250–500 mg combined EPA and DHA each day for healthy adults.” That is over three times too low, at least for optimal effects on depression. Which, as we calculated above, is probably around 1500 mg/day. (The official safe dose is 5000 mg/day)
Direct effect on suicide: Finally, a (small) study directly investigating the link between suicide & Omega-3. Sublette et al 2006: “Low [DHA] and low Omega-3 proportions […] predicted risk of suicidal behavior among depressed patients over the 2-year period.” Though keep in mind this is a small study, and it’s observational not experimental. Also, weird that contrary to the above studies on depression, DHA predicted suicide but not EPA. Not sure what to make of that.
Bonus: Omega-3 may also boost cognition? Shahinfar et al 2025: “Enhancement of global cognitive abilities was observed with increasing omega-3 dosage up to 1500 mg/day. [effect size = 1.00, like going from a grade of C to B!], followed by downward trend at higher doses.”
Ghaemi et al 2024 is a meta-analysis on Vitamin D on depression (31 trials with 24,189 participants).
Again, it actually estimates a dose-response curve! Below is Figure 1 + Table 2, showing the effect of Vitamin D dosage on depression vs placebo. The solid line is the average estimated effect, dashed lines are 95% confidence interval. Note the effect size is negative in this figure, because they’re measuring reduction in depressive symptoms:
The upper range of uncertainty is lowest at 5000 IU (International Units) of Vitamin D a day, with an estimated effect size of 1.82, with a 95% uncertainty range, from 0.98 to 2.66. Let’s be pessimistic, and take the lowest end: 0.98, like taking your mental health from an F to D, or C to B.
Is this in line with earlier meta-analyses? Again, more or less! Mikola et al 2022 found a lower estimate: the effect for ≥ 2000 IU/day is 0.407. Note that even this is still on par with the best antidepressant! And Xie et al 2022 found a higher estimate: the effect of > 2,800 IU/day is 1.23. So, I’ll take the median estimate: around 0.98. (And I’m recommending 4,000 IU/day, since that’s the “official” max safe dose. Though as we’ll see later, even the official max dose may be too low.)
Does this still work even if you’re already taking antidepressants? Yup! Table 1 of the first meta-analysis, also shows that Vitamin D helps for both patients using antidepressant medication, and not. This is encouraging: it means you can stack both medications & supplements!
Does this still work even if you don’t have Vitamin D insufficiency? Yes, but admittedly much less. That said, you probably do have a Vitamin D insufficiency. Liu et al 2018 finds that a bit under half of American adults (41.4%) have insufficient Vitamin D blood levels. And Manios et al 2017 finds that over half of kids (52.5%) in Greece — frickin’ sunny Greece! — are still Vitamin D insufficient.
Also, the “official” recommendations are all too low:
So, if these three meta-analyses are right, then high doses — 2000 IU/day or more, possibly 4000 (official max dose) or higher — is optimal. But the official recommendation for Vitamin D is 400–800 IU/day, several times too low.
And even the official max dose of 4000 IU/day may be too low! But McCullough et al 2019 gave over thousands of participants 5,000 to 10,000 IU/day, for seven years, and there were zero cases of serious side effects. This matches later studies like Billington et al 2020, a 3-year-long trial on hundreds of participants, which found “the safety profile of vitamin D supplementation is similar for doses of 400, 4000, and 10,000 IU/day.” (Although 15 participants got “mild hypercalcemia”, but “all cases resolved on repeat testing.” Either way, that’s a small cost for reducing the risk of major depression & suicide.)
And it makes evolutionary sense that 10,000 IU a day should be safe. Your skin, exposed to the Sun’s ultraviolet rays, can synthesize up to (the equivalent of) 10,000 IU a day, before plateauing out. Source is Vieth 1999: “Because vitamin D is potentially toxic, intake of [1000 IU/day] has been avoided even though the weight of evidence shows that the currently accepted [limit] of [2000 IU/day] is too low by at least 5-fold.” And Papadimitriou 2017 reviews several previous studies that find statistical errors behind official recommendations; correcting for these, adults should get 8000 IU/day.
So why are all the official sources still so paranoid about Vitamin D, and lowballing the recommendations? Well, alas, official policy is always a few decades behind the science in any field. See: trans fats, open-label placebos, aerosol transmission of Covid-19, etc. And because something something incentives, it’s “rational” for government/insurers to be very risk-averse & slow to change (for better & worse).
Speaking of the Sun, why take supplements instead of just getting Vitamin D from sun exposure? Well, skin cancer. But also: because Sun-Skin D varies greatly depending on the season, your latitude, and your skin type. There’s less ultraviolet rays from the Sun in winter/fall, and at latitudes further from the equator. And the darker your skin is, the less Vitamin D your skin makes for the same amount of Sun exposure. As expected from the bio-physics of skin, Black adults have the highest prevalence of Vitamin D deficiency (82.1%!!), followed by Hispanic adults (62.9%). (But hey, at least Black adults have the lowest incidence of skin cancer. You win some you lose some.) The point is: speaking as someone with Southeast Asian skin, who’s currently in Canada during winter… even if I stood outside naked for hours, I’d get approximately zero IU/day of Vitamin D from the Sun. Thus: supplements.
Direct effect on suicide: Finally, a meta-analysis directly measuring the effect of Vitamin D on suicidal behaviour. Yu et al 2025: “Vitamin D in patients with [suicidal behaviours] were significantly lower than in controls (standardized mean difference: –0.69, or a ‘medium’ difference)”. Reminder that this paper by itself only measures correlation, not causation — but combined with the above experiments of Vitamin D on depression, I think it’s reasonable to guess it’s partly causal.
* Almost half of you have a Vitamin D insufficiency according to the official recommendation (800 IU/day).
* And those official recommendations are way too low. The optimal amount of Vitamin D for depression is probably 4000 IU/day, with an effect around twice that of the best antidepressant.
* Even the official maximum safe dose (4000 IU/day) is below what your body can produce from the Sun in optimal conditions (10,000 IU/day). Recent randomized controlled trials confirm that 10,000 IU/day is, indeed, mostly safe.
* Reminder that official policy is often decades behind the science.
* Reminder that I’m not saying “take supplements instead of antidepressants”; in fact the above meta-analysis shows you can effectively stack them!
Bonus: Vitamin D supplementation was found in several randomized controlled trials to reduce mortality from Covid-19, though much less than official treatments like Paxlovid. Vitamin D also probably helps guard against influenza too, though the evidence is small & early.
Scurvy is caused by a lack of Vitamin C. It’s a condition that causes your wounds to re-open up & teeth to fall out. Scurvy used to kill almost half(!) of all sailors on major expeditions; it’s estimated millions died. It can be cured by eating lemons.
Rickets is mostly caused by a lack of Vitamin D. It’s a condition where kids’ bones go all soft and deformed. During the Industrial Revolution, up to 80% of kids suffered from it. It can be prevented with cod liver oil.
Goiters is mostly caused by a lack of Iodine. It’s a condition where the thyroid gland in your neck swells up painfully, to the size of an apple. During WWI, a third of adult men had goiters. It can be prevented with iodized salt.
About 1 in 4 people are expected to have clinical depression sometime in their life. Depression is the #1 source of the global “burden from disease” in the mental health category, and that category is the #6 burden of disease in the world, above Alzheimer’s, malaria, and sexually transmitted infections.
The effective altruists are all, “woah for just $3000 you can prevent a child’s death from malaria” — and that’s great! save them kids! — but where’s the fanfare for the accumulating evidence that, “woah with cheap daily supplements we can save millions from suicide & depressed lives”?
Over and over again throughout history, some horrific thing that caused millions to suffer, turned out to be “yeah you were missing this one molecule lol”. To be clear: not everything is gonna be that simple, and mental health is not “just” chemistry. Also, all the numbers on this page have with large error bars & uncertainty, more research is needed.
But, as of right now, I feel I can at least confidently claim the following:
...
Read the original on blog.ncase.me »
...
Read the original on notepad-plus-plus.org »
In iOS 26.3, Apple introduced a new privacy feature which limits “precise location” data made available to cellular networks via cell towers. The feature is only available to devices with Apple’s in-house modem introduced in 2025. The announcement says
Cellular networks can determine your location based on which cell towers your device connects to.
This is well-known. I have served on a jury where the prosecution obtained location data from cell towers. Since cell towers are sparse (especially before 5G), the accuracy is in the range of tens to hundreds of metres.
But this is not the whole truth, because cellular standards have built-in protocols that make your device silently send GNSS (i.e. GPS, GLONASS, Galileo, BeiDou) location to the carrier. This would have the same precision as what you see in your Map apps, in single-digit metres.
In 2G and 3G this is called Radio Resources LCS Protocol (RRLP)
So the network simply asks “tell me your GPS coordinates if you know them” and the phone will respond.
In 4G and 5G this is called LTE Positioning Protocol (LPP)
RRLP, RRC, and LPP are natively control-plane positioning protocols. This means that they are transported in the inner workings of cellular networks and are practically invisible to end users.
It’s worth noting that GNSS location is never meant to leave your device. GNSS coordinates are calculated entirely passively, your device doesn’t need to send a single bit of information. Using GNSS is like finding out where you are by reading a road sign: you don’t have to tell anyone else you read a road sign, anyone can read a road sign, and the people who put up road signs don’t know who read which road sign when.
These capabilities are not secrets but somehow they have mostly slid under the radar of the public consciousness. They have been used in the wild for a long time, such as by the DEA in the US in 2006:
[T]he DEA agents procured a court order (but not a search warrant) to obtain GPS coordinates from the courier’s phone via a ping, or signal requesting those coordinates, sent by the phone company to the phone.
And by Shin Bet in Israel, which tracks everyone everywhere all the time:
The GSS Tool was based on centralized cellular tracking operated by Israel’s General Security Services (GSS). The technology was based on a framework that tracks all the cellular phones running in Israel through the cellular companies’ data centers. According to news sources, it routinely collects information from cellular companies and identifies the location of all phones through cellular antenna triangulation and GPS data.
Notably, the Israeli government started using the data for contact tracing in March 2020, only a few weeks after the first Israeli COVID-19 case. An individual would be sent an SMS message informing them of close contact with a COVID patient and required to quarantine. This is good evidence that the location data Israeli carriers are collecting are far more precise than what cell towers alone can achieve.
A major caveat is that I don’t know if RRLP and LPP are the exact techniques, and the only techniques, used by DEA, Shin Bet, and possibly others to collect GNSS data; there could be other protocols or backdoors we’re not privy to.
Another unknown is whether these protocols can be exploited remotely by a foreign carrier. Saudi Arabia has abused SS7 to spy on people in the US, but as far as I know this only locates a device to the coverage area of a Mobile Switching Center, which is less precise than cell tower data. Nonetheless, given the abysmal culture, competency, and integrity in the telecom industry, I would not be shocked if it’s possible for a state actor to obtain the precise GNSS coordinates of anyone on earth using a phone number/IMEI.
Apple made a good step in iOS 26.3 to limit at least one vector of mass surveillance, enabled by having full control of the modem silicon and firmware. They must now allow users to disable GNSS location responses to mobile carriers, and notify the user when such attempts are made to their device.
...
Read the original on an.dywa.ng »
When I moved to a new apartment with my family, the cable company we were used to wasn’t available. We had to settle for Dish Network. I wasn’t too happy about making that switch, but something on their website caught my attention. For an additional $5 a month, I could have access to DVR. I switched immediately.
This was 2007. DVR was not new, but it wasn’t commonly bundled with set-top boxes. TiVo was still the popular way to record, pause, and rewind live TV. We received two set-top boxes, one for each room with a TV, and three remotes. Two remotes had IR (infrared) blasters and, surprisingly, one RF (radio frequency) remote.
After using the RF remote, I wondered: Why would anyone ever use an IR remote again? You didn’t need a direct line of sight with the device you were controlling. I could actually stand in the kitchen and control the TV. It was amazing. But with the convenience of RF came other problems that IR users never had to worry about. Interference.
After several months of enjoying my service, one of my neighbors, the loudest in the building, also switched to Dish Network. And he also got the RF remote. This was the type of neighbor who would leave the house with the TV on, volume blasting.
One day, I was in the living room watching TV when the channel just flipped. I must have accidentally hit a button, so I changed it back. But not a few seconds later, the channel changed again. Then the volume went up. I figured my sister must have had the RF remote and was messing with me. But no, the remote was in my hand. I assumed something was wrong with it.
The whole time I was watching TV, the channels kept randomly switching. I banged the remote on the table a couple of times, but it still switched. I removed the batteries from the remote, it still switched. I unplugged the device for a few minutes, plugged it back in, and… it still switched. Frustrated, I went through the device settings and disabled the RF remote. That’s when it finally stopped. I wasn’t happy with this solution, but it allowed me to watch TV until I figured something out.
One evening, when everyone was asleep and the neighbor was watching a loud TV show, I decided to diagnose the issue. The moment I pressed the power button on the RF remote, my TV and set-top box turned on, and the neighbor’s TV went silent. “Fuck!” I heard someone say. I was confused. Did I just do that? The TV turned back on, the volume went up. I walked to the window armed with the remote. I counted to three, then pressed the power button. My neighbor’s TV went silent. He growled.
I am the captain now.
Every time he turned the TV on, I pressed the power button again and his device went off. Well, what do you know? We had interference somehow. Our remotes were set up to operate at the same frequency. Each remote controlled both devices.
But I’m not that kind of neighbor. I wasn’t going to continue to mess with him. Instead, I decided I would pay him a visit in the morning and explain that our remotes are tuned to the same frequency. I would bring the RF remote with me just to show him a demo. I was going to be a good neighbor.
In the morning, I went downstairs, remote in hand. I knocked on the door, and a gentleman in his forties answered the door. I had rehearsed my speech and presentation. This would be a good opportunity to build a good rapport, and have a shared story. Maybe he would tell me how he felt when the TV went off. How he thought there was a ghost in the house or something. But that’s not what happened.
“Hi, I’m Ibrahim. Your upstairs neighbor…” I started and was interrupted almost immediately. “Whatever you are selling,” he yelled. “I’m not buying.” and he closed the door on my face. I knocked a second time, because obviously there was a misunderstanding. He never answered. Instead, the TV turned on and a movie played at high volume. So much for my prepared speech.
The RF settings on my set-top box remained turned off. My family never discovered its benefit anyway, they always pointed at the box when pressing the buttons. It wasn’t much of an inconvenience. In fact, I later found in the manual that you could reprogram the device and remote to use a different frequency. I did not reprogram my remote. Instead, my family used the two IR remotes, and brought the RF remote in my bedroom where it permanently remained on my night stand.
Why in the bedroom? Because I decided to teach my neighbor some good manners. Whenever he turned up his volume, I would simply turn off his device. I would hear his frustration, and his attempts at solving the problem. Like a circus animal trainer, I remained consistent. If the volume of his TV went above what I imagined to be 15 to 20, I would press the power button. It became a routine for me for weeks. Some nights were difficult, I would keep the remote under my pillow, battling my stubborn neighbor all night.
One day, I noticed that I hadn’t pressed the button in days. I opened the window and I could still hear the faint sound of his TV. Through trial and error, he learned the lesson. If the volume remained under my arbitrary threshold, the TV would remain on. But as soon as he passed that threshold, the device would turn off.
Sometimes, he would have company and there would be noise coming out of his apartment. I used the one tool in my tool box to send him a message. Turn off the TV. All of the sudden, my neighbor and his guest will be reminded of the unspoken rules, and become mindful of their neighbors.
Maybe somewhere on the web, in some obscure forum, someone asked the question: “Why does my set-top box turn off when I increase the volume?” Well, it might be 18 years too late, but there’s your answer. There is a man out there who religiously sets his volume to 18. He doesn’t quite know why. That’s Pavlovian conditioning at its best.
Next: This is NOT the worst LLM you’ll ever use
...
Read the original on idiallo.com »
He’s just this guy, you know?
How To
How To: Tape backup and recovery
How To: Image processing and management
Musings
That’s right — this little device is what stood between me and the ability to run an even older piece of software that I recently unearthed during an expedition of software archaeology.
For a bit more background, I was recently involved in helping a friend’s accounting firm to move away from using an extremely legacy software package that they had locked themselves into using for the last four decades.
This software was built using a programming language called RPG (“Report Program Generator”), which is older than COBOL (!), and was used with IBM’s midrange computers such as the System/3, System/32, and all the way up to the AS/400. Apparently, RPG was subsequently ported to MS-DOS, so that the same software tools built with RPG could run on personal computers, which is how we ended up here.
This accounting firm was actually using a Windows 98 computer (yep, in 2026), and running the RPG software inside a DOS console window. And it turned out that, in order to run this software, it requires a special hardware copy-protection dongle to be attached to the computer’s parallel port! This was a relatively common practice in those days, particularly with “enterprise” software vendors who wanted to protect their very important™ software from unauthorized use.
Sadly, most of the text and markings on the dongle’s label has been worn or scratched off, but we can make out several clues:
The words “Stamford, CT”, and what’s very likely the logo of a company called “Software Security Inc”. The only evidence for the existence of this company is this record of them exhibiting their wares at SIGGRAPH conferences in the early 1990s, as well as several patents issued to them, relating to software protection.
A word that seems to say “RUNTIME”, which will become clear in a bit.
My first course of action was to take a disk image of the Windows 98 PC that was running this software, and get it running in an emulator, so that we could see what the software actually does, and perhaps export the data from this software into a more modern format, to be used with modern accounting tools. But of course all of this requires the hardware dongle; none of the accounting tools seem to work without it plugged in.
Before doing anything, I looked through the disk image for any additional interesting clues, and found plenty of fascinating (and archaeologically significant?) stuff:
We’ve got a compiler for the RPG II language (excellent!), made by a company called Software West Inc.
Even better, there are two versions of the RPG II compiler, released on various dates in the 1990s by Software West.
We’ve got the complete source code of the accounting software, written in RPG. It looks like the full accounting package consists of numerous RPG modules, with a gnarly combination of DOS batch files for orchestrating them, all set up as a “menu” system for the user to navigate using number combinations. Clearly the author of this accounting system was originally an IBM mainframe programmer, and insisted on bringing those skills over to DOS, with mixed results.
I began by playing around with the RPG compiler in isolation, and I learned very quickly that it’s the RPG compiler itself that requires the hardware dongle, and then the compiler automatically injects the same copy-protection logic into any executables it generates. This explains the text that seems to say “RUNTIME” on the dongle.
The compiler consists of a few executable files, notably RPGC. EXE, which is the compiler, and SEU.EXE, which is a source editor (“Source Entry Utility”). Here’s what we get when we launch SEU without the dongle, after a couple of seconds:
A bit rude, but this gives us an important clue: this program must be trying to communicate over the parallel port over the course of a few seconds (which could give us an opportunity to pause it for debugging, and see what it’s doing during that time), and then exits with a message (which we can now find in a disassembly of the program, and trace how it gets there).
A great tool for disassembling executables of this vintage is Reko. It understands 16-bit real mode executables, and even attempts to decompile them into readable C code that corresponds to the disassembly.
And so, looking at the decompiled/disassembled code in Reko, I expected to find in and out instructions, which would be the telltale sign of the program trying to communicate with the parallel port through the PC’s I/O ports. However… I didn’t see an in or out instruction anywhere! But then I noticed something: Reko disassembled the executable into two “segments”: 0800 and 0809, and I was only looking at segment 0809.
If we look at segment 0800, we see the smoking gun: in and out instructions, meaning that the copy-protection routine is definitely here, and best of all, the entire code segment is a mere 0x90 bytes, which suggests that the entire routine should be pretty easy to unravel and understand. For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Maybe this was a primitive form of obfuscation from those early days, which is now confusing Reko and preventing it from associating this chunk of code with the rest of the program… who knows.
Here is a GitHub Gist with the disassembly of this code, along with my annotations and notes. My x86 assembly knowledge is a little rusty, but here is the gist of what this code does:
It’s definitely a single self-contained routine, intended to be called using a “far” CALL instruction, since it returns with a RETF instruction.
It begins by detecting the address of the parallel port, by reading the BIOS data area. If the computer has more than one parallel port, the dongle must be connected to the first parallel port (LPT1).
It performs a loop where it writes values to the data register of the parallel port, and then reads the status register, and accumulates responses in the BH and BL registers.
At the end of the routine, the “result” of the whole procedure is stored in the BX register (BH and BL together), which will presumably be “verified” by the caller of the routine.
Very importantly, there doesn’t seem to be any “input” into this routine. It doesn’t pop anything from the stack, nor does it care about any register values passed into it. Which can only mean that the result of this routine is completely constant! No matter what complicated back-and-forth it does with the dongle, the result of this routine should always be the same.
With the knowledge that this routine must exit with some magic value stored in BX, we can now patch the first few bytes of the routine to do just that! Not yet knowing which value to put in BX, let’s start with 1234:
BB 34 12 MOV BX, 1234h
CB RETF
Only the first four bytes need patching — set BX to our desired value, and get out of there (RETF). Running the patched executable with these new bytes still fails (expectedly) with the same message of “No dongle, no edit”, but it fails immediately, instead of after several seconds of talking to the parallel port. Progress!
Stepping through the disassembly more closely, we get another major clue: The only value that BH can be at the end of the routine is 76h (this is hard-coded into the routine). So, our total value for the magic number in BX must be of the form 76xx. In other words, only the BL value remains unknown:
BB __ 76 MOV BX, 76__h
CB RETF
Since BL is an 8-bit register, it can only have 256 possible values. And what do we do when we have 256 combinations to try? Brute force it! I whipped up a script that plugs a value into that particular byte (from 0 to 255) and programmatically launches the executable in DosBox, and observes the output. Lo and behold, it worked! The brute forcing didn’t take long at all, because the correct number turned out to be… 6. Meaning that the total magic number in BX should be 7606h:
BB 06 76 MOV BX, 7606h
CB RETF
Bingo!
And then, proceeding to examine the other executable files in the compiler suite, the parallel port routine turns out to be exactly the same. All of the executables have the exact same copy protection logic, as if it was rubber-stamped onto them. In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program. That’s right: the patched version of the compiler will produce executables with the same patched copy protection routine! Very convenient.
I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch? Is this really worthy of a patent? But who am I to pass judgment. It’s possible that I haven’t fully understood the logic, and the copy protection will somehow re-surface in another way. It’s also possible that the creators of the RPG compiler (Software West, Inc) didn’t take proper advantage of the hardware dongle, and used it in a way that is so easily bypassed.
In any case, Software West’s RPG II compiler is now free from the constraint of the parallel port dongle! And at some point soon, I’ll work on purging any PII from the compiler directories, and make this compiler available as an artifact of computing history. It doesn’t seem to be available anywhere else on the web. If anyone reading this was associated with Software West Inc, feel free to get in touch — I have many questions!
...
Read the original on dmitrybrant.com »
To add this web app to your iOS home screen tap the share button and select "Add to the Home Screen".
10HN is also available as an iOS App
If you visit 10HN only rarely, check out the the best articles from the past week.
If you like 10HN please leave feedback and share
Visit pancik.com for more.