Has anybody tried promoting the rumor that Falun Gong sympathizers are particularly fond of pirated software, and that a substantial portion of the Dalai Lama's publicity slush fund is paid for by bootleg software sales?
Plus, allowing the price of a commodity to equal its marginal cost of production is absolutely textbook decadent capitalist behavior...
If it's detected, make it so that you hold their computers and data hostage by forcibly locking them out and threatening to erase their data if the proper verifications don't occur.
Yeah, it's strongarm tactics, but if you're living outside the law, you can't exactly complain to the cops to help you out that someone's bullying you.
Terrible Plan:
You can, in fact, complain to the cops. With limited exceptions for self defense against imminent threats, most jurisdictions take a very, very dim view of vigilante justice. Even if you are 100% accurate, and never hit a false positive, do you think that the fact that you have legal grounds for a copyright infringement civil suit against somebody is going to save your ass from the slammer after you've committed a bunch of unauthorized-access and extortion related felonies? Don't bet on it. This is particularly the case if the copyright infringement is going on somewhere where the local authorities make a policy of turning a blind eye to that sort of thing; but take a much less indulgent stance on economic disruption by outsiders, whatever their justification.
And don't even think about losing the receipt for your fancy new licence tracking and compliance software 'solution'. Getting busted for pirating one of those is just adding insult to injury...
The assumption that I posses a mysterious "free will" that is somehow divorced from cause and effect(except in that it causes me to act) is simply too convenient to abandon!
The cloud guys certainly do need hardware, and by the truckload; but I suspect that they make comparatively lousy customers:
Your smaller shops tend to have limited bargaining power, and often no choice but to over-provision with respect to their needs(Can't have just one web/file/exchange server because it might fail; but don't have enough load to keep that one over 50% utilization, much less give the backup any exercise unless the primary should happen to go down...)
The(successful) cloud outfits, by contrast, tend to have in-house expertise in management and provisioning tools(so your 'value-add' management crapware isn't a selling point) and fairly tight control over utilization(or they'll be out of business) and some sort of software-level failover scheme in place. So they certainly do need servers, by the rack; but they are unlikely to have any interest in paying more than commodity prices, and are also unlikely to take any upsells to more expensive fault tolerant gear.
They are sort of the server equivalent of supplying house-brand desktops to WalMart: The volume is there; but you won't like the margins, and there are plenty of people who could replace you...
I am fond of webOS(application base is tiny; but the interface is actually quite well thought out. The "cards" work quite well. Hell, maybe team Google will pick up their smoldering remains at the firesale and polish up the 'chromebooks' with some of the UI touches...)
As for the IBM analogy, though, HP has a hard road ahead of it. IBM has always made hardware; but they've always had a software/support/consulting arm extracting its pound of flesh along with the hardware, from back when their job was to customize the Hollerith card reader for your application up the the present 'enterprise database middleware yadda yadda' stuff. They did ditch their desktop/laptop business, and they will, if asked, sell you some bare servers, dell style, for just cost+warranty; but they have always been a combined hardware/services entity. HP, by contrast, is more of a pure hardware/engineering shop that has been bleeding actual engineering talent for a while now.
I've heard that their Big Serious Expensive has its points; but every interaction with HP software that I've had down at the "commodity x86s and their peripherals" level has filled me with an unquenchable desire for bloody vengeance upon every last persons responsible for it.
Their winCE thin clients have had timekeeping bugs in certain models(that engineering kindly verified and then decided not to fix...) Their linux ones have glaring security deficiencies that they wouldn't even acknowledge our bug reports about(Hypothetically, if you were adding a diagnostic page that allowed the user of a 'kiosk' system to use ping to verify connectivity, would you implement it by giving them a freeform text field and then prepending 'ping' to whatever they entered and dumping it straight to the shell without any sanitization? Well, the input "$IP_ADDRESS && xterm" certainly suggests that HP did... For extra credit, the 'kiosk' program was running under a passwordless account on the sudoers list...)
The firmware of their network printers has been a mess for years, and their printer drivers(even for the workgroup networked printers with PCL/Postscript, let's not even talk about the direct-attached inkjet shit) actually seems to be getting worse as time goes on. Servers and workstations are ok, largely by virtue of being more or less stock intel or AMD kit, with drivers provided by people who don't utterly suck.
I know that hardware's margins don't keep the Wall street boys happy; but what sort of insanity could convince HP that they are a software company?
Arguably, we Do Not need ActiveX all over again; but we do need an (actually competent) implementation of what things like ActiveX were trying to accomplish...
While it is possible, and sometimes desirable, to increase security just by paring away as much power as you can get away with, that doesn't fly in the broader market. People want their games, and their videos, and whatnot. If they can't get them in-browser, they'll get them by downloading every friendly.exe that somebody offers them, which isn't exactly a triumph of security(particularly since prompting for elevated rights is standard behavior for installers...)
If you cannot protect somebody from something running in-browser, you don't actually solve the problem by not trying, you just shove it off onto the OS, which hasn't shown a brilliant track record of protecting people from the things they run, and offers less convenience in things like install/uninstall/update/synchronization...
Turning it on, without prompts, for all domains, by default, unless you are very, very certain is, of course, a terrible plan; but there is nothing fundamentally more hopeless about protecting people from browser plugins than protecting people from downloaded binaries, and history suggests that if they can't have what they want from the former, they'll enthusiastically click through whatever the latter asks them for...
I'm of the opinion that the raw food movement is vitalist nonsense(yes, switching from the twinkie diet to a raw food diet might incidentally be good for you; but not because cooking destroys the magic life vital principle in foods...)
However, it is my understanding that the fossil evidence we have is pretty definite on the decline in population-level health(and the enormous increase in population density) once humans began farming.
Probably don't need to worry about our slimy overlords; but it would be interesting to know if this bit of immune-boosting quasi-bestiality helped make humans the pervasive species they are:
Compared to hunter-gatherers, residents of combination agricultural and town/city civilizations are horribly disease riddled. Animal husbandry means zoonotic diseases and parasites in horrific quantity, grain-based agriculture means truly hideous oral health, and urbanization means drinking and sleeping where you shit. It's only in places with 19th+ century sanitation and 20th+ century medicine that the advantages of wealth and technology in sedentary civilizations started to translate into disease levels less horrid than pre-agricultural ones(even then, things like the yearly flu shot because some new combination of porcine, avian, and human viruses has emerged is a classic animal-husbandry parasite issue).. One wonders if any other reasonably-smart hominids ever took a crack at farming; but had to give it up or die because their immune systems just couldn't hack it...
It wouldn't; but(at least in the cross-timezone conversations I've encountered, the use of "Xpm my time" or "Yam your time" seem to be adopted pretty naturally, and not to impose too much difficulty on the user. If people need clarification, they ask, if contact is frequent(eg. a company and an offshore partner) a convention is established...
It isn't perfect; but humans are pretty good at dealing with natural-language ambiguities, probably better than dealing with times that have absolutely no correspondence to local solar position.
Apparently, one of the major upsides of sex(from a darwinian, rather than purely recreational, perspective) of the not-intuitively-all-that-sensible arrangement of having to seek out a conspecific, risk sexually transmitted infection, and mate simply in order to reproduce, is the rapid genetic diversification you can achieve by recombining genomes with others. Your asexual organisms have it much easier; but they have to depend on mutation(or, as with some bacteria, quasi-sex genetic exchange mechanisms).
The neat organisms, in my opinion, are the edge cases that can go either way. this piece(sorry about the paywall...) examines snails that can either reproduce sexually or spawn clones asexually. As it turns out, in areas with higher parasite loads, the snails resort to sex at much higher rates in order to keep abreast of the parasite threat, while the less pressured snails go for the rapid and low-risk strategy of asexual cloning.
Arguably, in an increasing number of cases, "unification" should be a fairly simple matter to accomplish without bugging the humans at all.
Observe: Virtually all networked computing devices, of the sort that people routinely interact with, have some sort of UTC(or trivially convertible to UTC) internal representation of real time, along with a localization parameter that tells them whether the user wants 12 or 24 hour time, and what time zone the user is in. Static devices generally ask for timezone on setup, devices with location capabilities can adjust as they move.
Those two ingredients really give you most of what you need for UIs and groupware/calendaring type software to iron timezone issues out in the background, while still letting everyone who isn't necessarily a jet-lagged globetrotter use a set of local times that roughly correspond to what the sun is doing where they are. Some packages already do support this, to a greater or lesser extent. If Bob, in the eastern US, sends Alice, in Hong Kong, a meeting request for "6pm", the system can just look at Bob's timezone localization, send the UTC equivalent of "6pm in bob world" to Alice's computer, which can then display the time that is locally meaningful to Alice according to her localization.
As with many UI/UX problems, there will be a bunch of ugly details, legacy quirks, and other messiness; but the problem isn't really rocket surgery: we already have substantial "unification" in terms of the internal representations, and we have a set of definitions(some more idiosyncratic than others; but all convertible to/from the unified internal representation format). The rest is just ugly details.
" Eleven carriers are found to impose a quite aggressive timeout value of less than 10 minutes for idle TCP connections,
potentially frequently disrupting long-lived connections maintained by applications such as push-based email. The resulting extra radio activities on a mobile device could use more
than 10% of battery per day compared to those under a more
conservative timeout value (e.g., 30 minutes)"
Apparently, the desire is not to drain the battery; but the telco is willing to do so in order to cut down on the number of TCP connections they need to deal with.
On the other hand, after working at MS, he went on to found Valve, which begat Steam, the (now cross-platform) online gaming/distribution/DRM/etc. platform that is widely regarded as utterly murdering "Games for Windows Live" on basically every level. It isn't clear that they would necessarily be buddies anymore, at least while on the clock...
Out of curiosity: I've seen a number of systems that use screwless drive rails that take advantage of the fact that the 3 screw holes on each side, and 4 on the bottom(for 3.5", 2.5" has something slightly different; but also fairly standard) by having pegs, just slightly smaller than the screws would be, that slide in to the holes. As long as modest pressure is applied to keep them in the holes(they aren't threaded or tight enough to be friction fit), the setup is pretty solid. Could a gripper mechanism employ either similar peg-insertion directly, or have an internal supply of rails with a good grip on one side, and pegs on the other(possibly even two internal supplies, one for 3.5"s and larger 'shim' ones for 2.5"s)?
Pulling and replacing drives from hot-swap slots in a drive shelf would only be a slight change from the long-available robotic tape silo systems; but I've never heard of a situation where rigging such a thing up made economic sense...
Your hot-spares provide immediate 'replacement', which allows you to make physical replacement less time-critical just by adding more drives to the system, and most big-huge-storage systems have front mounted indicator lights for drive health.
Having a human on duty who gets paged with an aisle and rack number, grabs a spare drive, and goes over and swaps it out for the one with the red light just isn't all that expensive on the scale of such a system... With the homogeneity of the drives, and the automated monitoring, swapping dead drives is easier than stocking grocery shelves(the latter isn't rocket-surgery; but there are substantial variations in size, shape, density, crushability, changes in location according to daily/weekly promotional campaigns, etc. Yes, I've done both.) The biggest personnel expense, in the case of an "unnamed customer" buying a bespoke system from IBM, will probably be finding somebody who has sufficiently high clearance to touch the system; but is still willing to be a drive monkey...
I'm assuming that IBM has better plumbers than I do; because "reliability" is not the first word that comes to mind when somebody suggests water-cooling 200,000 hard drives...
And as such, we need to start expecting people to have basic computer literacy skills so they do not fall prey to such schemes. How many thousands upon thousands of times does it have to happen before people learn?
Hear, Hear! I can't tell you how many secretaries and mailroom minions I've had to fire because they couldn't detect zero-day vulnerability exploits!
You appear dangerously close to suggesting that something this embarrassing might be the fault of somebody who matters, rather than a cog who should have known better and is 'no longer working for the company', as they say... I'm not sure we can have such talk about our betters here...
My understanding is that the attack proceeded in multiple steps and that knocking over a soft target was just a convenient opening move. Anybody who can be cracked just by duping some support person is Doing It Wrong; but it is hard to imagine a structure where having access to one or more low privilege accounts wouldn't make an attacker's life somewhat easier.
Now, as for the broader question of why RSA retained the seed keys for a nontrivial slice of the US's more security-touchy corporations in any remotely online-accessible form, or why those customers accepted that arrangement... There are not words enough to condemn that level of folly.
Slashdot Mirror
Has anybody tried promoting the rumor that Falun Gong sympathizers are particularly fond of pirated software, and that a substantial portion of the Dalai Lama's publicity slush fund is paid for by bootleg software sales?
Plus, allowing the price of a commodity to equal its marginal cost of production is absolutely textbook decadent capitalist behavior...
If it's detected, make it so that you hold their computers and data hostage by forcibly locking them out and threatening to erase their data if the proper verifications don't occur.
Yeah, it's strongarm tactics, but if you're living outside the law, you can't exactly complain to the cops to help you out that someone's bullying you.
Terrible Plan:
You can, in fact, complain to the cops. With limited exceptions for self defense against imminent threats, most jurisdictions take a very, very dim view of vigilante justice. Even if you are 100% accurate, and never hit a false positive, do you think that the fact that you have legal grounds for a copyright infringement civil suit against somebody is going to save your ass from the slammer after you've committed a bunch of unauthorized-access and extortion related felonies? Don't bet on it. This is particularly the case if the copyright infringement is going on somewhere where the local authorities make a policy of turning a blind eye to that sort of thing; but take a much less indulgent stance on economic disruption by outsiders, whatever their justification.
And don't even think about losing the receipt for your fancy new licence tracking and compliance software 'solution'. Getting busted for pirating one of those is just adding insult to injury...
The assumption that I posses a mysterious "free will" that is somehow divorced from cause and effect(except in that it causes me to act) is simply too convenient to abandon!
Battery technology certainly is evolving; but the "put power in" part is a fairly reasonable place to put a nice abstracted interface.
The cloud guys certainly do need hardware, and by the truckload; but I suspect that they make comparatively lousy customers:
Your smaller shops tend to have limited bargaining power, and often no choice but to over-provision with respect to their needs(Can't have just one web/file/exchange server because it might fail; but don't have enough load to keep that one over 50% utilization, much less give the backup any exercise unless the primary should happen to go down...)
The(successful) cloud outfits, by contrast, tend to have in-house expertise in management and provisioning tools(so your 'value-add' management crapware isn't a selling point) and fairly tight control over utilization(or they'll be out of business) and some sort of software-level failover scheme in place. So they certainly do need servers, by the rack; but they are unlikely to have any interest in paying more than commodity prices, and are also unlikely to take any upsells to more expensive fault tolerant gear.
They are sort of the server equivalent of supplying house-brand desktops to WalMart: The volume is there; but you won't like the margins, and there are plenty of people who could replace you...
I am fond of webOS(application base is tiny; but the interface is actually quite well thought out. The "cards" work quite well. Hell, maybe team Google will pick up their smoldering remains at the firesale and polish up the 'chromebooks' with some of the UI touches...)
As for the IBM analogy, though, HP has a hard road ahead of it. IBM has always made hardware; but they've always had a software/support/consulting arm extracting its pound of flesh along with the hardware, from back when their job was to customize the Hollerith card reader for your application up the the present 'enterprise database middleware yadda yadda' stuff. They did ditch their desktop/laptop business, and they will, if asked, sell you some bare servers, dell style, for just cost+warranty; but they have always been a combined hardware/services entity. HP, by contrast, is more of a pure hardware/engineering shop that has been bleeding actual engineering talent for a while now.
I've heard that their Big Serious Expensive has its points; but every interaction with HP software that I've had down at the "commodity x86s and their peripherals" level has filled me with an unquenchable desire for bloody vengeance upon every last persons responsible for it.
Their winCE thin clients have had timekeeping bugs in certain models(that engineering kindly verified and then decided not to fix...) Their linux ones have glaring security deficiencies that they wouldn't even acknowledge our bug reports about(Hypothetically, if you were adding a diagnostic page that allowed the user of a 'kiosk' system to use ping to verify connectivity, would you implement it by giving them a freeform text field and then prepending 'ping' to whatever they entered and dumping it straight to the shell without any sanitization? Well, the input "$IP_ADDRESS && xterm" certainly suggests that HP did... For extra credit, the 'kiosk' program was running under a passwordless account on the sudoers list...)
The firmware of their network printers has been a mess for years, and their printer drivers(even for the workgroup networked printers with PCL/Postscript, let's not even talk about the direct-attached inkjet shit) actually seems to be getting worse as time goes on. Servers and workstations are ok, largely by virtue of being more or less stock intel or AMD kit, with drivers provided by people who don't utterly suck.
I know that hardware's margins don't keep the Wall street boys happy; but what sort of insanity could convince HP that they are a software company?
Arguably, we Do Not need ActiveX all over again; but we do need an (actually competent) implementation of what things like ActiveX were trying to accomplish...
.exe that somebody offers them, which isn't exactly a triumph of security(particularly since prompting for elevated rights is standard behavior for installers...)
While it is possible, and sometimes desirable, to increase security just by paring away as much power as you can get away with, that doesn't fly in the broader market. People want their games, and their videos, and whatnot. If they can't get them in-browser, they'll get them by downloading every friendly
If you cannot protect somebody from something running in-browser, you don't actually solve the problem by not trying, you just shove it off onto the OS, which hasn't shown a brilliant track record of protecting people from the things they run, and offers less convenience in things like install/uninstall/update/synchronization...
Turning it on, without prompts, for all domains, by default, unless you are very, very certain is, of course, a terrible plan; but there is nothing fundamentally more hopeless about protecting people from browser plugins than protecting people from downloaded binaries, and history suggests that if they can't have what they want from the former, they'll enthusiastically click through whatever the latter asks them for...
I'm of the opinion that the raw food movement is vitalist nonsense(yes, switching from the twinkie diet to a raw food diet might incidentally be good for you; but not because cooking destroys the magic life vital principle in foods...)
However, it is my understanding that the fossil evidence we have is pretty definite on the decline in population-level health(and the enormous increase in population density) once humans began farming.
I believe so, which is why I find the notion of flattening time zones to be pointless already, and getting more pointless as time goes on.
Probably don't need to worry about our slimy overlords; but it would be interesting to know if this bit of immune-boosting quasi-bestiality helped make humans the pervasive species they are:
Compared to hunter-gatherers, residents of combination agricultural and town/city civilizations are horribly disease riddled. Animal husbandry means zoonotic diseases and parasites in horrific quantity, grain-based agriculture means truly hideous oral health, and urbanization means drinking and sleeping where you shit. It's only in places with 19th+ century sanitation and 20th+ century medicine that the advantages of wealth and technology in sedentary civilizations started to translate into disease levels less horrid than pre-agricultural ones(even then, things like the yearly flu shot because some new combination of porcine, avian, and human viruses has emerged is a classic animal-husbandry parasite issue).. One wonders if any other reasonably-smart hominids ever took a crack at farming; but had to give it up or die because their immune systems just couldn't hack it...
It wouldn't; but(at least in the cross-timezone conversations I've encountered, the use of "Xpm my time" or "Yam your time" seem to be adopted pretty naturally, and not to impose too much difficulty on the user. If people need clarification, they ask, if contact is frequent(eg. a company and an offshore partner) a convention is established...
It isn't perfect; but humans are pretty good at dealing with natural-language ambiguities, probably better than dealing with times that have absolutely no correspondence to local solar position.
Apparently, one of the major upsides of sex(from a darwinian, rather than purely recreational, perspective) of the not-intuitively-all-that-sensible arrangement of having to seek out a conspecific, risk sexually transmitted infection, and mate simply in order to reproduce, is the rapid genetic diversification you can achieve by recombining genomes with others. Your asexual organisms have it much easier; but they have to depend on mutation(or, as with some bacteria, quasi-sex genetic exchange mechanisms).
The neat organisms, in my opinion, are the edge cases that can go either way. this piece(sorry about the paywall...) examines snails that can either reproduce sexually or spawn clones asexually. As it turns out, in areas with higher parasite loads, the snails resort to sex at much higher rates in order to keep abreast of the parasite threat, while the less pressured snails go for the rapid and low-risk strategy of asexual cloning.
Arguably, in an increasing number of cases, "unification" should be a fairly simple matter to accomplish without bugging the humans at all.
Observe: Virtually all networked computing devices, of the sort that people routinely interact with, have some sort of UTC(or trivially convertible to UTC) internal representation of real time, along with a localization parameter that tells them whether the user wants 12 or 24 hour time, and what time zone the user is in. Static devices generally ask for timezone on setup, devices with location capabilities can adjust as they move.
Those two ingredients really give you most of what you need for UIs and groupware/calendaring type software to iron timezone issues out in the background, while still letting everyone who isn't necessarily a jet-lagged globetrotter use a set of local times that roughly correspond to what the sun is doing where they are. Some packages already do support this, to a greater or lesser extent. If Bob, in the eastern US, sends Alice, in Hong Kong, a meeting request for "6pm", the system can just look at Bob's timezone localization, send the UTC equivalent of "6pm in bob world" to Alice's computer, which can then display the time that is locally meaningful to Alice according to her localization.
As with many UI/UX problems, there will be a bunch of ugly details, legacy quirks, and other messiness; but the problem isn't really rocket surgery: we already have substantial "unification" in terms of the internal representations, and we have a set of definitions(some more idiosyncratic than others; but all convertible to/from the unified internal representation format). The rest is just ugly details.
" Eleven carriers are found to impose a quite aggressive timeout value of less than 10 minutes for idle TCP connections, potentially frequently disrupting long-lived connections maintained by applications such as push-based email. The resulting extra radio activities on a mobile device could use more than 10% of battery per day compared to those under a more conservative timeout value (e.g., 30 minutes)"
Apparently, the desire is not to drain the battery; but the telco is willing to do so in order to cut down on the number of TCP connections they need to deal with.
And, ironically, it will be the Controller players who have a (crippled) aimbot built into the game just to help them keep up...
On the other hand, after working at MS, he went on to found Valve, which begat Steam, the (now cross-platform) online gaming/distribution/DRM/etc. platform that is widely regarded as utterly murdering "Games for Windows Live" on basically every level. It isn't clear that they would necessarily be buddies anymore, at least while on the clock...
Out of curiosity: I've seen a number of systems that use screwless drive rails that take advantage of the fact that the 3 screw holes on each side, and 4 on the bottom(for 3.5", 2.5" has something slightly different; but also fairly standard) by having pegs, just slightly smaller than the screws would be, that slide in to the holes. As long as modest pressure is applied to keep them in the holes(they aren't threaded or tight enough to be friction fit), the setup is pretty solid. Could a gripper mechanism employ either similar peg-insertion directly, or have an internal supply of rails with a good grip on one side, and pegs on the other(possibly even two internal supplies, one for 3.5"s and larger 'shim' ones for 2.5"s)?
Pulling and replacing drives from hot-swap slots in a drive shelf would only be a slight change from the long-available robotic tape silo systems; but I've never heard of a situation where rigging such a thing up made economic sense...
Your hot-spares provide immediate 'replacement', which allows you to make physical replacement less time-critical just by adding more drives to the system, and most big-huge-storage systems have front mounted indicator lights for drive health.
Having a human on duty who gets paged with an aisle and rack number, grabs a spare drive, and goes over and swaps it out for the one with the red light just isn't all that expensive on the scale of such a system... With the homogeneity of the drives, and the automated monitoring, swapping dead drives is easier than stocking grocery shelves(the latter isn't rocket-surgery; but there are substantial variations in size, shape, density, crushability, changes in location according to daily/weekly promotional campaigns, etc. Yes, I've done both.) The biggest personnel expense, in the case of an "unnamed customer" buying a bespoke system from IBM, will probably be finding somebody who has sufficiently high clearance to touch the system; but is still willing to be a drive monkey...
I'm assuming that IBM has better plumbers than I do; because "reliability" is not the first word that comes to mind when somebody suggests water-cooling 200,000 hard drives...
Maybe not the sort of gear that DC-weenies churn out; but AC systems should be familiar with the imaginary power produced by theoretical generators.
And as such, we need to start expecting people to have basic computer literacy skills so they do not fall prey to such schemes. How many thousands upon thousands of times does it have to happen before people learn?
Hear, Hear! I can't tell you how many secretaries and mailroom minions I've had to fire because they couldn't detect zero-day vulnerability exploits!
You appear dangerously close to suggesting that something this embarrassing might be the fault of somebody who matters, rather than a cog who should have known better and is 'no longer working for the company', as they say... I'm not sure we can have such talk about our betters here...
My understanding is that the attack proceeded in multiple steps and that knocking over a soft target was just a convenient opening move. Anybody who can be cracked just by duping some support person is Doing It Wrong; but it is hard to imagine a structure where having access to one or more low privilege accounts wouldn't make an attacker's life somewhat easier.
Now, as for the broader question of why RSA retained the seed keys for a nontrivial slice of the US's more security-touchy corporations in any remotely online-accessible form, or why those customers accepted that arrangement... There are not words enough to condemn that level of folly.