Posts by Anteaus

Hacker pwns police cruiser and lives to tell tale

Config mistakes?

Way I would read this is that the equipment wasn't at fault, it was the guys who set it up didn't know what they were doing. Any IT guy worth his or her salt knows that:

Routers and other devices have default passwords. They have to, or you wouldn't be able to set them up in the first place. You don't, however, leave them like that.

If you forward an inbound port, you also create a firewall rule to restrict the IPs that port can be seen from. Or, if you want the port to be globally accessible you implement some form of strong encryption.

Since the router or DVR equipment manufacturer can't predict exactly how the kit will be used, it would be unreasonable to expect them to warn that a certain combination of kit, with unsuitable settings, will create a security risk.

Save the planet: Stop the Greens

Don't think so.

The issue here is not whether there are environmental concerns, but what those environmental concerns are. Pollution, yes, that is a concern, and a possible reason to avoid coal. But CO2 is not a pollutant.

Wastage of limited natural resources on a pointless exercise is also a key issue. The efficiency of any plant using carbon capture will be substantially lower than that of one without.

I can't help but think there are parallels between this scheme and the old American 'gas guzzler' cars, some of which managed only 3mpg due to ill-conceived 'smog control' measures which still further reduced the efficiency of an already inefficient vehicle to the point where an engine of ridiculous size was needed even just to achieve acceptable performance. I could forsee a similar positive-feedback loop applying here, with larger and larger power stations being needed to achieve the same output, but at much lower efficiency. If these 'green' power-stations guzzle the remainder of our gas reserves they will do us no favours.

As for funding, the cost of the carbon-capture pilot alone is touted as a billion.

I don't hold out much hope for ITER, it is a dead-end technology. Even if it can demonstrate continuous fusion at breakeven levels, there is no known way of extracting the energy it would produce. Meanwhile, a pilot-scale Bussard plant would cost a great deal less than the CC pilot.

Now, everyone's afraid to waste money on long-shot fringe science, and rightly so. But in this context what is carbon capture but fringe science? OK the technology is mostly based on proven stuff, but can it be shown to achieve anything useful? If every powerplant is converted to CC but global temperatures continue to rise regardless.. where are we then? Billions or trillions worse off, energy reserves squandered, and the chance to find a better solution wasted. That's where we are.

Unreal...

http://www.bbc.co.uk/news/uk-scotland-13253876

So, now your windfarm pays you more if you switch it off.

Here is an example of 'green effect.'

OK this has been commented to the hilt already, but thought I'd add these links:

http://www.decc.gov.uk/en/content/cms/what_we_do/uk_supply/energy_mix/ccs/ccs.aspx

"This is the largest public funding contribution in the world to a single CCS project, ensuring that the UK will continue to lead the way on large-scale demonstration."

http://www.bellona.org/ccs/Artikler/pre_combustion

Gives an idea what's involved.

-and which hint at the sheer amount of taxpayers' money being wasted on 'carbon capture' projects.

-So' we're going to spend huge wads of cash and loads of scientists' time on developing these extremely questionable technologies to trap CO2. Then of course we have to burn MORE of our limited fossil fuels because of the lower efficiency of these schemes. So, we run-out sooner.

I firmly believe that if the cash were put into fusion research instead, we'd have an answer in a few years. Or, even photovoltaic cell research would be a wiser spend. Low cost, high efficiency solar panels would at least have a use, especially in developing countries.

Maybe we should all lobby our MPs to stop this nonsense.

Fusion yes, Tokamak,no.

The reason fusion power has gone nowhere is that almost all of the money is being poured-into just one branch of that science, namely the Tokamak or toroidal magnetic-bottle style of reactor. Some research is now being done into laser fusion, but that is only recent.

The Farnsworth electrostatic-confinement fusor was producing actual hydrogen fusion, albeit at a low level, long before the big Tokamak projects got off the ground. The Tokamaks have only recently produced low-level fusion after countless years of trying, and billions spent.

Opinions have been voiced that the reason so much money has been poured-into just one field of fusion research that has produced virtually no useful results is that the oil companies see this as a safe option, since Tokamaks will never challenge the dominance of oil, whereas some other technologies just might do. I don't hold much for conspiracy theories, but it does beg the question.. why? If a simple, inexpensive apparatus was already producing measurable results, why spend 40 years trying to get one very bulky and very expensive apparatus to do the same?

A development of the Farnsworth machine, the Bussard or Polywell reactor, certainly has the theoretical potential to produce power on a commercial scale. Yet, it has suffered from serious lack of funding, hence the slow progress.

A viable fusion powerplant would in any case more likely use hydrogen-boron fusion rather than the deuterium-tritium fusion currently being explored in Tokamaks. The reason is that D-T fusion generates fast neutrons which tend to damage the apparatus, not to mention ruining any electronic equipment inside the shielding. Which would make control and monitoring extremely difficult.

Hydrogen-boron fusion calls for energy levels which no present Tokamak can reach, and which are probably beyond the theoretical capability of any Tokamak design. Meanwhile, Farnsworth/Bussard reactors could exploit the less problematic H-B reaction, as it is within their theoretical capability given a moderate upscale of present test plant.

As far as proof of concept goes, at least with fusion we have one. Nature has done this before, albeit with a very simple apparatus but much larger supplies of fuel. The sun. We therefore know it can be done. There is no question about that. We just need to figure-out how to duplicate those results, but on a smaller scale.

First though, we need to stop flogging the dead horse and look at ALL the available options.

Google to sell subscriptions to Chrome OS notebooks?

Hmmm...

Not seen this so not sure how it will work in practice, but in my experience it's plugins which run inside a browser which are the main security problem. The way to make a browsing computer secure is to minimize the number of plugins. This is why IE has such poor security, because there are a billion ways of launching exploitable code from it.

Now, if you have to use the same browser for trusted sites as for general browsing, does that mean you have to do everything with all plugins enabled?

As regards online apps, Google Docs works better than most, but in general I loathe browser-based apps. One of the worst features of CMS websites is that you can't save your work to a local file, and you can't save your work without losing your place in a large document, because saving triggers a page reload. Thus you don't do periodic saves, and so end-up losing your work when the connection goes down.

Boffins pull plug on SETI alien-seeking antenna array

Unlikely to succeed, but...

Agree that SETI is unlikely to find anything, since the timespan over which a civilization uses radio is probably too short. The likelihood of any near us to be doing so right now (or a few hundred years ago to allow for transit time!) is slim.

Though, if they want funding, they need to weave a climate-change argument into the request. Then billions, not a few paltry millions, will flow in.

Legal goons threaten researcher for reporting security bug

Nothing too unusual

A while back was running the Spamwise site, which helped to uncover vulns in BBS, Web directories and the like which (mostly through stupid coding mistakes rather than actual intent) were leaking subscribers' email addresses to spammers.

Most sites thanked us, but a few reacted like this.

I suppose the bottom line is that some siteowners are more interested in beancounters than binaries, and anything which is seen to damage their business cred is reacted-to with seething hostility.

Google sued over – yes – Android location tracking

Bug found

"Hey Steve, I've found the bug. There were these two slashes on the line that was supposed to delete the old data. I guess someone must've knocked the keyboard when we were rebuilding it."

Apple breaks location-storing silence

Correlation = Spying

I think this underlines a more general point, which is that having too many facets of your life rely on one service, or one device, creates a security issue. From that point of view a separate GPS is less convenient to carry around than a combined GPS/phone, but avoids the issue of data misappropriation.

This principle of combining data was one of the key issues with the government's thankfully-failed ID Card scheme. Having to use the SAME card for numerous searches would have created security issues which the use of separate cards would not create. Plus, many such security issues would have been hard to anticipate.

Then again, how many phones now sport Facebook apps? OK, so an unscrupulous carrier could did a goldmine of info by correlating contacts in there, and GPS logs. And, so it goes on.

It's basically a situation where 2+2 does equal five, the sum total of combined info being worth more than its parts. The more devices and services are integrated, the greater the value of the combined data, and the greater the temptation for abuse.

Farewell, Novell

Novell priced themselves out

Having been originally trained as a Netware installer, I recall that platform with something of a grimace.

Basically, Novell had a good product for its time but priced themselves out of the market by way of punitive licensing arrangements. In one case we had to pay over £2000 to add two users to a system, because they refused to sell us two licenses and instead demanded that we buy a (one-point) version upgrade for the whole site.

It was after this experience we switched to NT.

Later they switched to Linux, but by that time we were using Microsoft or Debian and weren't interested.

Windows phones send user location to Microsoft

Missing the point I think..

AFAIUI these phones track your movements whilst NO nav or mapping software is running.

It might also be compared with the fact that a phone transmits your speech to the carrier when off-hook. This is an unavoidable part of its working. But, if it also did so ON-hook, I would start to wonder what the h*ck was going on, and why.

Earlier versions?

Anyone have the lowdown on WM6.5 or 6? Do these also contain spyware?

Never fancied 7 anyway because of its SD card encryption.

Cops raid man whose Wi-Fi was used to download child porn

Complex issue..

If you had at least tried to secure your WLAN you could say that you had acted with due diligence, and that what happened was in no way your fault.

But, as things were the cops should have noticed that that connection was public, and were negligent in not checking this. If the connection had been encrypted, the cops would have an excuse for not checking this aspect.

Though, on balance I think I'd prefer to take the preventive measure.

Google pours millions into wind power

Yes, interesting research

I wouldn't like to say if Bussard's ideas are viable or not, but they are based on Farnsworth's work, which was actually PRODUCING fusion, albeit at a low level, long before the Tokamak-based reactors produced a single fast neutron. On that basis it seems like a better area to put money into.

That, and at least the Polywell (Bussard reactor) guys have a scheme for generating power from a fullscale reactor. Albeit so far a theoretical one, because they don't have the cash to test it. The Tokamak guys, after billions spent on research, have so far shown that they could in principle ruin their apparatus with fusion-produced radiation and heat, but that's about all. They have no workable idea for extracting power from it.

Subsidies confuse the issue of windfarm viability.

Not sure what the Stateside situation is, but in the UK the main factor in the proliferation of windfarms is that they are subsidized.

While windpower may not necessarily be a bad thing, it's difficult to make any objective assessment of the economic viability where subsidies are involved. Even if we know how much subsidy was given, we don't know if the investor would have acted differently, sans subsidy.

Flash cache exploit debuts in Amnesty attack

To be expected if you...

Which I think goes to show that if you are going to lock horns with some people who don't care about human rights, then you need to make sure you protect your own rights. Especially, your website.

That said, I do have reservations about the current trends in UK/EU human rights legislation, which seems to have degenerated into a charter for pampered minority-groups to demand preferential treatment, and to sue the shirt off anyone who denies them special status.

Hell, as a topical example we can't even use red or green in games anymore.

This, IMHO, is a bastardisation of the original purpose and spirit of the HRA, which set-down rights which apply to ALL citizens, without exception or predjudice.

-The maintainer of a local Amnesty website for about a decade. (hopefully, malware-free)

Lawsuit targeting RockYou data breach gets green light

Non-bovine in nature...

From what I've read, binding of values doesn't guarantee escaping of all possible commands within those values.

In any event this is an attempt to solve a problem of unwanted and dangerous functionality by adding even more labyrinthine complexity. Not good, because there are guaranteed to be hidden, unexpected gotchas in such an approach.

The issue here cannot be properly resolved by any kind of coding tricks. It is that any system which allows commands to be embedded inside user-responses is fundamentally unsuitable for Web response-form use. Exactly what part of that is difficult to grasp?

Essence of situation:

Q: How many bags of potatoes do you want?

A: "3 AND launch missile in silo #37"

SQL: 3 supplied, and I obey. Boom.

If platform is defective... just demand the impossible of the coder!

These SQL injection vulns crop-up with monotonous regularity, and it's hardly any surprise that they do. The fact of the matter is that EVEN if you understand the nature of the risks (and some aspects are far from easy to understand!) it is virtually impossible to be certain that none exist in a large block of webpage code.

IMHO there is little point in punishing those who made the mistake leading to the vuln. Instead, it's time the base system was modified to eliminate this weakness.

Meanwhile, if the courts want to do something productive in terms of improving Web security, they would be better to go after sites and software which leak bulk quantities of users' email addresses to spammers, not by mistake but through deliberate negligence. There are after all enough of those to keep 'em in legal fees for a while.

Hunting of incredibly rare two-horned 'unicorns' forbidden

Pointing in wrong direction

A unicorn horn points forward. The myth probably arose from seeing a medieval knight holding his lance such that the point seemed to emerge from the horse's head.

Perverted Justice vigilante sentenced for DDoS attacks

OK so you're the editor...

.. of Rolling Stone or Radar, and you're offered a story which you know is part of an orchestrated campaign of malice.

Do you publish?

If you publish, and become the subject of a DoS attack by the victim of this campaign of malice, do you then launch a retaliatory legal attack against the victim of the malice, or do you simply acknowledge that you should not have done that, and that the consequences are your own fault?

Anyone with an ounce of moral fiber would do the latter, methinks.

IP registry goes to Defcon 1 as IPv4 doomsday nears

Bad design = poor acceptance

Cursing yesterday when I typed ipconfig on a customer's remote computer, and had to spend ages trying to find the IP address somewhere in the midst of the screeds of crap which scrolled right offscreen. Since it was Vista I made excuses about Vista being useless. But of course, any IPv6 OS is the same.

Industry has had a decade to switch to IPv6, and the fact that uptake was so low should have been a warning to the standards guys that they needed to rethink. Unfortunately, it's probably now too late to implement a better standard.

Teens who listen to music a lot are at high risk of depression

Not surprising really.

A standard principle of brainwashing is that if you keep repeating something enough times, people will start believing it. If you listen to depressing music enough, you will eventually become depressed. Though, I would have thought that sob-story C&W would be worse in that respect than pop.

Then again, does aggressive thrash-metal make teens violent? Maybe it does. There are enough violent yobs around these days, and no-one can offer any other explanation of why they're like that. A lot of kids of that age are into the metal scene. Connection? Now, I actually like some classic metal, but I admit that it could put a suggestible person into a very evil state of mind.

For coding, I find that something ethereal or relaxing greatly aids my concentration. Ozrics, Tangerine Dream or Mozart, for example.

Adobe warns of attacks exploiting critical Flash flaw

"Rich user experience" to blame.

MS are so keen on this cliche - along with "Tight integration" but somehow can't see that it's at the root of most PC security problems. They're not called Trojan Horses for 'nowt, and every time MS invents another risky file-embedding technology, they create another opportunity for something nasty to get onto your computer by a totally-unexpected route.

Avast alert finds WHOLE WEB malign

Questionable effectiveness

Every IT manager pays lip-service to the demand of installing resident antivirus software, but in reality it isn't that effective as a protection. Mainly because the dangerous malware is the new stuff which hasn't yet been examined and catalogued by the AV people. That, and feature-bloat is a major problem with AV software. I guess this is because to the uninitiated, the package with the most 'shields' seems -on paper- like the better one, so to win the sales-war every vendor has to bloat their offerings to the max.

What users don't realise, of course, is that most of these 'shields' are just pointlessly duplicating the action of the core product. If a webpage is scanned before you're allowed to open it, if any file-download from that site is filtered as a data stream, if the downloaded file is then scanned as it is saved to disk, and then scanned yet again as it's launched, how does that achieve anything that scanning the file once doesn't?

The best protection is achieved by a combination of (some or all) of:

Using a more-secure browser

Removing unneeded plugins

Running the browser with limited priveleges

Using a virtual machine

Setting a software-restriction policy which prevents users from launching downloaded .exes

A simple AV product which scans all executable files as they arrive.

GCHQ commits schoolboy security blunder

Who is to blame here, user or coder?

I'm in two minds as to whether this is the fault of the software, or the fault of the user. Yes, us geeks know not to use CC for multiple addresses... but is it reasonable to expect the average appliance-user to know WHY that is bad practice?

Is a user of an electric shower supposed to study the differences between a TNC/S or a TT electrical supply before they use the appliance? Or, would they assume that provided they operate the controls correctly, they should be safe?

By the same token, suppose an 'appliance user' updates a CMS webpage and in doing so types an email address. The software they're using then automatically converts the address into a 'click to mail me' URL.

The user draws the conclusion that (a) this is marvellously helpful and brilliant software design, and (b) that there can't possibly be anything wrong with doing this, or the 'smart' software would surely have said so. On the strength of this, they decide to put all of their colleagues' email addresses on the webpage too. After all, why not, it's helping people to contact them is it not?

I shouldn't need to explain what the outcome of this will be. (Cue four vikings sitting in a cafe...)

When you think about the CC/BCC issue in the same context, maybe software should warn the user if they type more than a specified number of addresses into a CC field. Say, five or ten.

-Paris, because she knows what it's like to have your private stuff published all over the place.

How is SSL hopelessly broken? Let us count the ways

Related problem

A related problem is that browsers like FF are now being configured to make it hard for users to accept self-signed certs. This led to us having to take SSL off clients' webmail connections because users kept complaining that 'the browser said the security was faulty.' Result: No security.

This situation is also, I suspect, responsible for the number of requests for certs relating to mailservers running on subdomains.

All of which shows that ill thought-out security can reduce security instead of improving it.

Dutch astronaut unleashes 155 mph 'Superbus'

Oh bollards!

I can forsee those doors getting bashed to pulp rather quickly, thanks to the EU's past schemes to line the edge of every pavement in Europe with a million iron spikes.

It's the oldest working Seagate drive in the UK

HD Reliability woes

In my workshop I've a stack of dead HDs of all makes. 2.5 and 3.5. IDE and SATA. I wouldn't like to say which manufacturer has the best reliability, but I wouldl rate now-defunct ExcelStor as the worst ever encountered, with literally 100% failure.

The problem with modern HDs seems to be that the firmware is on the platter instead of in a ROM, and it only takes the slightest glitch for it to be over-written. Result, dead disk which can only be revived by way of special procedures, if at all..

Email compromised at Epsilon

Which underlines the risks..

..of posting naked-and-vulnerable Mailtos on webpages. In that case, no sophisticated exploit needed, just a spammer with relatively-simple harvesting robot to collect the addresses, and you're in exactly the same kind of trouble.

Fukushima's toxic legacy: Ignorance and fear

Failure of safety equipment is what mattters

The fact that there was no great release of radiation is immaterial.

Suppose you fit a burglar alarm to your house. A thief enters, and the alarm fails to sound. The thief decides there is nothing he wants, and leaves empty-handed. Does that mean the alarm is perfectly OK?

What matters here is that the safety provisions failed to prevent a critical situation. That critical situation could well have led-to a meltdown, or even a Chernobyl-style explosion. In fact, it very nearly did. The safety features are therefore NOT satisfactory. That is the lesson we need to learn from it.

Channel VAT loophole shrunk, not shut

Much bigger loophole.

The biggest VAT loophole is that registered businesses can reclaim VAT on goods for internal use, thus everything they buy for themselves is effectively zero rated. It's time this loophole was closed, and they were made to pay fairly for goods, same as everyone else.

MS claims credit for Rustock botnet takedown

Well done!

Though, the spammers might not be the only ones miffed about this. I'm betting some DNSBL operators are grinding their axes and calling Microsoft all kinds of unmentionable things.

Fortunately, I somehow doubt they'd have the brass neck to blacklist 207.46.0.0/16 in retaliation for the proportional reduction in filtering-service revenue.

UK cyclists hit by fraud after online purchase at website

Not necessarily software

While a software security issue may be involved, the possibility that an employee is doing this shouldn't be overlooked. The fact is that anyone with your card details and security number can make a deduction, and it need not relate to an actual purchase. The company should make a careful check of logs for anyone making unauthorised logins to the ecommerce software, or for issues like authorised staff leaving computers unattended with payment-handling software running.

I tend to prefer PayPal for buying online. That way, only one transaction is possible per purchase, and I determine the amount paid, not the seller.

I daresay there are security issues with PayPal too, but IMHO it's a safer system.

Traffic-light plague sweeps UK: Safety culture strangles Blighty

Infinitely worse for all road users

Just down the road from here they've put in about ten sets of lights where previously there was one roundabout and one set of lights. There are now traffic jams all day. There were never any serious jams before.

I walk up that road frequently, and walking is a slow process too. Every junction involves waiting for two sets of pedestrian lights, sometimes three. The place is lined with 'cattle fences' to stop people crossing anywhere else except the lights, and cyclists are concerned about being crushed against these. Hence, although there are cycle lanes, they use the pavement.

Then there is a rash of the 'bollard disease' where a section of pavement already too narrow for the volume of foot-traffic has had a third of its already-inadequate width taken away by a set of metal spikes stuck in the ground. What for, God knows.

That, and they're using a new style of lights with no 'green man' except at the pushbutton. That means you have to rely purely on the audible signal, or the person nearest the button starting to cross, you don't actually know if the lights are red or green. I've seem several cases where a brake-squeal has led-to pedestrians stepping-into the path of traffic. Sooner or later there's going to be an incident where a bus or lorry with squeaky brakes mows-down a crowd of people.

Not far away, there is a junction where you have to make violent swerve into the outside lane with only a few yards' warning, to avoid being chicaned-off left. You can tell when you're walking near this junction, by the constant peal of horns and the occasional screech of tyres.

-Thing is, I'm not aware that there was any particular traffic problem in this street before they started on these changes. All of the problems have been created BY the changes.

-What do these planners smoke, I ask?

Oracle gives 21 (new) reasons to uninstall Java

Web access is the issue

The mistake isn't in having coding runtimes, it's in making those runtimes accessible to websites by way of browser plugins, and in doing so without the user's knowledge or consent. I daresay that qbasic could be used to write malware; the difference is that qbasic code cannot be run inside a browser. Java, .net and in some cases .vbs can be, and this is what makes them dangerous.

If you use a Mozilla browser you can edit greprefs\all.js to stop java (and other large attack-surface plugins) being automatically loaded into the browser. Type about:plugins in the URL bar to see just how wide an attack-surface you're exposing. You may be surprised.

Been doing that for years.

It must be a decade since any major website used Java. Most people don't realise that though.

One of the key issues used to be (and maybe still is) is that new Java versions don't remove older ones. And, java apps can dictate which of several versions present is to be used. Thus, upgrading confers NO security advantage UNLESS you also manually remove old versions. The more old versions still gathering dust in Add/Remove Progams, the wider the attack-surface you are presenting to malicious websites.

An alternative to removal (if for example you use OO) is to turn off Java in browsers. You can do this with the settings, or a more secure way in Mozilla browsers (which applies to all profiles and can't be so easily over-ridden) is to modify the greprefs\all.js file:

pref("security.enable_java", false);

is the line you need to change, from true.

German Foreign Office kills desktop Linux, hugs Windows XP

Wait till they 'upgrade'

The problem they're really gonna hit is when they try to 'upgrade' to Win7, because that's when they'll find the real compatibility snags arising. IME, Linux and XP computers on the same LAN can coexist reasonably well, but Win7 and XP computers don't get-on well together for numerous reasons. This is especially so in a domain environment.

This means that the 'upgrade' to Win7 preferably needs to be done in one fell swoop to avoid these issues, perhaps over a weekend. But, imagine the costs involved in doing so, not to mention the downtime if any snag is hit.

Malware endemic even on protected PCs

Cloud has other security issues too..

A point raised on allspammedup.com is that spammers have latched-on to the fact that with the trend toward IMAP instead of POP mail, more and more users now leave their entire email collection on a cloud server instead of, or as well as, downloading it onto a PC. This opens the possibility of 'bots being used to find accounts with weak passwords and harvest the From: addresses of the emails therein. Naturally these addresses then get hammered with p*nis-pill ads.

Thus, having a weak password on a cloud account has deeper implications that you might think. It can cause harm to your associates, as well as to yourself.

How many false positives, though?

Not only is AV software less effective than it used to be at trapping attacks, it also generates an increasing number of false alarms. Most common among these is finding any executable built with the UPX compactor as malware.

If I scan my (readonly) program-store share with Clam, it finds perhaps 10-15 false positives. Fortunately I know which these are and that they are not infected.

The only way to be reasonably certain these days is to do a CRC comparison with a known-good copy of the file, or upload it to virustotal for an opinion.

I don't think this situation weighs in-favour of cloud computing, but it does suggest that running executables from readonly server-shares instead of the local HD has its advantages.

Starbucks' iPhone barcode app easily scammed by screengrab

Bit like ID cards really...

This underlines one of the key issues with the now thankfully defunct ID card scheme, and with RFID passports. If another person can easily copy and re-use your credentials, then the ID system facilitates crime instead of preventing it.

DEC: The best of systems, the worst of systems

You could recognise a DEC engineer by..

..the lacerated fingers.

Thing I instantly recall about DEC PCs was the razor-sharp, unfinished metal edges inside. Very nasty to work on, especially as they seemed to go for ultra-compact layouts which meant digging-in tight corners to fit HDs etc..

Only ever pulled one PDP apart, and I don't recall it having the same 'sharps' problem as the PCs.

(There isn't a thumb dripping red stuff icon so..)

Your mind's '.brain' jpeg-like picture file format probed

RAM storage, so no problem.

"Well, back in the days I've always been amazed how some of my fellow students were able to compress data."

Yes, but it's mostly stored in the SODIMM area of the cortex. After each exam, a pulse to 0v on the /RST line clears the way for the next exam's data. Hence, only enough storage for one paper is ever needed. <g>

Anonymous hack showed password re-use becoming endemic

Forums one thing..

...and I likewise use low-quality passwords in forums, mainly because of the need to be able to remember them when working in several places. But, not for things that matter.

The more worrying aspect though, is the growing trend towards global web-access to company files. Here, Microsoft enforce 'password complexity' which sounds clever but isn't. In fact, password-complexity rules disbar a lot of strong but memorizable passwords, and enforce the use of either non-memorizable or else weak passwords. For example the reasonably strong "nobodywilleverguessthispassword" is disbarred, but the very weak "Password1" is, ridiculously, allowed.

That, and I've never understood the reasons for forcing password-expiry. If the user has to keep changing the password, it more-or-less guarantees they will use "Password1" .. "Password2" and so on INSTEAD of a strong password which they only need memorize once.

What is password expiry meant to achieve anyway? If a hacker has had access to my files for 42 days, does it make any difference if I disallow an extra few days' access? Most likely (s)he will have done any damage they're gonna do, gotten fed-up and gone elsewhere long before then.

IMHO the best passwords are those which have a regular vowel/consonant structure, and thus look like words, but are nonsense. These are surprisingly easy to remember, but shouldn't be crackable by dictionary methods.

Nominet asks what you think of police domain grab

Reasonable, provided a warrant is required

..and adequate evidence having to be put on the table, but not without.

For examples of why this would otherwise be bad, you only have to look-at the 'vigilante justice' meted-out by DNSBL operators.

We've seen too many examples of police departments having very poor understanding of IT, and that opens the door to all kinds of exploits to get rival sites shut-down, by way of exploiting that lack of understanding.

Microsoft finally says adios to Autorun

Better than nothing, but not a reliable solution

Key thing here us the registry branch - HKCU. Change user (or have a problem with your userprofile, so it defaults itself) and autorun sneakily turns back on. You can also set the same value in HKLM (and should do) but this can still be over-ridden by a user setting.

See my earlier post (or http://windowssecrets.com/comp/071108#story1 ) for a more reliable method of nobbling it for all users.

Too true...

Even after setting NoDriveTypeAutoRun to 0xFF I've had it mysteriously come back on.

This page: http://windowssecrets.com/comp/071108#story1

documents a useful additional piece of protection, which if autorun does manage to launch, redirects it to perform a useless action instead of executing the commands in autorun.inf. I tested this idea with autorun ON and some simulated malware on removeable media, and it does seem to protect the computer.

Superphones: A security nightmare waiting to happen

A limited Linux user is a user that is NOT in the "sudoers" -EH?!?

To run sudo, you need to enter a password. That is, unless you configure it not to ask for one. Which, is up to you.

UAC never requires a password, plus it has the same problems of losing network connections, kicking-off VNC access, etc as logging-off and logging-back on. Worse, you can never tell when it will interrupt your work.

Sudo does work, and doesn't cause the same troubles as UAC. What's more, it's under the control of the user, rather than 'going-off' at random.

Windows and limited users .. nightmare.

"Windows makes it too easy to run with elevated permissions, if you change your work methodology to stop this, it's not too tricky to secure."

OK, so I make myself a limited user.

Try to install software from LAN share.. and told I must logon again (or RunAs) as Administrator.

OK, done that... and in the process lost all network shares, so now I can't install the software!

Try to re-create shares.. and get told that I need another CAL, as I'm now effectively a second 'user' even though it's the same computer. Fork-out cash to Microsoft, and try again.

Install software.. seems to go OK. Whew. Software now asks if I want to configure it.OK, seems sensible so I say Yes, and spend 30min getting it working the way I want.

Job done, logoff and change back to my own account, eager to use the new software.

But.. to my dismay, the settings have mostly defaulted. Nothing works properly. Groan inwardly, and go through the whole config process all over again. Only to hit certain items which I'm told can only be set by an Administrator.

At this point, seriously consider screaming and banging my head on the wall, but then decide that typing "net localgroup Administrators <user> add" might be less painful.

Meanwhile, limited-rights Linux user types "sudo apt-get install<whatever>" and it just works.

The difference is in the 'works' word. A small word, but a significant one.

'Personal Air Vehicle' VTOL jump-copter in key flight test

Rehash of an old idea

Unpowered rotating wings are not a new idea, in fact they predate the commercial development of the powered-rotor 'copter.

From what I understand -having examined a few autogyros at an aircraft maintainer's hangar some years back- they are easier to fly than a regular 'copter (no collective lever, and no rotor-induced yaw to complicate the control-inputs) but do have one or two nasty vices that powered rotors don't have.

The advantage over fixed-wing is that by running-up the rotor on the ground, a very short takeoff run is possible. Likewise on landing the lift from the rotor is maintained down to almost zero airspeed, making for a short roll. The things they can't do, of course, are to takeoff or land vertically, or hover.

As for me, I'd love a fullsize one of these to go to work in:

http://www.youtube.com/watch?v=gvH2f-AewX8

-A black one, naturally.

Now, that would turn heads. ;-)