Posts by Elongated Muskrat

Virgin Media sets up 'smart poles' next to cabinets to boost mobile network capacity

Re: "digital electricity" technology

Surely "digital electricity" is what you get if you put your fingers in an electric socket?

Exchange Online blocked from sending email to AOL and Yahoo

Re: AOL

If you've had the same email address for a quarter of a century, you get used to it.

OpenAI goes public with Musk emails, claiming he backed for-profit plans

Re: Musk OpenAI and Microsoft

...or... Space Karen sues them for doing something he made them do, and here are the emails to prove it?

Meanwhile, on Xitter, it's free speech if he agrees with it, and he'll sue you if he doesn't...

Twitter's ex-CEO, CFO, and managers sue Elon Musk for $128M

The funny thing about Teslas is that they were adored by liberal greenies everywhere greenwashing wankers as an excellent way of displaying their eco* virtue.

There, FTFY.

The average "liberal greenie" (if you can find one who doesn't cycle everywhere) doesn't earn enough to drive such an expensive car. Nobody ever got rich knitting tofu. Meanwhile, the Tesla has taken over from the white Audi as the car most likely to be driven six inches from your rear bumper at 80mph on the M4. It always was an arsehole's car, I can't recall anyone, ever, who fits the description of "greenie" advocating for me to buy one.

Meanwhile, whilst I live in a flat with no infrastructure for charging an EV, I will stick with my mid-range, practical, petrol car.

Re: Move over Donald

Why do people as rich as this become total dirtbags/scumbags/assholes in a very short time after getting rich?

I think you have cause and effect mixed up there, buddy.

Probably more like a 2k car on top of a 15k battery

They call me 'Growler'. I don't like you. Let's discuss your pay cut

Re: Depends on your definition of growler I guess.

That sounds like the sort of nickname one of our predatory salesmen would give himself.

It's called Wanker Tax.

Musk 'texts' Nadella about Windows 11's demands for a Microsoft account

Re: The tedious but non-convoluted way to do it...

Interesting to hear about the not creating a password bit. This is the process I went through when setting up my wife's new laptop for her. I didn't even know it let you set up the new admin account without a password. TBH, that's a bit of a gaping security hole, but the mandatory collection of identity-theft-worthy information as "security questions" is as well. It's appalling to think that in 2024, Microsoft still can't get security right.

Meanwhile...

A quick google turns up this...

"New drivers will need to download the Tesla app and create a Tesla Account before you can add their profile to your vehicle."

Yup, that's right - to drive a Tesla (let alone own one), you need to create an account with Tesla.

Now, I hold no particular love for, nor loyalty to, Microsoft, but that Elon Musk sure is a hypocritical dickhead.

Palantir boss says outfit's software the only reason the 'goose step' has not returned to Europe

Fine Fare

From a man whose boss is probably* currently dressed as Father Jack at the end of the episode, "Are You Right There Father Ted?"

*in a metaphorical sense, at the very least.

Microsoft trying to stop Copilot generating fake Putin comments on Navalny's death

My wife experimented with using AI to help generate copy for some of her blog posts. Her findings were that it can help generate the introductory text and "hook" to get an article started (so, basically, one sentence), and help with overall flow and structure, but as with everything else AI generated, the plausible-sounding content it generated for the actual meat of the article was actually factually incorrect, containing "interpolated facts". As it happens, it has some limited use as a crutch to sketch out the overall form of an article, but then pretty much everything it generated would be thrown away and replaced with something better worded, or actually accurate.

The problem is that there are any number of "fake news" web sites out there that can churn out seemingly endless content with no regard to whether it bears any resemblance to reality, and the unwary can get fooled by them. The same problem now exists in scientific publications, with such examples as the recently infamous "giant dissected rat penis" (if you're not aware of it, google it somewhere where your boss or coworkers won't look over your shoulder). I'm sure we're only a short step away from fake "fact checking" sites, if these don't exist already.

Re: @AC - Alternately...

Statistically, for any Jeel post, both apply. The odds are strong that you don't even need to waste your time reading it.

edit - I just skim-read the FSB copypasta, and can confirm this to be the case, so that you won't have to waste your own time doing so.

Re: Statistics at work ...

Time to sack the entire editorial staff and replace them with a PFY feeding prompts to an LLM? and close down.

FTFY

BOFH: In the event of a conference, the ninja clause always applies

They're not invited. They turn up anyway.

Legal campaigners challenge UK.gov decision to redact NHS-Palantir contract

Re: "We accept that Big Pharma needs to suck data"

The thing that astounds me is that my comment above has not garnered even one single downvote, not even from the usual far-right trolls.

Re: "We accept that Big Pharma needs to suck data"

Well strictly strictly speaking, it's because all the palantírs are connected, so that when you see Sauron, he sees you, and that's what drives you mad.

Re: The reason is simple to understand

The only real question is: between Peter Thiel and N. R. Narayana Murthy, which one is Sauron, and which one is Saruman?

Re: "We accept that Big Pharma needs to suck data"

Let us not forget, either, who owns Palantir, the company named after the madness-inducing seeing-stones. That's right, Peter Thiel, they guy who said that "[I] no longer believe that freedom and democracy are compatible". If that sort of political rhetoric sounds familiar, that's because it was very popular in parts of Europe about 90 years ago. (spoiler: that didn't end well)

The very idea of allowing a firm that was founded primarily to mine data to provide "more security with less privacy" (his words, not mine) access to anything in this country, let alone NHS data, is sheer madness. We should be looking very closely at whom, in our government, has been drinking the fascism kool-aid, and then promptly eject them from office.

Simply put, this man's personal beliefs are incompatible with democratic freedom and human rights.

European Court of Human Rights declares backdoored encryption is illegal

Re: Well good thing the UK had Brexit

Oui, je suppose que c'est vrai.

Re: Well good thing the UK had Brexit

Oh, and before some wag comes up with "Godwin!", I'd like to point out that Godwin's Law only applies when there isn't a valid comparison to the Nazis. When there are clear parallels to the actions of National Socialists in their rise to power, it's probably not only appropriate to point them out, but, I'd argue, required.

Re: Well good thing the UK had Brexit

To be fair, they could have come up with a better name for the court, to avoid the obvious confusion, because most people abbreviate both as ECHR and rely on the reading comprehension of the reader to disambiguate them. Sadly, it seems many people's critical analysis skills are lacking, and they get confused, or the person writing about one or the other doesn't take sufficient care to make sure their usage is unambiguous. I've only seen "ECtHR" come into relatively common usage in more recent years.

Re: Well good thing the UK had Brexit

Spot on, what our corrupt government is up to is eroding the separation of the three pillars of government: legislature (them), judiciary (the courts) and the executive (policing).

Policing has already been corrupted by undue influence from the Home Secretary taking direct involvement in policing decisions, and the election of politicians as PCCs. That, and immunity from prosecution of historic crimes for friendly paramilitaries (the "Troubles Act").

They want to take control of the courts, if they manage that, what we essentially have is a dictatorship, where one branch controls the other two. An elected dictatorship is still a dictatorship (hello Adolf).

I mean, if you can't see the parallels, then it's really time to actually study some early-mid 20th century German political history. Specifically, the state "othering" of easy targets, the rise of the SA and SS, the demonisation of the judiciary; all we're missing at this point is the outlawing of unfriendly political parties (as "terrorist organisations"), Kristallnacht and the Reichstag fire.

Re: Well good thing the UK had Brexit

The elephant in the room, of course, is that the Rwandan government has basically said that they will only take refugees from the UK as long as we are complying with international law, which we will not be doing, despite the number of pieces of legislation Fishy Rishi can come up with stating the opposite. They'll keep the several hundred million quid we've wasted on this harebrained scheme, and send the first batch of "illegals" right back.

Meanwhile, the whole point of the thing is to allow the far-right shambles that is the current UK government to thump some tubs to retain the populist vote. Sadly for them, the polls currently show that only about 25% of people are actually that stupid. It's just a shame that Keir Starmer is turning out to be a bit of a wet flannel, so the next government will likely be quite shit as well.

Re: Well good thing the UK had Brexit

Except the problem is determining if people are actually refugees, or just economic migrants and thus illegal.

A few things:

1) The "problem" is that the system for processing asylum claims (and thus making that determination) is what our government is not doing properly, wasting hundreds of millions of pounds imprisoning asylum claimants in "processing centres", or putting them in hotels whilst simultaneously not allowing them to work, or receive benefits beyond a very small stipend for living expenses (despite what shouty gammons like to claim). The backlog of claims is huge, and making decisions on them is where the money should be being spent. It is already illegal to house or employee someone whose residency status cannot be proven, so the quantum immigrant who simultaneously comes here to take our jobs and live off benefits does not exist.

2) No person is illegal; there is no such thing as "untermenchen". To suggest otherwise is pretty much spot on the definition of fascism.

3) until we were forced out of the EU by corrupt politicians and their useful idiots, we could return asylum claimants to the first EU country they entered under the Dublin convention. Leaving the EU entailed leaving its conventions. Bad luck. File this under "consequences".

4) The UN convention on refugees states that people can claim asylum in the country of their choice, not the country of someone else's choice. The lack of safe and legal routes to claim asylum in the UK, or ability to make a claim from a safe third country means that, except for refugees from countries the government decides to take them from, for political purposes, the only way to legitimately claim asylum in the UK is to arrive here "illegally".

5) Almost all other countries around us take more refugees and asylum claimants than we do. We don't even take our fair share.

6) We are a nation of immigrants, you melt.

7) Perhaps if we treated all humans with respect and dignity and recognised that many have legitimate reasons for wanting to come here, such as reuniting with immediate family, rather than promoting hate and "othering" of desperate and vulnerable human beings, we wouldn't be such a nasty, insular, and downright arrogant nation.

Tesla's Cybertruck may not be so stainless after all

Re: Musk? Who trusts this guy?

The US auto industry, on the other hand, is largely self regulating.

See also: Why we'll never see one of these monstrosities in Europe.

Re: Stainless?

They were hardy "just scares" at the time when power stations were burning lots of sulphur-containing* coal. Sulphur dioxide reacts readily with atmospheric moisture to form sulphurous acid / oxidises further to sulphur trioxide and reacts with moisture to form sulphuric acid. Neither of those things are good for arboreal forests, or indeed, for uncoated steel vanity-wagons.

*I'll call it sulfur when Americans can spell aluminium.

Re: Cybertruck - the gift that keeps on giving...

Hey, we could galvanize them, then they'd look even more like souped-up wheelbarrows.

BOFH: Hearken! The Shiny Button software speaks of Strategic Realignment

Re: Shiny button software...

...and for the processing cost, storage, and network access at $0.01 per kilobyte (1000 bytes, not 1024)

Raspberry Pi Pico cracks BitLocker in under a minute

Re: Deliberate

Exactly this. I'll just add that a one-time setup will still need a secure channel between CPU and TPM in order to exchange those keys, or some method to enter them manually. At best, you're moving the exact same problem further along the road by one step, and at worst you are introducing a new vulnerability.

It's also worth pointing out that since CPUs and TPMs are modular, and it's perfectly reasonable to be able to replace one or both, that one-time setup needs to be actually not be one-time, but have a reset or update mechanism too. In this case, real-life requirements for functionality negate the only security you might gain (time-boxing the key exchange activity).

Re: Deliberate

How do two components that know nothing about each other share a secret? Wow! Another Turtle!

Reading the comments here, it seems that there are an awful lot of people who need to start reading Bruce Schneier's blog, and probably some of his books before putting their ideas into practice.

One important principle that he talks about often, is the fact that anyone can come up with a method of encryption that they can't defeat themselves, and thus feel is secure. Someone who knows what they are doing can usually come along and defeat it in minutes, if not seconds.

Don't get me wrong; the only reason for having the TPM module is to allow it to run Win11. I don't have Bitlocker enabled on my home desktop PC, because if someone gets in and steals it, the main loss is of the machine, not the data on it. The convenience of being able to remove a disk and read it from another system, for a hardware tinkerer, outweighs the security from having it encrypted. I'd be far more likely to lose access to a disk's data from failure of the TPM module, than from the disk being stolen. One of the things about security is also trade-offs.

My work laptop, which is currently on the same desk, has PIN-protected bitlocker, because it contains commercially sensitive data that needs to be secured. If my desktop PC did, I'd be encrypting the volumes that held that data.

Re: A brilliant testament to analysis

Indeed, in order to beat that password, you need to get hold of the laptop while it's still powered on, then grab the memory out of it and dunk it in some dry ice while you read the contents.

Re: A brilliant testament to analysis

So, when I "manufactured" my home PC, which has a physically separate CPU (which I fitted) and TPM (which I fitted, at a later date), at what point should i have somehow generated and "loaded" private keys into the CPU ad TPM? If they were already present, how should I have obtained them to load one's public key into the other? How would you prevent someone else from extracting the same keys at a later date in the same manner, thus enabling a MitM attack? If I am to load keys myself, how am I to prevent someone else from loading new keys at a later date (and thus knowing them, and being able to perform a MitM attack)? If I can only load them once, what happens if I find out that my keys that I have had to generate myself, are not properly secure (because, as a typical user, I am not security aware) and I need to generate new ones, but cannot? Oh dear, someone has got hold of the plain-text copies of those keys that I generated, and used them to perform a MitM attack!

Did I mention that security is hard? I am also not a security expert, but am well-read enough on (and have practical experience in) the subject to know what questions to ask...

Re: A brilliant testament to analysis

This is correct. Sadly, the security model is broken, because by design it allows for the user secret part to be omitted.

Re: A brilliant testament to analysis

What you are missing is a man-in-the-middle attack on the key exchange, performed by pico-Mallory. I believe Diffie-Hellman is just as vulnerable to this as any system where Alice and Bob have starting positions where they know nothing about each other.

https://www.geeksforgeeks.org/man-in-the-middle-attack-in-diffie-hellman-key-exchange/

Both Alice and Bob have to provide a message to the other, that can't be spoofed, or intercepted and read, by Mallory. Since Bob must be able to read Alice's initial messages, and Alice must be able to read Bob's, it stands to reason that Mallory can too, and can relay them without detection.

If Alice says to Bob, "Hi, here's my public key, I'd like you to use it to encrypt message to me, because only I have the private key to decrypt those", and Mallory intercepts that message, and substitutes his public key for Alice's, then Bob will be encrypting his messages with Mallory's public key, and Mallory can then take those, decrypt them, read them, re-encrypt with Alice's public key, which he also knows, and pass them on to Alice, without either Alice or Bob knowing. Unless both Alice and Bob are acutely aware of message timing, and can detect from that, that the messages have been decrypted and re-encrypted in flight, Mallory can read all the messages in plain text.

You can take the disk out of the laptop, or clone it and take away the clone, and decrypt its (supposedly secure) contents.

I reckon that with a spot of laser ablation and a scanning electron microscope, and a fair amount of effort, any chip will give up its secrets with time. I'm assuming that CPUs made on the same die would all have the same baked-in TPM key, but there might be some sort of process to vary the die, or flash the key in later. in those cases, you would probably also need to have some expensive CPU probing kit, but that's probably going to cost peanuts compared to the SEM.

The same logic applies to separate TPM chips, be they solder onto a motherboard, or on a TPM module. With enough money and finesse, you can pull anything apart to the functional level and work out exactly what every logic gate is doing.

Re: A brilliant testament to analysis

This is already a thing, though. My work laptop requires it; my employer required that I set up a "PIN" that only I know so that nobody else can access the laptop.

The problem is the trust between the TPM and CPU where there is not an external (i.e. user) input of the secret part; this is not required, so the security is broken by design. Without a secret component known only to the user, at some point in this process, the interchange has to be in plain text, or encrypted with known keys, which is, for all intents and purposes, equivalent to plain text (in the same way that ROT13 is).

My desktop gaming PC has a 9th Gen CORE i5 in it. It also has a separate TPM module so that Windows 11 will run on it (on the rare occasions that I actually need to boot into Win11, but eventually we all know MS will force us to "upgrade" to continue to get security updates). It may be the processor has a built-in TPM, but the motherboard's BIOS doesn't have the option to enable it. However, I think "since 2015" isn't the same as "since 2015 in all processors".

Find out which processor (exact model number) the laptop has in it. Search for a data sheet on that processor to determine whether it has on-chip TPM.

Re: A brilliant testament to analysis

failed to encrypt comms between CPU and TPM

OK, clever clogs, explain to me how this can be done, securely...

Many problems (and supposed solutions) in security involve just moving the problem somewhere else.

To encrypt communication between the CPU and TPM, presumably, they would each have to have access to an encryption key of some sort (or asymmetric key pair). How does one set this up so that the CPU know how to encrypt things that only the TPM can decrypt, and vice-versa? If you use public/private key pairs, how do you ensure that the thing talking to the TPM with its public key is the CPU, and not, say, an attacker who has clamped a probe onto to the tracks on the motherboard and hooked it up to a Raspberry Pi Pico? Presumably the public key has to be known to chip manufacturers, at least. The likelihood of something like that (both widely known, but also secret) not being leaked is so close to zero that we might as well assume it's already broken.

It's not like you can have some sort of certificate for both the CPU and TPM to authenticate themselves, without having a master registry (in hardware) of all those certificates, or the ability to look them up via, for example, a certificate authority, which means an entirely independent comms channel to the internet. Even then, we know that some certifying authorities we already have for things like SSL are less than reliable. How do you revoke a certificate authority that's hard-baked into hardware? If you can, how do you do that securely, without opening a vulnerability for a bad actor to revoke legitimate ones?

For some reason, security has a reputation for being Hard, with a capital 'H'. I can't imagine why...

Return-to-office mandates boost company profits? Nope

Re: No WFH - WTF

It really is Gerald Ratner* level stuff, isn't it? I never understood why Sralan gave money to the Labour Party, if you cut him in half** there would be a Tory rosette down the middle. I suppose it was money to Tony Blair though...

*For those not familiar with Gerald Ratner, he was the owner of a chain of jewellery shops who famously described a set of earrings he sold as, "cheaper than a prawn sandwich from Marks and Spencer’s, but I have to say the sandwich will probably last longer than the earrings," alongside other comments describing some of his wares as "total crap". Needless to say, his business didn't fare too well after that - the share value plummeted by half a billion quid.

**This is not a (tacit) request for someone to do this.

Building a 16-bit CPU in a spreadsheet is Excel-lent engineering

Re: Always impressive

The E. coli used for research purposes is (usually, hopefully) a harmless strain. People get alarmed because there are very nasty strains of it out there, this is because it is a pretty simple bacterium that reproduces quickly (and hence evolves quickly) at body temperature, and tends to pick up genes from elsewhere through horizontal transfer, like stealing other organisms' RNA is going out of fashion.

In the lab, people tend to culture a known strain without contact with other organisms, so it doesn't have the opportunity to pick up genes from elsewhere. If you were to end up with something else growing alongside it, it would go straight in the autoclave, then down the sink.

Re: Many thanks Richard!!

But, but, but... It has syntactical white space! What a brilliant idea!

DeepMind AI helps cook up 'novel' compounds – with sides of controversy

Re: Combinatorial chemistry

It's the chemistry equivalent of throwing lots of combinations of ingredients into lots of baking trays, cooking them, and then trying to decide whether any result is edible.

Windows 3.11 trundles on as job site pleads for 'driver updates' on German trains

The entire attack surface is probably one serial port behind a screwed-down panel in the driver's cab. I'd suggest that if someone gained access to that, they'd already compromised the whole train. There's certainly no concerns with Wi-Fi or network vulnerabilities with something not capable of using Wi-Fi, and probably not attached to a network (certainly not the internet!)

Re: Improvement?

I think there is probably a case to be made that the sort of hardware that went into a Windows 3.11 PC is getting rarer, and much is not manufactured any more. Things like replacement RAM would be a specialist purchase, nobody makes ISA cards or IDE hard disks any more. Good luck finding spares and repairs for 3.5" or 5.25" floppy disk drives, if your motherboard goes kaput, then kaput it is; about the only modern compatible component I can think of would be the PSU, and possibly a keyboard and mouse if you get a USB to PS/2 adapter for them; again, only useful if the system in question doesn't communicate exclusively over a serial port.

Techie resurrects teletext on a vintage BBC Master

Re: Fabulous

I recall doing this at one point using the BBC Master in the library at my school back at some time in 19-mumble-mumble. I wonder if I still have the 5.25" disk it was saved onto anywhere; It's possibly in a box at the back of a storage unit. ISTR that the "software" that could be "downloaded" was pretty basic (pun intended) and didn't do anything interesting.

Re: Composite Video is still present on the PI

I think it's generally accepted that if you're buying something with a load of GPIOs on it, you probably own a soldering iron. If you want pre-built devices that you can't tinker with, sealed with various different types of security screw, the Apple Store is that way -->