Posts by jeremya

Mega council officers had no idea what they were buying ahead of Oracle fiasco

Access not so bad

In the early days of Access, I had to write a CRM system from scratch in 2 weeks for my Telco Call center. It had to run with 20+ people simultaneously using a single Access database on a file share

It took notes of all contacts and provided billing data on demand. Coding was Visual Basic.

I had the option of migrating to a SQL server version but in reality, the Access jet engine was highly reliable and much faster - it is an ISAM database after all.

Despite some in Microsoft disliking Access and trying to can it for decades, the jet engine it uses is the basis for one flavour of the Windows registry

Starlink-branded hardware reportedly found amid wreckage of downed Russian drone

Re: What usage ?

Jellied Eel said

"One of the flashpoints was the massacre of protestors inside the Odessa Trade Union building. Ukraine's problem is it was always split along ethnic lines. Voting patterns show this clearly, ie East of the Dnipr was more traditionally 'Russian'. West, that's been the domain of the Banderites and their twisted ideals of Ukrainian identity."

While true it's not the whole truth. Speaking Russian did not disqualify you from being Ukrainian until the coup in 2014.

Native Russian speakers are more common in the east and very common in Kiev, where the ruling elite is almost completely native Russian-speaking at home. This includes Zelensky. They only speak Ukrainian in public for political purposes. This is a byproduct of Soviet times, when Russian was the language of Government, and the Ukrainian government is in Kiev.

If you go further West there are more Ukrainian speakers, especially around Lviv. Lviv was a Polish city up until 1946 when it was annexed into Ukraine as part of the WWII settlement and the Polish population was kicked out and replaced by ethnic Ukrainians.

You end up with the main nationalistic Ukranian base living in recently captured territory. The base seeks to extend the Ukraine nation east and displace the native Russian speakers despite them being for the main part proud to be Ukranian. The Minsk accords were meant to keep the Donbas in Ukraine with some degree of autonomy. The Donbas did not want to be part of Russia. The Ukraine nationalists saw Minsk as a temporary measure till they could get enough forces to subjugate the Donbas. This has now been frustrated.

250 million-plus unused IPv4 addresses should be left alone, argues network boffin

No problems with IPv6

I recently sold my IPv4 class-C as it had no actual benefit to me and cost money to maintain.

In exchange, I have a /48 IPv6 range and a single IPv4 address allocated by my ISP (plus some IPv4 & IPv6 addresses for my cloud servers). I have zero problems!

Internal Windows machines prefer to run IPv6 anyway. So do my Linux machines. A little bit of DNS with A and AAAA records and it's entirely seamless

I also run dual-stack mail servers, and around 25% of incoming mail uses IPv6 in preference to IPv4.

Hello? Are you talking on a Cisco SPA300 or SPA500 IP phone? Now's the time to junk 'em

Any option for custom firmware

Out of curiosity, is there any programmers's model for cisco phones?

That is documentation on the CPU, the circuit diagram(s), hardware components (registers etc), and any code signing required.

I know cisco has admitted they have put a lot of GPL software into at least some of their phones without mentioning it till questioned.

Would that process have resulted in cisco disclosing the entire software stack?

ICANN reserves .internal for private use at the DNS level

But will it break things?

There is an existing problem with non-standard but still valid DNS names.

Some software, especially to do with network functions on windows systems, but not necessarily Microsoft code, breaks when you use DNS suffixes that aren't in the traditional DNS hierarchy.

A whole bunch of the new TLDs get rejected by email address validators. More importantly, many 'wizards' break because if they don't see TLDS as defined 20+ years ago. I think (from memory) the sharepoint and exchange wizards have these problems. There are many more examples.

I'm interested in how .internal will be resolved. will your local DNS server recognise it and not recurse up the DNS tree? And/or is there a mechanism to return some code on a DNS query that says this is a non-public name?

CrowdStrike meets Murphy's Law: Anything that can go wrong will

Re: Windows: a flawed security model

Windows does have an adequate security model and doesn't require anti-virus.

The problem is that using the built-in Discretionary Access Control and Policy systems requires skill and a willingness to accept some pain till you get it right.

However, one criticism could be that it has Discretionary rather than Mandatory Access Control as provided by SELinux. That was an original design decision that has had the inevitable results we see now.

It is bleeding obvious that systems *will* be compromised despite firewall and anti-virus protection.

The CrowdStrike fiasco illustrates how security managers have focused on preventing attacks and have neglected exploit containment and system recovery.

CrowdStrike's Falcon Sensor also linked to Linux kernel panics and crashes

Re: Why use Crowdstrike when you have SELinux?

Windows NT (and hence all current windows systems) have something similar built in but mostly not used and nowhere near as strict.

It comes in two flavours

1 Discretionary Access Control (DAC) is the primary security model. It allows the owner of an object (like a file or a directory) to control access to it. The owner can decide who can access the object and what operations they can perform on it.

2. Role-Based Access Control (RBAC) which restricts system access based on the roles of individual users within an enterprise.

These are only really used in enterprise-managed systems where policies can set these on files and other resources.

A fully locked down Windows system is possible but you'll probably only find it in Government high security machines.

In contrast SELinix is quite common on internet facing systems

Why use Crowdstrike when you have SELinux?

SELinux is the ultimate security product for Linux-based machines. It was developed by the National Security Agency (NSA) to secure Government computers. It is maintained by Red Hat and available on most distros.

The SELinux philosophy is: if it's not explicitly allowed then it's blocked.

SELinux has pretty good threat detection as well. Every blocked action is logged and available to log monitors to start reacting in seconds if not milliseconds

CrowdStrike seems to have the philosophy of: letting everything run and if I hear of a problem I'll provide a fix

SELinux needs you to understand your systems and processes and enable functionality only when required

CrowdStrike lets you treat systems as black boxes and believe the man behind the curtain will make it all good.

The downside of SELinux is that you must know about the processes and systems you are administering and be patient while developing an optimal configuration. Funny that! I thought that was a basic requirement for systems security administrators. Never mind. With CrowdStrike, the man behind the curtain will make it all good, so you can hire cheap helpdesk staff to set up your systems.

Life, interrupted: How CrowdStrike's patch failure is messing up the world

The fault is actually systems administrators

Any systems administrator who allows automatic patches to his network hardware is fundamentally incompetent.

They are even more fundamentally incompetent if they have no disaster recovery and rollback plan.

This is one of the instances where running most of your systems virtually has a massive advantage in that a rollback can be done with a few clicks - assuming the rollout process has snapshots before any patching.

I travel hopefully there will be a lot of firings of sysadmins. The sad reality is they will all be feted as heroes for recovering the borked systems.

CrowdStrike file update bricks Windows machines around the world

Internet safe for now

What's remarkable is that internet services in Australia seem to be unaffected.

Does this mean ISPs have decided that Windows machines and mission-critical functions are incompatible?

If so, congratulations all around!

CISA looked at C/C++ projects and found a lot of C/C++ code. Wanna redo any of it in Rust?

Not seeing the forest for the trees

The discussion comes down to: Yeah we know that hardware is exploitable, and that machine language is exploitable, and we know that the processes where machine language is generated (compliers linkers etc) are exploitable, and we know that any time data is in transit it is exploitable, but we'll complain about memory allocation in the high-level language and the problem will go away.

Instead, what the IT industry has done for many decades is to put in processes to first of all identify coding or system problems, eg using valgrind, and more importantly mitigate the effect of any failure by system design and monitoring e.g. stateful packet inspection on firewalls or advanced process monitors.

Also, manufacturers don't seem particularly interested in changing the processor architectures to make exploits at any stage improbable. e.g. implementing key functionality such as threading in silicon, or at least microcode. There are 'proven' secure microkernels such as SEL4 but none I can find that are entirely silicon.

A friendly guide to local AI image gen with Stable Diffusion and Automatic1111

Windows 11 Install broken

As per title, I attempted the install in two different ways and ran into python dependency hell.

I get the feeling the Windows Port has been neglected for months if not years.

I can run GPT4ALL on the same host without problems

Spam blocklist SORBS closed by its owner, Proofpoint

Re: Personally, I've never had a problem

I too do that but I've lately had an obnoxious European mail service reject my emails because the IPv4 reverse DNS of my public IP 'looks like an ISP assigned address' - which it is of course.

I do control the reverse DNS of my IPv6 range but they don't support IPv6

Gentoo and NetBSD ban 'AI' code, but Debian doesn't – yet

AI Assistance is so-so

I regularly use chatGPT-4 to generate small fragments of code - python or bash.

For simple tasks and a few dozen lines of code it's for the most part correct given a clear context.

But it's not perfect and occasionally GPT-4 will get a a stupid idea into its context and keep on repeating that.

GPT-3.5 is faster but breaks very quickly.

GPT-4o Is a hybrid of 3.5 and 4 (?) and from my first experiences it gets things wrong at about the same rate as GPT-3.5

Overall, with GPT-4 I think I am ahead. It does the small-scale execution and I do the large-scale direction. I get mostly useful code and minimal 'inventiveness' by GPT-4. I won't be using 3.5 or 4o any time soon.

So banning code 'generated by AI' is actually a NIL ban. Any code that gets put into projects has to be micro-managed anyway so there is always a human in the loop and the code is human-generated with machine assistance.

Major telco outage leaves millions of Australians disconnected

BGP failure is no the only option

I think people are locked on the BGP because that's what caused the Facebook outage.

Another possibility is a private root authority certificate expiring. Suddenly all parts of the network that rely on PKI would instantly fail and this would cascade into automatic provisioning failure.

Bombshell biography: Fearing nuclear war, Musk blocked Starlink to stymie Ukraine attack on Russia

Re: The report is not completely accurate

The types of FPV drones they use from China require a video feed for final targeting. But.

When the target is a warship at sea, all you have to do is use GPS to get close enough and then use a thermal sensor to lock on to target. This is not some magic. Thermal sensors have been used on amateur aerial drones for decades - principally to maintain level flight against a horizon. They cost a few bucks and there is Arduino code to use them.

You could use an Arduino to navigate the final attack including zig-zag and jinking to home into that huge hot thing that is a warship.

So a pre-planned GPS approach with minimal low data rate adjustments and you have a battleship killer or bridge demolition device.

No need at all for Starlink video other than to record the event and use it later for propaganda.

Re: The report is not completely accurate

Drones don't require Starlink, especially not long-range marine drones. They operate on planned GPS courses and receive monitoring and control by a wide range of technology such as HF radio, meteor scatter radio, and commercial satellite services such as Iridium.

The juicy bit about Starlink is it can give high-quality video from boats plunging into bridges etc. More of a propaganda tool than anything else.

Re: The report is not completely accurate

Here is a Reuters report from February quoting the SpaceX president that Starlink was blocked for drones.

https://www.reuters.com/business/aerospace-defense/spacex-curbed-ukraines-use-starlink-internet-drones-company-president-2023-02-09/

The report is not completely accurate

Musk confirmed on X that they had always restricted the use of Starlink in Ukraine (and probably Russia).

The issue was he got a request to enable Starlink for drone boats to attack Sevastopol. He declined to enable it on the very reasonable grounds that he would be complicit in an attack, and quite possibly responsible for a nuclear war.

AWS: IPv4 addresses cost too much, so you’re going to pay

Re: IPv4 I'm selling mine

The price varies. It's dropped over the past months but looks like it's stabilised. At one stage last year it was over $60USD per address.

The broker expects it to rise in the mid-term so I'm in the market waiting for good offers rather than selling at market price.

Long term the strength of the US technology sector is a big factor. When companies start firing the IPv4 price droops.

IPv4 I'm selling mine

Coincidentally I am in the process of selling my legacy class-C /24 IPv4 range.

I migrated most of my systems to IPv6 (my ISP gave me a /48 range). The effect of migrating to IPv6 with a single IPv4 address has been minimal.

I use a private IPv4 range inside the LAN for printers and phones etc. But I also run a full IPv6 internal range as a /64 subset of my /48. I have no idea what I'll use the rest of the range for.

For a smallish business, you only need one IPv4 address and even then it doesn't need to be static if you use an external smart host for mail and web services.

Anyway, if you want to buy an IPv4 /24 in the APNIC region, give me a hoy.

Missing Titan sub likely destroyed in implosion, no survivors

Terminology

Surely the incident was a rapid gain of chamber pressure, not a rapid loss?

Will Flatpak and Snap replace desktop Linux native apps?

Why not go the whole hog and "flatpak" the entire O/S as well.

None of this crappy waiting for hours while arcane scripts do their stuff to merge into the even more arcane systemd.

Just have a big blob that is the O/S and you don't do anything to it.

Download. Run

|

Boffins interrogate sodium ion battery stability mystery

The issue is not so much soda ash (sodium carbonate) as the relative cost compared to other sodium sources.

In all cases, the cost of the sodium is a tiny fraction of the cost of any cells

In the construction of various types of sodium cells, other materials required include manganese, iron, cobalt, titanium, and sulphur. Each has its own supply issues.

But even these are only a fraction of the cost of lithium ion cells which are dominated by handling highly dangerous processing chemicals and anode and cathode production technology.

Sodium ion will become attractive when it can be manufactured with 'green' chemicals without containment in small production facilities. This technology is still in its infancy.