Posts by Joe Montana 818 publicly visible posts • joined 12 Mar 2007
"though I do worry about how easy it would be to extract my signature from the document for use elsewhere."
The sooner we get away from using something so ridiculously arbitrary as a "signature" for any form of authentication the better...
I just mash the touchpad on my laptop, it makes a few random lines which has always been accepted as a valid signature every time i've tried, and never looks the same twice.
It costs resources to make copies too, the problem is the disconnect between the cost of making a copy vs the selling price of that copy. It's actually quite expensive to copy physical books, but costs almost nothing to copy digital media.
In terms of music, you can sell tickets to your live performances - you can't copy those accurately so there will always be value in attending the original performance. The problem is greed, people don't want to work (ie in this example, perform live on stage) to earn a living - they want to work once and then keep getting paid for years afterwards without lifting a finger.
// We say it's wrong to kill another human
Or more accurately, wrong to harm another human against their will.
// but it does potentially reduce the value of the item being copied
Key word here is potentially... There are many instances where it does not, for instance where the media is no longer for sale, or is not sold in a particular location etc. In these cases it potentially increases it because it increases the audience.
// which reduces the incentive of the creator to keep creating
Not necessarily...
The ability to continue selling the same thing over and over without having to create anything new also reduces the incentive to keep creating.
When we have the question of morality...
Is it morally right to place arbitrary restrictions on who is allowed to purchase content? Surely media should be available to anyone at any time for the same price. Refusing to sell to someone who is willing to pay the same price as someone else who was sold a copy is very wrong.
One of the biggest selling points of the Amiga was that you could easily pirate the games, and share them with your friends. Many people bought Amigas for this exact reason, and there was a lot of copying going on between friends.
The fallacy is thinking the market was bigger than it really was... Most people who played games were kids with limited budgets. If there was no piracy, those kids would just have had less games or played more free games - it would never have translated into additional sales.
Doing that would have broken the existing ipv4 network and caused significant headaches until the new (ipv4.1?) patches were rolled out everywhere... You would have a mix of systems with some being compatible and some not, some things would never have got updated.
It would also have made the implementations much more complicated, and thus slower and more difficult to do in hardware (high end routers generally implement the routing logic in asics).
The idea of ipv6 is that it's pretty painless to go dual stack, which should have been an obvious thing to do. Any modern OS will prefer ipv6 if available, and revert to legacy ipv4 if not. Pretty much all legacy kit that was around when ipv6 was first introduced has been end of lifed by now. Windows has had ipv6 support since XP for instance.
IPv6 is simply better, i build all networks as dual stack or ipv6-only, and i only use ipv6 internally. It makes many things much easier, you have end to end connectivity controlled by simple firewall rules rather than multiple messy combinations of rules and nat, your logs show the individual endpoints without having to correlate address translation, i can establish vpn connections between multiple independent sites and third parties without suffering address conflicts. Every system on my network is directly addressable, assuming there are firewall rules in place to allow the traffic, and the rules are simple because of that - no need to worry about multiple hosts hiding behind a single address etc.
It's like the transition from the messy days of segmented memory on dos and earlier systems, to the simple flat 32 or 64bit address space on newer systems.
There is absolutely no need for NAT, it breaks things and is not a security feature. If you want to block inbound connections then any firewall or router can do that with ipv6 (and home user oriented devices do this by default).
Unless your network is tiny, managing ipv4 is a nightmare - there was a post by microsoft a few years ago about migrating to pure ipv6 to avoid this hassle - address conflicts, duplicate addresses, multiple layers of address translation making it difficult to set firewall rules or correlate logs.
It's even worse in third world countries, where the prevalence of CGN causes all kinds of headaches - you'll quite often find yourself being blacklisted by google etc, or having to fill out captchas because some other user behind the same shared address did something.
The problem is that most users aren't aware of ipv6 or what it is, so there is no demand for it. Prominent companies like google and facebook need to promote ipv6, for instance offering beta features to ipv6 users first or displaying a warning banner when users connect to their services from legacy ip. If users start asking their ISPs for ipv6 en masse and moving towards isps which already support it you will quickly see support expand.
As someone who works in the industry, but not for any of the above companies...
Companies like NCC only perform scans within a given scope, so a client will come along and say "we need you to scan www.ourcompany.com" for a budget of £X (ie time limited), so that's what they do, and provide a report saying what was found.
But this is just a scan of the front door, its extremely limited in scope, and the client companies want it limited because it saves them money. Sure you might not find any vulnerabilities on the web server itself, but that's not the only way to attack a company site:
* Third party sites that provide content (ads, analytics or tracking scripts etc)
* The backend hosting environment where the site is (routers, firewalls, hypervisors, nameservers, etc etc etc)
* The workstations used by those who manage the site itself, or the infrastructure it sits on.
* Any interconnected infrastructure - eg are any of those aforementioned devices joined to a domain?
* Malicious employees.
There are so many other ways to hack a site, but doing a thorough assessment of all the interconnected pieces in a highly complex system is very expensive - so noone does it.
The fundamental theory is that you sell the property then rent it back, in the short term the rent is much less than the price of the property so you get a short term injection of cash.This makes the company look more profitable *this year* so the execs get their bonuses, then they take their bonus payout and leave to go somewhere else and do the same thing.
Once they're gone, the reality of having to pay all the previous maintenance costs for the building plus profit for the company now owning/running the building sinks in and their ongoing costs are higher than they were.
Fibre is a dedicated cable to your property, NTL's coax is a shared ring covering a small area, 5G is a shared spectrum covering a wider area... You'll have exactly the same problem with 5G, once everyone in the area is connected up your share of the radio spectrum will be very small and performance will be poor, but the service will be very fast at first when it doesn't have many users.
ARM is a british company owned by a japanese parent company, they don't have to follow US regulations.
VIA make x86 compatible cpus and i think are based in taiwan, although obviously taiwan isn't too friendly with prc.
AMD agreed a development deal with a chinese company some months back, so that chinese company already has the rights to manufacture current AMD processors.
China have their own locally developed MIPS-compatible processors, and RISC-V is open to anyone and both would be reasonable options for a laptop not burdened with windows.
Some self service checkouts are linux based, like the ones at B&Q... You don't usually see because they rarely crash, although i have seen them reboot once during a power outage.
Most ATMs nowadays are running windows 7, XP ones have largely been phased out.
Many devices use windows because its easier, and developers to write the frontend software are easily available, but its stupid to have a full featured os on a device intended to provide a very limited subset of functionality.
"[EDIT I see from other posts this was common enough to make it into shoddy action movies. Security designers must be stupid the world over]"
Unfortunately this is extremely common, both in physical and computer security... People only ever think about the most obvious routes of access and don't consider what other methods there might be.
A few years ago i was talking to a developer of what's basically a database of customers with a web based frontend. One of the rules they had to comply with, was that anyone who accessed any customer record must be logged.
So the web based frontend was designed to do just that, any customer record you viewed generated a log entry, and they were happy with this.
What they didn't consider was that the data resides in a database, which resides on a disk, which is also backed up to a tape every day. You could access the data at any of these points and nothing would be logged at all.
They also didn't consider where the logs were kept, some people had access to alter the logs.
All of this meant that they actually weren't in compliance with either the spirit of the letter of the regulations.
It's not even because of business expense, its a chicken and egg problem...
IPv6 provides huge benefits, but only if everyone is using it... If not everyone is using it, then it only provides limited localised benefits for those who do, and there is very little pushing for it.
The regional registries should be doing more to require their members to implement dual stack, many people want to implement ipv6 but can't because isps are refusing to support it.
ISPs which do support ipv6 should use it as a marketing tool, call it "next generation internet" or something as it's technically true. Users don't even need to care what it is, just make them think "new, shiny".
Big sites like google should start promoting ipv6, displaying warnings when users connect from ipv4 addresses or offering new beta services on ipv6 only to start with. If users start demanding ipv6, and moving to providers which support it then isps will soon start rolling it out.
The US government required that all government websites, and that of all government suppliers use ivp6 - all us government websites are reachable over ipv6, yet i don't think any uk government sites are.
IPv6 is simpler if you've actually used it extensively.
Even the largest ISPs have a single large prefix, whereas even moderate sized companies now have multiple ipv4 blocks in completely different ranges. Everything is routable and unique, so you don't have to worry about address conflicts or address translation. Running a network of any significant size using v4 is painful for these reasons.
Also even hosting services is painful now because of nat, used to be that you could use blacklists to block addresses which were the source of malicious traffic, but now you have a tiny pool of addresses shared by thousands of customers of the same isp. Block that address and you block one abusive user or infected machine and thousands of legitimate users.
And if you don't block, you have no way to differentiate between legitimate traffic and malicious traffic coming from the same address.
Also the problem is worse in most third world countries, having been much later to get connected they have extremely small pools of addresses. In the UK you will still typically get your own address for your household, but this is not the case in myanmar where every isp uses nat and you will have the same address as all the other users. Myanmar has 1 address allocated per 2600 citizens.
If you're using cgn you also have to log every connection made in order to track potential illegal activity... Some providers do this and it's quite a considerably burden, some providers just don't bother which makes them perfect for criminals as there's no way to trace a particular historical activity to an individual customer.
The lack of routable addresses also prevents you hosting anything and prevents the use of p2p protocols etc, no self hosting games, all traffic goes via third party servers instead of direct between users (ie more latency)...
Typically for convenience a company will have all their windows boxes in a domain, and then staff will be logging in as domain admin (or using service accounts with domain admin privs etc) and those creds can be extracted from a single compromised system and used to access all the others. Malware can also automate this process and will harvest creds and spray them against other hosts.
It's possible to manage windows differently, but also a lot more hassle to do so so very few places do.
Also your domain controller needs SMB open from the domain members, and if you have the right creds you can login over SMB and take control of the machine - so you can spread from one host to the dc, and then from the dc to other hosts. That's assuming that the individual devices don't allow direct SMB connections between each other (which often they do anyway).
Unix is much easier to manage (and more commonly configured so) using ssh keys, so if a single box gets compromised all you get is the public keys - which are useless.
If done the way linux distros do it, which lets users add their own custom repos then no, MS would not get any data from users.
Which is why they don't do it the way linux distros do, they try to push their own store where instead of letting users add their own repos, any publisher has to go through microsoft giving them control and information - worse for users, worse for other publishers.
Browsers have been less targeted ever since msie stopped holding 90+% market share... Now you have several browsers, and several different platforms that people commonly run them on so it's much harder to target.
With msoffice however, you still have a 95+% target to shoot at. You used to be able to pretty much guarantee that your intended victim would be running msie, now you can almost guarantee they are running msoffice. If is no monoculture, attacks become much harder.
If you're going to insert a backdoor, you would make it look as much like an accidental security hole as possible so you have deniability when it's eventually discovered.
That said, Huawei was willing to open up their source code to the UK government to have it inspected, which is more than can be said of any of the other major vendors. They could well be worse, giving them incentive to keep the code hidden. Even without source code, many serious vulnerabilities and evidence of very poor coding practices have been discovered in many different vendors products.
People doing the same job with comparable hours/responsibilities/experience/etc are getting paid the same...
Think about it, businesses exist to make money, they don't pay their staff any more than they have to. If you could pay women less for the same work, why would any business ever hire any men at all?
Especially considering that all the media hype about discrimination focuses on higher paid male dominated roles, there is never any focus on female dominated roles or low paid male dominated roles. If your business hired only women, no attention would be paid to your discrimination and there would be no visible gender pay gap anyway as you'd have no male staff to compare to.
So they decided to audit Huawei code because they were afraid of chinese backdoors... Turns out they didn't find any provable backdoors, but lots of security vulnerabilities due to poor code.
It makes a lot of sense to audit vendors products like this, but why do this only for Huawei?
Unless you've audited all the suppliers, you can't really draw any comparisons - is the huawei code any worse than other vendors? If anything, it's probably better as at least huawei were willing to let their code be audited... Perhaps other vendors know their code is worse and don't want it exposed.
I've encountered situations where developers provided a secure password storage method, only to be told to take it out again.
In some cases they wanted the plaintext password so it could be sent to users who forgot it, while in others they needed the plaintext to implement another misguided "security features" like only requesting specific characters from the password.
"literally nobody (not even the people whose job it is) knows what's going to happen to the UK's airports and borders in a few weeks time."
Based on previous events which caused panic like this, the airports and flights will probably be deserted due to people intentionally avoiding them due to all the media hype.
They said that travel in london would be impossible during the olympics a few years back, but aside from localised congestion during events the times i travelled into london during the olympics it was actually much quieter than usual.
There are plenty of direct flights to south america from europe and africa, especially from spain and portugal who have close links with south american countries. I've flown direct from spain to ecuador, which would make a pretty good international conference venue due to their relaxed visa policies.
It's self perpetuating but it also has to start from somewhere, the police didn't suddenly decide out of nowhere that they were going to target a particular group or area - such decisions were made due to a prevalence of crimes by those groups or in those areas.
And such a bias can also fade over time, if the police are stopping and searching people from a specific group that historically committed crimes easily detectable during a search, but find that the proportion of searches which result in an arrest significantly decreases then they will refocus their efforts on more useful activities having achieved the goal of reducing crime in one area.
If not 95%, it's still a significant percentage especially considering the demographics of the population as a whole.
If knife crimes being committed by blacks are decreasing then perhaps this is a result of the police focusing their resources on them?
And yes crime correlates with poverty, but the UK is not a third world country. Just because your parents were poor, uneducated and turned to crime doesn't mean you have to. The government provides free schooling and various opportunities for everyone but it's still your choice wether to take advantage and your own fault if you don't. I know many people who came from poor backgrounds and were able to get a decent education and subsequently get reasonable jobs.
As you point out, certain cultural groups are less compatible with UK society than others and the end result of this tends to be crime, but if you say this in public you get accused of racism against those groups.
The fact is there are many different cultural groups in the UK and other western countries, some of them are highly successful and some are not, and it is those unsuccessful ones who are looking to pin the blame on others rather than accept responsibility for their own failings.
Because some people actually need macros, although they are generally best avoided...
If you are going to implement a scripting language in your application, what makes more sense?
1, inventing your own proprietary scripting language that's only used by your application suite forcing anyone who wants to write macros to learn something new thats not reusable elsewhere.
2, build on an existing language which is already widely known and supported.
I've had complex word documents go wrong between the mac and windows versions of word.
I've had complex word documents go wrong between different patch revisions of the same base version (ie installing security updates).
I've had complex word documents go wrong between the same patch level on different machines..
These formats are simply too complex and poorly documented to render reliably. Sometimes libreoffice actually makes a better job of rendering a document than a given version of word, especially if you have very old documents or documents which have got corrupted.
Microsoft have a choice of...
1, invest in proper QA and development, keep customers happy and lose very few customers.
2, save money on QA and development, piss customers off but still lose very few customers because most of them have no choice.
Shareholders will force them to choose 2, the users are locked in and they can't go anywhere - why would they bother offering a better product if the users are still buying the shoddy one?
"Maybe go have a read of what's actually been happening."
I have read, i've also read what the people in myanmar are saying (ie local media) and most importantly of all i've actually been to myanmar both recently and for significant amounts of time (i have the passport stamps to prove it), and actually know several people who grew up in the affected region of the country.
What you read about in the international media is extremely biased against myanmar, what you read about in the local media is obviously completely biased in the opposite direction. The actual truth is somewhere in between.
"There's also something of a tendency towards rape by the military too." - unfortunately this is common, there are accusations against british and american troops carrying out rapes in iraq, vietnam etc too.. Is it any wonder that a third world military with significantly less training or discipline would also do the same thing? Not saying it's right, just putting it in perspective. FYI the terrorists are also carrying out rapes.
"They've also reportedly been going to non-Rohingya villages and encouraging the people there to go and do the dirty work instead." - these villages don't need any encouragement, the non rohingya villages have been attacked by the terrorist groups and are out for revenge, remember these are third world villages, not well educated westerners. You see the same thing in the middle east where various factions take up arms against each other.
And then there are false flag operations, economic refugees, and non-rohingya refugees who have fled in the opposite direction (ie towards other cities in myanmar) which you don't hear very much about in the western media.
So instead of reading propaganda online, why don't you actually go to myanmar and speak to people?
"Following attacks on authorities by a Rohingya militant group last year, the Myanmar military retaliated in violence that the UN has characterized as ethnic cleansing."
So basically a rohingya militant group (aka terrorists) attacked the authorities, and the result of this is military intervention. Any country in the world would react in the same way, and indeed fights against armed terrorist groups are currently underway in several other countries like syria and iraq.
"An estimated 25,000 people have been killed in the violence, the UN claims, and 0ver 700,000 people have now fled to neighboring Bangladesh"
Assuming this is correct, killing 25,000 and allowing 14 times more (700,000) to escape doesn't sound like very successful ethnic cleansing.
The area in question is now a warzone, with fighting between the military and terrorists with innocent civilians being caught in the middle. That 25,000 figure doesn't just represent innocent people killed by the military, it also represents terrorists, soldiers and innocent victims killed by the terrorists.
There are always innocent casualties in wars like this, many civilians are getting killed in syria and iraq, and the military forces there are far better trained and equipped than the myanmar military.
"There has been a significant increase in freedom of expression in Myanmar over the past five years" - freedom of expression also includes freedom to express your hatred and other negative opinions. Conversely not being free to express your hatred doesn't change your opinion, it ensures that it remains hidden and doesn't facilitate any discussion or education.
If you simply suppress someone's views and spray them with one-sided propaganda they will grow to resent the propaganda and their existing views will be reinforced. What's needed is open debate and education so people can be exposed to all sides and learn for themselves.
Louis Rossman is a good point, if a mac fails outside of warranty people are likely to go to someone like Louis to have it repaired. If a generic PC fails outside of warranty, people usually just throw it away and replace it. This even happens when there's a software failure and the underlying hardware is fine.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
