Posts by Joe Montana

Fed up with poor Brit telly and radio output? Ofcom wants a word with YOU

Cars

Most cars don't support DAB by default, and most other countries don't use DAB.. If they do have digital radio it will often be using a different standard. FM is fairly universal, and easy for auto makers to include so they can then sell their cars in many different countries.

I regularly rent cars, the rental cars are all modern less than a year old vehicles from various different manufacturers and so far none of them have had DAB.

And then there's all the existing cars on the roads, many of which have integrated radios and aftermarket replacements often look quite crude and lose integration with the rest of the car.

Personally i only ever listen to radio in the car,

Chromebooks now the fastest-growing segment of PC market

Re: Google

Chromebooks don't do as much as regular laptops? Most users never use all the features anyway, and more importantly the average user isn't technically literate enough to deal with a complex computer system, and because of this you have all manner of malware problems.

A Chromebook takes away the burden of managing a complex system, and allows the user to get on with what they want to do.

As for the google stalkware aspect... Yes that's true, but the fundamental idea of a managed computer for non technical users is a good one - we just need more choices as to who manages it rather than just google.

It's alive! Shared-nothing migration puts the spark into Hyper-V

KVM

The KVM hypervisor has had the ability to do live storage migration for quite some time...

Microsoft: Someone gave us shot in the ARM by swallowing Surface tabs

Legacy apps

Windows tablets have been around for years, and always had the ability to run legacy x86 apps... They never sold well, because those legacy apps were designed for use with a keyboard and mouse and are generally difficult if not completely unusable on a tablet based interface.

Apple succeeded because they made a tablet which ran apps specifically designed for use with touchscreen input. And they were also very smart to differentiate ipad from their keyboard/mouse targeted systems.

Microsoft want to tie the whole thing together, so they are trying to sell tablets by associating them to a product that while well known, carries a lot of negative baggage.

People expect a product marketed as being windows, to:

run legacy apps (windows rt does not, and such apps run poorly on x86 tablets)

crash

be malware prone

Or to put it another way, there is no reason why any android device couldn't run traditional unix applications, as the vast majority can be easily recompiled to run on an ARM cpu. Indeed most already have been, and there are a number of ARM based devices which do use traditional input peripherals and which do run traditional applications.

So despite how easy it is, there is virtually no interest in running traditional apps on touchscreen devices, and far more interest in creating new touch friendly interfaces for such programs.

Not all data encryption is created equal

WTF

"The simple reality is that most networks are like eggs – protected by a relatively strong shell but the inside is soft and gooey. If you manage to compromise any one thing on my network the rest will fall like dominoes."

And this is the whole problem, fundamentally flawed design.

Every device should be as hardened and closely monitored as necessary given the data on it, and every device should be configured as if it was directly exposed to the internet. If you then choose not to expose such devices you are doing so as an extra line of defence, not as your only line. And you should not accept devices which are fundamentally broken and unfixable.

Encryption is also not the answer, encrypting your hard drive is great until your machine gets compromised via a network level attack, at which point the encryption key has already been entered and the running system can access all the data.

Encryption is often misused, for instance DRM schemes where both the encrypted data and the key are provided to the user which means its mere obfuscation as opposed to proper encryption. Similarly many security standards and guidelines say you must encrypt data, but if you also need to access that data then the key must be available too... Quite often convenience wins out, and the key is kept on the same machine.

In these situations your security is not as strong as your encryption, it is only as strong as the effort required to work out how the data is obfuscated and extract the key - which for a widespread/common system only has to be done once.

Internal power struggle at Oracle leaves Brits cool on Sun

What do you expect?

Being a reseller is always a dangerous short term game... Your a middleman, and an unnecessary one at that, sooner or later the vendor and/or end client will realise that they can cut you out of the picture and keep your share for themselves.

REVEALED: The gizmo leaker Snowden used to smuggle out NSA files

Re: No security system should have a single point of failure

You can't make any files unreadable by the admin users...

The admin can extract the password hashes of all users, and the plain text passwords of logged in users at any time from a windows host.

Even if the permissions explicitly prevent the admin user from reading or taking ownership of the file, you can always pass the hash into another user, or elevate to system/backup users (if the backup user cannot read the data then the data won't get backed up - not a good state of affairs). There are several other things you could do too.

The problem is people who don't think outside the box, thinking that something as trivial as file permissions will stop someone with admin privileges is ridiculous. Hackers do think outside the box, and realise that most of the published security features, especially on windows, are fundamentally broken in one way or another.

Unix also cannot stop an admin user from accessing any data on the system, but it doesn't try to pretend otherwise. And it is this pretence which gives users a false sense of security, and causes them to implement half assed measures that anyone remotely competent can bypass instead of accepting the inherent risk and working out other ways to mitigate it.

It's much better to have a known risk which you fully understand, vs a risk you are unaware of because you think you fixed it and don't realise that your fix is fundamentally broken.

Re: Root password, sure, but why wasn't the data encrypted?

So you can't write to removable media?

What if you read some exploit code from the removable media, and use it to elevate your privileges such that you can disable the aforementioned software?

Also, since such software is likely a userland application rather than a kernel option, if it crashes you regain the ability to write...

Re: Root password, sure, but why wasn't the data encrypted?

Software like this has no reason to be expensive, its simply overpriced.

Prevent access to USB? Just remove the USB drivers and the system will ignore the ports and only someone with suitable privileges would be able to reinstall them.

And incidentally, USB devices are used because they are most convenient, if you block USB them people who want to extract information will use other less obvious ways.

If you leave USB enabled, but keep a log of any data written to such a device then you stand a better chance of catching someone who will often just use the easiest method to extract data. If you disable USB and assume that's an end to it, then the attacker will either find a way to re-enable it (which you wont be expecting or monitoring), or find some other way to get data out which again is less likely to be noticed...

How many organisations control what you print? How many do it in a half assed way (eg your supposed to print through a printserver which logs, but its possible to connect directly to the printer which doesn't).

How many will do an adequate search to ensure you don't enter the building carrying a tiny camera, audio recording device, modem, wireless transmitter etc?

How many sites are in such locations that would make it impossible to throw something out so that it clears the perimeter fence and falls on public land where it can be collected later?

How many networks are connected to the internet and just restricted by firewalls, and how secure are these networks? In many cases its possible to get *something* out which could be used as a covert channel, and in even more cases its easily possible to compromise the local network to such a degree that you are able to modify the firewall rulesets to suit your purposes. The average windows network is horrendously insecure, and firewalls while generally much tougher unix based systems are often administered from windows workstations which sit on a trivially ownable domain, likely the same domain as end user workstations.

You are only as secure as the weakest link, and yet many organisations waste millions trying to strengthen areas that were never their weakest link in the first place.

Nokia, Microsoft put on brave face as Lumia 925s parachute into Blighty

Only 16gb?

And how much of that 16gb of storage is actually usable?

Also of the 2 people i know who bought windows phone handsets, both of them bought them at fire sale prices where they were significantly cheaper than any android or ios handset.

Sony sucker-punches Xbox on price, specs, DRM-free gaming

For how long?

When it came out the ps3 was backwards compatible to the ps1/ps2, and it let you run your own software on it through the otheros feature...

Who's to say sony aren't simply doing a bait and switch against microsoft, and will take away these features at some point in the future.

YES, Xbox One DOES need internet, DOES restrict game trading

Always listening

Microsoft: "We're always listening to our customers"*

* Via the kinect system integrated into the xbox one.

And "The PC is backwards compatible with games like doom (1993)"...

Not really, to play the original version you'd typically need an emulator like dosbox. The reason doom still works is because it was open sourced and people have updated it to work on modern systems.

BSkyB-owned BE slams into traffic pile-up over 'unlimited' broadband lie

Re: Come on 150GB a month

Sure, start watching shows in higher quality and your bandwidth usage will increase quite significantly...

Also lots of software is now distributed online, imagine downloading a few large games from steam or xbox live etc.

Incidentally, 150GB is equivalent to an uncapped 512kbit connection.

Hey, O2 punters: Kiss goodbye to 4 MEELLION* Openzone hotspots

Useless service

Like many, i always found the btopenzone service from o2 completely useless...

When they offered the cloud, i could set my phone to automatically connect and would find myself in various locations (primarily around london) where it worked just fine... It was also very useful in london, as the 3g network was often overloaded while wifi was generally usable.

With openzone if i set it to auto connect, i found that the vast majority of openzone access points just didn't let me on, so while i was in the vicinity of one email wouldn't arrive on my phone anymore which was highly irritating.

Because of this i virtually never used the openzone service.

Microsoft tops list of software piracy nailed in UK by FAST

Warez...

"Heathcote Hobbins added that unlicensed software downloaded from an unauthorised internet source - from file-sharing networks to shady websites - could be incomplete or littered with viruses."...

Or in many cases the downloaded software is not only complete and virus free, but is actually superior to the version you could have bought because it has user-hostile and dangerous features such as drm schemes removed from it. The amount of times i have seen such features malfunction and disrupt paying customers while the cracked copies keep on running.

PC market facing worst-ever slump in 2013

Obvious

This was a long time coming... General purpose computers have simply never been suitable for the average consumer, they are designed for geeks and are far too complex and with far too many things to go wrong for the average user.

The idea that typical users are able to maintain and use a system as complex and opaque as windows is ridiculous, and linux distributions although better in that regard were never marketed properly.

Tablets in their current form take away that hassle, plus they are cheap and affordable in a time when people are tightening their belts.

Despite what the anti linux crowd have been saying for years, a central repository where you can select and trivially install software is EXACTLY what users want and need. The idea that users would buy software in a box from a store, or that they're in any way clued up enough to safely download and execute binaries from arbitrary websites is ridiculous.

Experts: Network security deteriorating, privacy a lost cause

Sheep

These days noone bothers armouring the sheep, they just armour the pen they're kept in... If a wolf gets into the pen, he can have his pick of any of the sheep who will have become fat and lazy due to the false sense of security provided by the fences.

Orange customer clobbered with SIX-FIGURE phone bill

Unmetered...

This is why unmetered services are so important, sure you may not normally use more than a few hundred megs in a month but with an unmetered connection you take away the risk of something like this happening.

Same goes with water meters, one leak while you're on holiday and you could be faced with a massive bill when you get home.

New 4TB drive spaffs half a telly season into your eyes AT ONCE

Re: Seagate has a new 4TB 3.5in hard disk for digital video recorders

Go for a dreambox, they come without drives but will take and format a standard sata drive (2.5 or 3.5" depending on the model)...

Hard drive technology moves a lot faster than tv does so while a diskless stb will have a reasonable shelf life, hard drives either become obsolete or the price drops to much less than you paid for it so it makes little sense to tie the two products together.

What kind of pirate are you: Justified, transgressor or just honest?

Re: Hang on...

Rewarding people who pay?

The current services punish those who pay with restricted availability, restricted platform support, onerous drm schemes etc.

Those who pirate are rewarded with a better quality service, media in open formats and without arbitrary restrictions.

Higher paid than artists?

While 95% of artists may well earn under 10k, it is not their work that generally gets pirated...

It is the work of those 5% (or less?) of artists who earn ridiculous amounts of money while often not being any more skilled at their trade than many of the other 95%.

Not to mention the fact that the vast majority of money spent on media doesn't even go to the artists themselves and is instead embezzled by greedy middlemen.

Internet freedom groups urge W3C to keep DRM out of HTML

Re: Needs DRM

Any DRM, even a supposedly "open" spec would still be implemented by closed source binary only plugins, there would be no improvement over the status quo and it may even become worse.

DRM simply doesn't work, it's only a level of obfuscation, and the more open that becomes the less obfuscated it is. The more information you have about how the scheme works, the easier it is to break, but any scheme is breakable its only a matter of time and motivation.

Netbooks projected to become EXTINCT by 2015

Killed by MS and OEMs..

When netbooks first came out, they generally had a crippled linux distro (ie no package repository)... But they were cheap, and did what most people wanted...

Once MS got into netbooks, they stopped being small consumer devices and started being "small, slow laptops"... And if they increased the specs to be less slow, so too increased the price making them "small, expensive laptops".

So now you have tablets, small, cheap and not running windows (and the very few that are don't sell well and/or aren't cheap). Netbook OEMs made the mistake of thinking people wouldn't buy netbooks without windows, when in reality windows is a millstone around their neck.

The ten SEXIEST computers of ALL TIME

Re: Wot no SGI?

The indy looked like it should open along the diagonal slice, but alas the top was simply moulded plastic and it slid off like the lid of any other desktop of the day.

The Octane was actually far more modular, and easier to service than the indy while still looking pretty cool. I still have one in my garage that sees occasional use, it was my main workstation for many years.

Living in the middle of a big city? Your broadband may still be crap

Location...

Barbican is right in the city, they expect most users in the area to be business users who will buy leased lines rather than adsl.

GCHQ attempts to downplay amazing plaintext password blunder

FAIL?

What's strange is that GCHQ put a website online available to the public without it being pentested first, usually government sites must be tested by a company that's a part of the government pentest scheme (operated by CESG). Either that, or whoever tested the site missed something so ridiculous?

Incidentally, while storing plaintext passwords is generally regarded as a bad thing, every windows system does exactly this - stores plaintext passwords in memory as well as letting you authenticate using the hash itself (ie the hash becomes plaintext equivalent). If anyone else did something so stupid their products would be banned, but ms gets a free pass.

Oz shop slaps browsers with $5 just looking fee

Self defeating policy

"Those people are simply not aware that our prices are similar to the other stores and we have products not available anywhere else"

And those people never will become aware, because they won't pay $5 to enter the store...

UK biz ISP Entanet goes titsup, 'broke' a bit of Blighty's internet

Enta outage

I have a DSL line from Enta, and i lost ipv4 connectivity but ipv6 was unaffected for most of the time... When ipv4 came back online later in the evening, ipv6 dropped out although both seem to be working ok this morning.

Sysadmins: Let's perch on Microsoft Santa's lap, show him our wish list

They won't do anything without leverage

Ask yourself this, will you still be using MS software if they comply with absolutely none of your requests?

If the answer is yes, then they have absolutely no reason whatsoever to implement any of your suggestions. You are locked in, and you will take whatever crap they throw at you. They don't care about existing customers because they know they won't lose them, they only care about getting new customers and new markets.

CCTV hack takes casino for $33 MILLION in poker losses

Incompetent security is worse than none at all

This scam was only possible because the casino was being paranoid about cheating, but doing so in an incompetent way. It just goes to show, if you can't do something properly then don't do it at all.

Yet another Java zero-day vuln is being exploited

Ubiquity...

This is why no single piece software should be installed on 90% of machines...

When IE was the dominant browser, it made a great target for hackers. Now that there is diversity in browsers, they simply move to something else where there is no diversity.

The sooner there are 3 or more implementations of something each with a decent level of market share, it becomes a far less attractive target for hackers. And if there is an unpatched 0day vulnerability it's much easier for users to switch to another implementation, even if only temporarily.

Microsoft secure Azure Storage goes down WORLDWIDE

Re: Oh Rly?

It's not about guaranteeing you won't have an outage, that is impossible...

It's about knowing what you have, how its setup, and if something fails what's gone wrong and what you can do about it.

It's all about knowledge, control and understanding risk. With a third party cloud provider you have no idea how well (or otherwise) setup their infrastructure is, how resilient their hardware and power is, how it all fits together and you have no ability to fix anything if it breaks. With your own infrastructure you do know all these things, and you can make your own decisions according to how much resiliency you need vs available budget.

Over 100,000 sign White House petition for handset unlocking

Ridiculous...

Handset locks are ridiculous and immoral. There is already this little thing called "contract law" which is designed to protect the operators against customers who would take the handset and refuse to continue paying the contract.

Providing a user complies with the terms of the contract, what they do with the phone should be entirely up to them. Users may want to travel to other countries and use local simcards, they may want to lend their phone to friends or family, they may decide they dont like their new handset and continue using their service with their old handset while selling the new one.

Traceroute reveals Star Wars Episode IV 'crawl' text

Fakeroute

Rather than all that hassle, you could just use a program like fakeroute to fake the traceroute responses...

Asian political activists whacked in Mac backdoor hack attack

Re: Another argument ..

It's not about being immune, it's about being less vulnerable due to having diversity...

If there's a monoculture then you know exactly what software your targets will be running, and what vulnerabilities that software has.

Diversity is the main reason that drive by attacks against browsers have started targeting ubiquitous plugins (java, flash etc) rather than the browsers themselves.

BT copper-cable choppers cop 16 months in the cooler

Why should "the huge financial impact this can have on businesses" be the determining factor when considering a sentence? Businesses make continuity plans to cope with unexpected situations like this...

How about the fact that hundreds of homes were left without telephone services, some of whom are likely to be elderly or infirm and may depend on their phone line in order to call 999?

Nokia turns a PROFIT. Sort of

Re: So....

Not only that, but they sold their HQ, which is a one-off boost to earnings. In subsequent years they will be paying to rent it back from the new owners, who will actually want to make a profit from their investment.

Asia has fastest internet, launches most cyber-attacks

Is it really the chinese?

While attacks may originate from china, who's to say that it is actually the chinese launching those attacks?

It could very easily be compromised machines located in china, which are being operated by parties located elsewhere. If you are doing something illegal it makes a lot of sense to hide your activities by relaying them through systems located as far away from your true location as possible.

'Better than Adobe' Foxit PDF plugin hit by worse-than-Adobe 0-day

Diversity

The problem with Adobe is that it's ubiquitous... When you have one identical piece of software installed on millions of systems it invariably becomes a target, and this will always be a problem because no software is perfect.

Having a variety of different readers out there, with a good healthy split of install base is good for everyone.

Also people being aware of alternatives makes it easier for someone to temporarily switch to something else until a 0day is fixed in their preferred application.

And it also helps against targeted attacks, since the attacker must first try to find out what software their target will be using.

Minicam movie pirate gets record-breaking five years in prison

Re: 5 years is not bad

The only thing he will learn in jail, is how to commit other crimes. He will be in there with all manner of criminals, he will gain new criminal contacts and be taught all manner of illegal money making schemes. When he gets out of jail, he won't be able to get a legitimate job due to have a previous conviction, and so his only source of income will be the opportunities presented by his new knowledge and contacts.

ARM server hype ramps faster than ARM server chips

Where to buy?

I hear about all these ARM servers available, but where can you buy them? I have an OpenRD box which is pretty good, but it has a fairly old CPU by today's standards...

A modern replacement, rack mountable with 2x GigE, onboard SATA and a PCIE slot would be great but all i see are either cheap development boards which are too limited, or highend boxes which try to pack hundreds of cores into a small space which are huge overkill for my needs and have very high startup costs if you want to start small and expand later (eg having to buy a blade chassis)...

If i could buy a 1U ARM server with the above specs i'd be all over it, one for testing to start with and more later if they worked out ok.

Ever had to register to buy online - and been PELTED with SPAM?

Unique emails

I do the unique email thing with a slight twist relative to what everyone else seems to be doing...

Instead of company@mydomain, i do [e-mail] by using a wildcard subdomain. This serves two purposes:

1, i can junk the address with dns which causes less load on my mailserver (and i can create mx records which point back at whoever is the source of the spam).

2, Some spammers will take a given list of domains and try random common names @ the domain, so you can still identify the troublesome domain.

While i primarily use the unique email address setup to identify companies which have sold me out to spammers, i have found that several are starting to be sneaky about this - if the email address contains their own company name they won't give it out, so companyname@yourdomain wont get sold to spammers but blah@yourdomain will.

Build a BONKERS test lab: Everything you need before you deploy

Storage

Something like FreeNAS or OpenFiler is a good choice for storage, combined with a regular motherboard and a cheap hardware raid controller (so you have write cache which makes a HUGE difference for vm images, an hp p400 controller with 512mb bbwc can be had for 60 quid on ebay these days)...

Performs well and cheap while providing the convenience of an appliance, you could even repurpose your old compute nodes, or use the same motherboards and just go for less ram or cpu since neither are terribly important for such purposes.

Also the HP 1810-24 switches are a good choice, reliable, gigabit, managed and fanless.

Rampaging gnu crashes Microsoft Store, hands out literature

China

Your wikipedia page shows that at least since 2010, China has had more attacks against schools than the US, and yet guns are illegal in China...

It's not guns that kill people, it's not culture that kills people, it's crazy lunatics who kill people and illegal or not they will still be able to acquire guns... And if not guns, they will use swords, knives, or even home made explosives and achieve much the same result.

Make guns illegal and only criminals will have guns.

Microsoft 'surprised' by Google Gmail 'winter cleaning'

No surprise...

Google have to pay MS a licence fee for each user they have that uses activesync, which is a colossal waste of money for a free service...

Standard protocols like Caldav, Carddav, IMAP etc can be used for free...

Everyone else has good support for standard protocols, even Apple, it's only MS that refuses to implement them and try to keep you locked in.

Instead of complaining about google no longer willing to license a proprietary protocol and let you use it for free, how about complaining about MS for not bothering to support openly documented royalty free standards.

GPU-stuffed monster cracks Windows passwords in minutes

Re: Shock Horror

This is nothing to do with the network authentication protocols, which have their own weaknesses...

It is to do with the password hashes which are stored on disk and in memory (in the case of domain logons)...

Vista upwards stores the NTLM hash only by default, earlier versions stored LM too. As the article points out, LM is trivially weak while NTLM is also pretty weak too, and both are massively weaker than the hashing used in any unix system.

The networking protocols are another amusing issue, since there is no need to actually crack the passwords anyway. If you have the hashes, then you can authenticate against NTLMv2 and all earlier versions without knowing the plaintext (google: pass the hash).

It's also possible to man in the middle the network auth protocols (google: metasploit smb_relay).

And there are plenty of ways to obtain the hashes, you can pull them from disk, for domain logins you can pull them from memory (the plaintext is also typically stored in memory - google for mimikatz) when a user (or service account - very common for service accounts to be logged in to all kinds of machines, even with admin privs) is logged in... So your windows domain is only as secure as its very weakest member.

Xboxes stay on sale but may cost Microsoft money in Google case

Non disclosure

The fact that other companies settled is irrelevant as we don't know any of the details... It could have been for a trivial amount, or even a negative amount in exchange for the publicity... The "settlement" could also have been a deal primarily about something totally unrelated with the patent case tagged on.

Who's using 'password' as a password? TOO MANY OF YOU

Re: Double Fail

There are more problems than that...

Most password strength enforcement systems are garbage, very few check for dictionary words for instance so Password1! is often a perfectly valid choice as it is >8 chars, contains numbers, mixed case letters and symbols - and yet is still trivially easy to crack.

And then you have the inconvenience, far too many passwords to remember because every trivial little site thinks its important enough for you to bother using a strong password.

And then the trust aspect, do you know *HOW* a particular site stores your password? Most sites never disclose to you how user passwords are stored and what precautions they take to protect them, and even if they did they could be lying. There are plenty of sites out there, including some big names that store passwords in plain text or in a form thats easily reversible to plain text.

So i use an intentionally weak password combined with a throw away email for most sites, if the site has a password policy i usually just append 1 or 1! to the end to get round it.

As for throwaway email, spamdecoy.net isn't the fanciest of sites but it works well and has several domains you can use (some places block the common disposable mail domains after a while).

Lawyer sues Microsoft rather than slot an SD card into his Surface

Exceptional...

While all devices come with some space occupied by the core OS, MS use a HUGE amount of space relative to all other competing devices.

Sky support dubs Germany 'Hitler's country'

Outsourced to asia..

The name Hitler just doesn't mean the same thing in most asian countries... Few of them will have learned about him in school, and he was never an important part of their history. Many will not even have heard of him at all.