Posts by Michael Wojcik 12299 publicly visible posts • joined 21 Dec 2007
Why would all self driving cars not be in constant communication with all others within their stopping distance using a standardised protocol? It would seem a trivial thing to implement in the scope of self driving.
This is clearly a meaning of "trivial" that I have not previously encountered.
How about a train of cars at 100mph on a motorway, 5 feet from the car in front using less petrol than driving a safe distance at 60 mph due to reduced wind resistance?
This "convoying" argument is often made by people who have never seen a car come apart on the highway.
I have, more than once. Saw the entire rear bumper assembly fall off a car traveling in the high-speed lane once.
I have a friend who used to drive a tow truck. One time we picked up a Jeep that lost a wheel - fortunately in a parking lot - when the axle sheared due to a manufacturing defect.
That will be fun when it happens to the car 5 feet in front of you, while you're doing 100mph.
Just a couple of weeks ago a deer ran across the road in front of me. That's a common occurrence in this part of the country, but in this case the road was the eastbound side of I-70, a major restricted-access multilane highway. It came out of the trees in the median, so it wasn't visible until just before it entered the roadway; and it was a summer afternoon, so thermal imaging wouldn't have been much help either. That would be a pretty bad event for your 100mph convoy, too.
Eliminating human drivers does not eliminate all failure modes.
Small scale biodiesel plants are affordable and small enough to be kept at home, and can be powered with cooking oil. Ok, that may mean most survivors run on the devils fuel, but there will always be something to run an engine on.
It's easy to convert gasoline engines to propane, and that ain't going away any time soon.
I love driving
I find driving terribly boring, but I'm not looking forward to automated cars. At least when I'm driving I can decide, on the spur of the moment, which route to take, when to stop, etc. When I want to leave those decisions in someone else's hands, there are taxis and livery cars and public transportation.
I think YOU should USE MORE block CAPITALS. It makes for a TERRIFIC reading EXPERIENCE.
But congratulations on kicking off the inevitable chorus of commentators posting the same tired, unworkable "solutions" to the problems with the patent system, such as non-transferability and eliminating NPE ownership. We never get tired of seeing those same proposals in the comments for every single story that mentions patents.
OK. It's time to extend the Reg automatic comment generator to pre-populate the comments section of any battery related story with the following two hyperbolic and sophomoric comments:
"We see a new-battery-tech story every five minutes in the Reg but no new-battery-technology has ever come to market!"
and
"You idiot, batteries are a million times better now than they were last week, which proves that every single story about new battery technology heralds yet another breakthrough."
And then perhaps we can all move on, eh?
And I'm far from being "on the market". Just doing sexurity research, with my wife looking over my shoulder and laughing, as I was laughing.
You only sign up for the articles, eh?
Not that I don't believe someone would peruse dating and "hook up" sites purely for the inherent humor, mind you. I've never bothered, but I've read accounts from people who have used them, and some of them are damn funny. But the qualifications are starting to sound a bit defensive. Less, in this rhetorical situation, is more.
In my day they just singled out a kid with the wrong hair colour/physique/aptitude for sport/accent/whatever else they chose to pick on, instead of trawling through a 9.6GB database to find potential victims.
Damn bullies, stealing my lunch money to pay for their AWS clusters.
Or that time they made me debug their R code.
So somebody used somebody else's email address, and yet the person who owns the email address, just simply ignored or deleted all of the emails that AM sent them?
I'd never heard of Ashley Madison before this story broke. If I'd received emails from them they would likely have gone straight to the spam filter.
Offhand, it looks like the Stagefright bug could be used to root the phone on devices where it runs with system privileges. Apparently (according to the Zimperium blog post), on some devices it only runs with media privileges - but privilege escalation is always a possibility.
So, yes, this is probably another vector for rooting Android phones.
There are some useful things you can do with a rooted phone. Titanium Backup can hide vendor-installed crapware on a rooted phone, for example. You can replace the stock Android with CyanogenMod. You can disable Stagefright, if you don't care about playing media files or have an alternative decoding library. And sometimes it's just fun to fire up a console session and go poking around in the system.
I rooted my first Android phone but never got around to doing anything interesting with it before it died. My current one came rooted - bought it from a reseller via Amazon as an unlocked, no-SIM phone, and as it turned out it was rooted as well. Handy.
That really doesn't help the picture.
Oracle are claiming they find and fix thirty times as many security vulnerabilities as are revealed to the public. Even if that happens before the code in question is released, there's something very wrong with Oracle's development process, given the number of issues that are published.
Occam's razor isn't an absolute. It certainly can be wrong
More precisely, it's an observation about probabilities that should be applied to a probabilistic model, not used as a filter. A Perfect Bayesian Reasoner always implicitly applies Occam's razor, which is simply a matter of acknowledging that multiplying a positive number by a value in [0,1) results in a smaller product. Thus "multiplying entities", to paraphrase Punch's gloss of William of Ockham's principle,1 reduces the overall probability of the thesis, if each "entity" has a non-zero probability of being incorrect.2
1Wikipedia has a nice summary of the tortured path of attribution and paraphrase by which we get the various phrasings.
2Prolepsis: Yes, I'm aware that Punch is using "multiply" here in the sense of production, not in the arithmetical sense, as he predates modern probability theory. His version, like William's, is an informal grasp of process that we have since formalized, in basic probability theory and in more complex ways such as various Bayesian models.
It's even dafter down here in the lower half of the planet: it's still winter. Bloody hemispherists.
Oh, stop complaining. You'll get summer eventually. Probably.
You don't hear us whinging about having to turn the monitor upside-down just to read your comments, do you?
There is no finesse,... No finely crafted tricks in hiding, just a blatant smash and encode, and it works?!?
I'm not at all surprised. What finesse would be needed? The user ran a program to encrypt a bunch of files. On a Windows system, it's basically the same as running "cipher /e /s *", except using a third-party program rather than the built-in EFS utility cipher.exe. Or similarly with gpg or whatever tool you like.
Now, in the particular case of ransomware, the user foolishly ran an encryption "utility" that ships the key off to someone who can extort the user, rather than giving it to the user. But that's just a minor tweak to the User Interaction Model.
As I understand it, some ransomware is more sophisticated. It sits in the system for some time, silently decrypting the files it's encrypted on the fly, so that you don't know it's there - long enough to have had a reasonable chance of encrypting your backups as well. Then it springs the trap. That's a bit of subtlety (and a reason why you should verify backups from a different system). But that's clearly aiming at something a bit higher than the low-hanging fruit.
Have a 3rd party encrypt your PC before you travel then pay them to decrypt it afterwards?
Bruce Schneier suggested this protocol to protect hard-drive contents from rapacious Customs agents.
In his version, you encrypt the drive, put the key on a USB drive, and mail that to a contact in the country you're traveling to. You make sure that you don't have a copy of the key, so that when questioned you can truthfully say you can't decrypt the drive. (I don't have a link handy - I think this appeared in his blog and his CRYPTO-GRAM newsletter.)
Of course, as Randall Munroe has pointed out, authorities tend not to let you get away with this sort of life hack. And that's particularly true, at least for US borders, where following the letter of the law seems to carry little weight with Customs.
I expect it is because if you encrypt a vast number of known files with the same key then it becomes easier to analyse and recover that key.
A "vast number of known files"? How many files does the typical victim have? You know of a known-plaintext attack against AES? And one that works with, what, a few hundred GB of data?
If the encryption is any good, then no, it does not become easier to recover the key - unless you happen to be in the possession of an unpublished and remarkably valuable attack against a modern symmetric cipher, in which case you presumably know enough to secure your systems against infection by ransomware in the first place.
So you encrypt each file with a unique key, then encrypt the table of files and keys with another key which you then ship off to the server.
Even if this were necessary (or useful), there's no need to generate a new completely independent key for each file and then send a whole list of them back to the server. This protocol is just as secure:
1. Let H be a cryptographic hash function with an output at least as long as the encryption algorithm's key length.
2. Generate random initial key K0 which is sent to the server.
3. Encrypt the first file with K0.
4. Subsequent keys are generated with Ki+1 = H(Ki). If necessary a padding function such as PKCS#7 padding can be used to extend the input to H.
The ransomware ... administrator? bandit? ... can generate the same series of Kn, since he has K0 and knows what H was used. Assuming H has no known weaknesses, each Ki is equally strong. Even if, say, 10000 files are encrypted, it's not very expensive to try on average 2500 keys1 to decrypt the first block of a file and see if it looks right2, for a total of 25 million decryption operations for key-identification purposes.
I've never looked into ransomware in any detail. If I were writing it, I certainly wouldn't bother with this pointless multiple-key scheme; but if for some reason I did, I wouldn't generate an independent key for each file. That's just silly.
1For the first file, you have to try on average 5000 keys to find the right one out of the 10000. For the last file, you only have one key left, because when you find a correct key you discard it after decrypting the file (each key was only used once). So the average is 2500 keys per file across all the files.
2Assuming that the ransomeware in question only encrypts files of a type it recognizes, and that most or all of these can be identified using bytes in the first block. Maybe we have to try a few false-positive keys or decrypt a couple blocks; that doesn't significantly increase the cost. And the cost is borne by the victim anyway, so why would the attacker care?
Argh. XSS and SQL injection are so very different.
document.getElementById("body").value="pwned"; document.forms[0].submit();
(I'd have enclosed that in script tags to make it look right, but that dumps me on some Cloudflare captcha page. So apparently Cloudflare are, in fact, doing some sort of input blacklisting for the Reg. Bah. Sanitize on input and generate output correctly. Don't filter - it's ugly and leads to a lousy user experience.)
the El Camino Real
"The the royal road", eh?
And it's not like the Bay Area's El Camino Real is the only one in the US - there are a couple others in California, and New Mexico's El Camino Real de Tierra Adentro is a good 85 years older than that newfangled one that runs through Palo Alto. Not to mention the ones in Mexico, other former Spanish colonies, and Spain itself. The Spanish royals were all about establishing roads.
These houses have wheels under them for a reason
Apparently the homes in this park are single-wides, so it's possible they're relatively mobile, but often "mobile" homes in the US have been modified to the point where moving them is an expensive proposition. It's worse with double-wides than it is with single-wides, but even so I wouldn't count on this plan being particularly feasible.
Can't the county go find a 4.5 acre parcel for less than $39 mill within a reasonable distance
Probably only for pretty large values of "reasonable distance". Property in the Bay Area is expensive. Certainly I'd think it very unlikely that someone could find a suitable plot that would offer similar commute times and other amenities to the residents. They're right on El Camino Bignum now.
the days of .com's unquestioned dominance are all but over
They are? Who aside from hipsters and idiots is actually taking gTLDs seriously? Sure, Larry and Sergey grabbed a .xyz for their new toy, and Larry in particular has some kind of fetish for gTLDs; but that's no guarantee that serious businesses will be deserting the .com TLD in droves.
The land rush for gTLDs thus far is clearly speculation, and largely unsuccessful speculation at that. All signs suggest the vast majority of Internet users neither know nor care what gTLDs are, and many of the people who do know what they are find them annoying.
Most Freeview HD compliant kit that I've played with prompts if the same programme is available in HD.
Our cable provider pushed through an over-the-wire box update a few weeks back that does this, among other things. Yet another obnoxious intrusion when I'm trying to watch something. They're just pushing me closer and closer to dropping them entirely.
And we have WOW, which has been rated the least-despised cable company in the US by people responding to Consumer Reports surveys. I can only imagine what things would be like with, say, Comcast.
Movies in particular benefit though
Meh. HD doesn't make the plot, dialogue, acting, or directing any better. Personally, I don't much care about the rest.
We have an HD TV (couldn't really get anything else when the old one died), and maybe a hundred HD channels. We rarely watch them because the SD equivalents come earlier in the online program guide, so we never scroll as far as the HDs. When I do happen to see something in HD, the increased resolution doesn't do anything for me.
I remember when we (my family and I) used to timeshift programs using VHS VCRs recording in EP mode. That didn't hurt our enjoyment. Indeed, I find I'm less interested in television these days, with my 500 channels and on-demand and Netflix and HD and DVR and blah blah blah.
Now if you'll excuse me, I have to go yell at those kids.
If your reception is so bad even an SMS is hit or miss, you basically don't have a practical second factor to work with, which means you're SOL.
No, it just means you need a second factor that doesn't require a network connection. Those synchronized CPRNG tokens work just fine in that environment, for example. So do smartcards, which use physical possession as one of the two factors.
We had 2FA long before we had smartphones. Don't let smartphones limit the options.
That'd be a bit more clever if 1) this issue was in any way related to SQL injection, and 2) everyone on the entire planet wasn't already familiar with xkcd #327. There are tribes in remote regions of Papua who have never seen a computer, but nonetheless have seen crude1 hand-drawn versions of the tale of Little Bobby Tables.
But, really, the former item is the key one. XSS is not SQL injection, and no one is served by confusing the two.
1As opposed to Randall's exquisitely minimalist renditions, of course.
But we are slowly getting there.
True, for sufficiently large values of slowly.
One big problem is that research is far ahead of most practice - and has been for decades, probably since the '70s. Few development organizations regularly use even the widely-available, well-understood free and commercial tools for static and dynamic checking, for example. Even fewer seem to use things like fuzzers1, code-coverage statistics, intelligent testing engines, etc. And I suspect very few have anyone paying attention to research in the area, except the occasional oddball doing it on his or her own time.
So while work like this - both offering a new technique and using it to discover issues in commonly-used software - is very welcome, the dreary fact is that typical software development teams aren't even using techniques as old as lint. (How many of you have worked on teams that routinely ignored compiler warnings?)
And this is why we need bug bounties - not just to give researchers an incentive to find and report problems, but to show the beancounters at the bounty-paying companies what kind of RoI they might realize from imposing better development practices.
Of course, Oracle doesn't need a bug-bounty program. Adam Gowdiak will keep them amply supplied with JRE bugs for the rest of time. Ellison has cleverly deduced that by being an arrogant jerk, he can get researchers to report bugs in his software just for the satisfaction.
1The situation here seems to be a bit better with web development - we see a number of our customers running various web-testing packages, free and commercial. I suspect that's a combination of the simplicity of running those packages and a dim recognition among upper management that public-facing web apps are often riddled with security holes that can lead to expensive compromises.
Good lord, what idiocy won't these people spout?
The collapse of the gTLD bubble can't come soon enough for me. It's too late for all the speculators to be wiped out (some took profits quickly), but maybe the remainder will suffer for their sins. And if they work up a class-action suit against ICANN on some pretext that would be lovely too. (Not that there's any legal grounds for finding against ICANN, but maybe the threat would make them think a bit harder before trying something like this again.)
... against Alex Stamos. If he wasn't involved in this decision - and I imagine wasn't - he should have gotten involved when it blew up, and reinstated the internship to show good faith with researchers who publish vulnerabilities in Facebook products. If that means admitting the company was at fault, well, that's what it means to be in charge of IT security.
So far it appears he's a typical "security chief": all bluster and no interest in actually acting in the interests of IT security or users.
After all, an "intern" is analogous to free slave labour
Many companies offer paid internships. I don't know the ratio offhand for the undergrads in the Professional Writing program I sometimes teach in, but I do know many who have had paid positions for their required internships. Some are internal (in the university), but many are external.
You do realize there isn't much difference
There isn't any difference. I drink water extracted from "poo" too, and so does everyone else on the planet. Unless you're synthesizing your own water from some pristine source of hydrogen and oxygen, every water molecule in your body has very likely passed through some other animal at some point.
Now, the machine I have for extracting water from poo is a bit more complicated - it's called a DWV-system-plus-sewers-plus-sewage-treatment-plus-water-cycle. But it does the same job.
(At my soon-to-be vacation home, that round trip will be even shorter, because we'll have a septic system and leach fields and a well. The well head is at least the required 100 ft from the septic tank, and even further from the leach fields, and the predominant water propagation from the fields might be away from the well. But inevitably some water will diffuse out of the fields into the well.)
I've known Steve for about 20 years and he is anything but a nutjob.
Perhaps. That doesn't change the fact that ICANN continues to have a miserable record for transparency, accountability, or changing things that are patently broken.
I think ICANN is simply a toxic organization. When Cerf was running it, it did all sorts of things that were highly questionable, if not reprehensible. If Vint Cerf didn't run ICANN in an acceptable fashion, who will? Maybe the chair doesn't have enough power, or maybe it's simply a position that makes it too difficult to resist a tyrannical stance.
Sorry, but you can't argue that slavery is not good for business, just ask any economist.
Slavery is less efficient than capitalist wage-slavery. That's a well-supported economic thesis. So yes, you can argue that, and economists have.
But thanks for playing.
I have some long e-mails to write to the owners of various online publications I write for about implementing SSL by default
Well, now, there's one problem. I don't want TLS everywhere on the web. My security model is not your security model, so why should I support your effort to impose your security model on me?
When I read the Reg, I don't need or want the extra overhead of TLS. For that matter, when I post comments, I don't need or want it. I don't care if someone goes through the (not trivial) effort of impersonating me here.
The HTTPS Everywhere fanaticism is only one small corner of IT security, true, but it's symptomatic of the whole. Every armchair security expert has some axe to grind. I don't believe I want an Occupy Computers movement agitating for a lot of ill-considered, poorly-understood security "fixes".
Some of IBM's XStations used 80186s, with TI TMS34020 or similar as the GPU.
Can we wax nostalgic about the 34020 too? When I was at IBM, circa 1990, I wrote code for the thing, for a document-imaging system that I don't think was ever released. Mostly I pushed ddx routines for X11 down to the card, actually, which makes me wonder if any of that code ended up on the XStations.
Security is like virginity and balloons: one prick and it's gone
A sophomoric reducto ad absurdam. No one who actually studies security in any serious way would make such a statement.
Security is not a binary condition. It's a measure of relative costs under a threat model.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
