Posts by Scoured Frisbee

Imagine surviving WW3, rebuilding computers, opening up GitHub's underground vault just to relive JavaScript

> A human-readable index and guide have been stored too.

And in which language are those?

'iOS security is f**ked' says exploit broker Zerodium: Prices crash for taking a bite out of Apple's core tech

> Add time and financial motivation, he said, and you get more bugs.

No, if you have time and financial incentives you will get more issues. The bugs were already there.

What do you call megabucks Microsoft? No really, it's not a joke. El Reg needs you

No one has proffered "Bitzilla", the software monster?

Google says its latest chatbot is the most human-like ever – trained on our species' best works: 341GB of social media

Re: Hummm soo...

Did you see that ludicrous display last night? The thing about Arsenal is, they always try to walk it in.

The D in Systemd is for Directories: Poettering says his creation will phone /home in future

I totally get not mixing state and configuration in /etc, and it is trivially obvious that this is going in the opposite direction - as the follow up line of questioning revealed, if you have to get the system to sign your home directory then now the home directory is storing configuration. Whatever, I've built systems that had problems too, if I don't catch them then hopefully someone else does and we figure it out - that's why I enjoy working with smart people.

What I don't understand is what is happening at RedHat. There are plenty of bright folks at RH who could have easily come up with all our above objections and then some. How did P get to a conference before he considered them, and that on stage? Is there some cult of personality going on, or dearth of management keeping communications open? Did all the good developers move away because of a toxic environment? Something something agile devops sprints? As someone who has occasionally considered RH jobs I am genuinely curious...

No it's not Russell Brand's new cult, it's Microsoft's Office crew rolling out their Save Experience

Illustrations

Microsoft... Blah blah whatever. Kudos to the Reg team for making great art for the article - I got a good giggle out of "A Word document saved to OneDrive" and was happy to see truly relevant images. Cheers!

Microsoft's only gone and published the exFAT spec, now supports popping it in the Linux kernel

Re: What if ...

> AFAIK no one has seen fit to do an open source driver for ext on Windows...

https://sourceforge.net/projects/ext2fsd/

Been using it recently for pulling data off a USB ext2 drive, but I seem to recall having previously used it with ext3. Can't speak to its writing but reading is great.

It is a user space reader, I'm not sure if there's a way to make it load dynamically when a drive is connected. It's been pretty stable, and I don't reboot very often, so this has not been a huge limitation for me as a technical user - for my wife and kids it would be, but then they have no interest in reading my old backup drive anyway...

Sleeping Tesla driver wonders why his car ploughed into 11 traffic cones on a motorway

I fell asleep in that stretch some twenty-odd years ago, driving across the state late after graduating and moving out of my college apartment. My mid-80s Buick was not so good at self driving - I took out a bunch of median poles and destroyed the car, but was not injured and fortunately no one else was involved. Glad it was only superficial damage for this gentleman.

That night I did receive a ticket for driving too fast while being asleep. It was certainly true and I paid it, along with enhanced insurance rates for some years My parents also paid for the DOT to replace the median catcher for the next sleepy fool - my graduation/survival present!

In NC most road construction sites are not populated; often cones are put up at the extreme ends and stay up for the years it takes to finish a project. Not to justify running the barrier but odds are good no one was actually at the site beyond the other drivers. From the video I'm glad the driver did not instinctively jerk to the right upon waking!

DXC Technology exec: What should our brand be known for?

* Redundancy: it's not just for data anymore

* DXC: "nothing" is our middle name

* When everyone says it's impossible, DXC will take your cash up front

* It's not witchcraft, we're sinkimg

* Testing contract law since 2017

* Good, fast, cheap: we've heard of them

* Now offering flexible timetables for your projects

Germany has a problem with the entire point of Amazon's daft Dash buttons – and bans them

Re: A 'proper' use for the buttons

I am surprised it took this august community so long to get to the real utility of these (and presumably why Amazon charges cost). I have a number of the buttons, they hop on the WiFi when pressed and then drop off after timing out - five minutes if I recall. This makes it trivial to script stuff, even with openwrt or the like - just be sure to block the uplink so you don't really order anything!

They're good for counters, logging when something happens, reminders - anywhere you want a binary input and can wait five minutes between events.

Nobody in China wants Apple's eye-wateringly priced iPhones, sighs CEO Tim Cook

Re: Overpriced kit

> We have 4 newish iPhones in our family and the total cost for all of them together is just under £750.

I bought my daughter a 6s for Christmas, the cheapest usable one I could find from a reputable vendor was us$200 - and it will be out of security in a year. (That said she doesn't have any money, so I'm expecting her to keep using it until something crazy happens.)

But where'd you pick up 4 for £750?

Oregon can't stop people from calling themselves engineers, judge rules in Traffic-Light-Math-Gate

Re: Restrict engineering

To add to the above poster, as a licensed professional engineer I've agreed to put the health and well-being of the public before my own and employer's interests. If you disagree with my actions you can complain to the board, which will pull my license.

Once I asked some peer software engineers from a public-facing company the last time they considered anyone other than their employer and immediate customers. It took them most of lunch just to parse the question, the concept was completely alien. I don't think they were doing anything malicious, the wider impact of their code (and there is a lot!) just wasn't part of their thought process.

Personally I'm in the 'licensure is fine if you want it' camp, but I see the value in having an external group with whom to discuss ethical concerns, and the unspecified fear of having to justify some possibly-unethical action to a board of peers.

Git it girl! Academy tries to tempt women into coding with free course

Re: "they aren't interested"

Hey, so, I totally get not wanting to reply to every bigot. However you and I would like a nice public collection of stories about women in the profession - both for advertising to students/children and also for responding to 'there's no different treatment' - and it strikes me that you are in a position to get them. Any chance you could convince the Reg editors to do a series of interviews with female and trans coders/ IT staff/ architects, and maybe women who shifted away from computers and why? It would be a very valuable contribution to the field.

Scam alert: No, hackers don't have webcam vids of you enjoying p0rno. Don't give them any $$s

Life imitating art

Surprised it took this long, frankly:

https://en.m.wikipedia.org/wiki/Shut_Up_and_Dance_(Black_Mirror)

Yes, people see straight through male displays of bling (they're only after a fling)

Re: Funded by a car manufacturer by any chance?

Anybody have recent research on new car depreciation? I was shopping for a Camry (US) a few years ago; after straight-line depreciating for mileage the used cars were 10-20% more expensive than the new offers from Toyota, not even accounting for better interest rates. In fact for most of the slightly used vehicles I found (<3 years / 30kmi) they were -in asking price- more expensive than the Toyota new prices.

I've driven old and fixable cars forever (mostly old Mercedes and Volvos) but shopping for a newish reliable one made me second guess the common wisdom. Now that cars are basically odd-shaped computer cases I'm not sure if it was a weird market thing or a new trend, hence would appreciate any pointers to reliable recent surveys.

'Well intentioned lawmakers could stifle IoT innovation', warns bug bounty pioneer

No love for IoT...

...but I find

> governments would be prohibited from buying IoT kit with known vulnerabilities as ill conceived

as eminently reasonable. Cisco didn't patch its switches for Meltdown/Spectre, but they are known to be vulnerable, for example.

I've worked in enterprise embedded software for nearly 20 years, releases that have shipped without known exploitable bugs were usually found to be under-tested by the field.

There's definitely a spectrum but drawing a bright line just means companies will lawyer up until vulnerabilities can't be disclosed, not that IoT kit will suddenly become impenetrable where the rest of the software industry has failed.

Ethics? Yeah, that's great, but do they scale?

Re: Great!

One of the (dis?)advantages of being a professional engineer is being held responsible for the general welfare, and having access to a board with which I could discuss ethics issues. It is a reminder to think of the public (not just customers!), though that probably would mean I'd be out of the company if it came to it.

For me I'd rather be ethical than employed, but I can see how I would be tempted to compromise in such a situation. As such having the extra layer of oversight is good for me.

TVEyes blindsided: Fox News defeats search engine in copyright spat

Re: Ten minutes??

TL;DR

Arlo, can you go? NETGEAR spins out its security cameras biz

I'm interested in and possibly afraid of the organic products they're expecting from Arlo.

HP coughs up $6.5m to make dodgy laptop display lawsuit go away

Re: Similar Prob

On the subject of lemons, the worst laptop I ever had was a Powerbook. One day I came home to find it in the driveway, my wife had thrown it there hoping I'd run over it so I couldn't fix it again.

So there's my Apple story. Not to worry, I have plenty of others - my wife is great at destroying electronics from any manufacturer.

Ever wondered why tech products fail so frequently? No, me neither

Re: UAT Testing

That's why professional software testers automate everything they can, so the next time they get to break it by doing something else. Now if someone can point me to a vendor that has enough testers to automate and also meet schedules I will buy only from them henceforth.

Space.. the fi, er, New Frontiers: NASA to hurl space robot at duck comet – or Saturn moon

Re: Europa

Surely drilling Europa should be the domain of the ESA?

NiceHash diced up by hackers, thousands of Bitcoin pilfered

Assume he meant "after reader Lee Reeve"...

Is that a bulge in your pocket or... do you have an iPhone 8+? Apple's batteries look swell

Re: Obligatory

After the last few gushing Apple articles I thought for sure the editors were trying to work their way into press invites. Guess Kieren didn't read the memo...

Hey, IoT vendors. When a paediatric nurse tells you to fix security, you definitely screwed up

From the article it looks like she's been a security professional for the past three years - how long until the headline is no longer "paediatric nurse" but her actual current occupation?

Falling apart at the seamless: Inside Apple's LTE Watch fiasco

Re: no surprises here

Dunno, I opened the opposite bug on Android Wear 2 - you can set the watch to stick to a captive portal network (for example to use an aftermarket browser to login), but the setting is reset on boot. I bought an extra charger just so I could use ADB at work to tweak this setting - I usually leave my phone at my desk and just wear my watch around.

Anyway someone in Silicon Valley is thinking about captive portals, just not someone at Apple.

Horsemen of the disk-drive apocalypse will ride upon 256TB SSDs

Confused editor?

> SSDs in the same format reach 11TB, in excess of five times more, and have far shorter data access times and higher rack space, power and cooling needs.

SSDs have higher power and cooling needs? I hope that's not right.

> Disk technology has little chance of reaching 100TB+ capacity levels in the next few years.

> 128TB SSD coming from Samsung

> New 1U server SSD format (NGSFF) from Samsung to create 576TB server storage

Can you please talk more about why you expect these products won't make it to market in the next few years?

WannaCry-slayer Marcus Hutchins 'built Kronos banking trojan' – FBI

Serious question - is it illegal to sell exploit software? I mean, I wouldn't want to be the buyer, but for some reason I thought the sale of such stuff was actually legal.

Shadow Brokers hike prices for stolen NSA exploits, threaten to out ex-Uncle Sam hacker

Something doesn't add up

200ZEC=$65000

400ZEC=$131000

Price fluctuations while the article was being written?

F-Secure's Mikko Hypponen on IoT: If it uses electricity, it will go online

The automotive market appears to disagree with your optimism.

Boeing preps pilotless passenger flights – once it has solved the Sully problem, of course

Re: Remote pilots?

No reason you couldn't have constant / frequent simulated or replayed emergencies going on the remote pilot console, just halt the emergency at random if it's not live so you never know until the end if you got interrupted with a real one. I could see some benefit to having an expert in fatal crash situations piloting the craft, and making the whole thing one constant game would keep the remote pilot sharp for the real life situations.

Obviously that doesn't solve the connectivity problem but it's not completely silly. I'd love my pilot to be assisted by a remote emergency specialist, I just don't want to be on the plane where the remote pilot decides "oh this can't be real" and turns us sideways into the Atlantic.

Speaking of, I haven't read Ender's Game in a couple years.

'I feel violated': Engineer who pointed out traffic signals flaw fined for 'unlicensed engineering'

I'm registered as a Professional Engineer in a US state that nominally restricts the term - not that it matters in our field, all of my colleagues advertise themselves as engineers but the reality is I do not work in a regulated field (software) so the state board leaves us alone. I only got the license because I wanted to have it for personal, family legacy reasons.

However, I do think prior comments have incorrectly trivialized what it means to be a registered Engineer. This is my state but throughout the US it is similar. Getting a PE certificate involves:

- having an accredited engineering degree, non-engineering degree plus some years of experience, or no degree and ~20 years of experience;

- taking a general knowledge-based exam covering general topics like physics, math, materials, civil engineering, electrical generation, and so on;

- working as an engineer-in-training for at least four years, with consistently increasing responsibility;

- getting personal and character references from other professional engineers and community members;

- taking an experience-based exam that covers a variety of topics across disciplines (when I took it about half the applicants passed);

- paying your fees, nominally the board has to approve but I think it is rubber stamped once you've met the above.

- renewing annually, which includes recording at least 15 hours of continuing education directly related to your field of discipline.

Finally, professional engineers sign off that they swear to protect the health and welfare of the community above their own gain or corporate interests, and are subject to discipline by the engineering board for a variety of offenses above and beyond legal issues.

Professional engineers started getting licensed around the country because unqualified people started building bridges, mostly. People literally died, politicians contracting for roads and buildings started asking "how can I be sure this builder knows what he is doing, takes his work seriously, is more interested in my safety than his bottom line?"

For several reasons I don't want software engineering to require registration, but I suspect that these questions will resurface after a few more Toyota brake incidents, or to put it another way as software starts to kill people more frequently.

'Trash-80' escapes the dustbin of history with new TRS-80 emulator

While growing up my father had a model 1 with expansion, ironically he preferred the tape drive to floppies. I do remember buying cassette loading games at the flea market. Eventually my aunt sold it at a church tag sale - this was after 2000 but I think my father is still upset at her for not returning it.

He also had two model 100s (one and a spare) for work, so when he was out of town we could use the second. Eventually they came to me; one broke in the mid-noughties and I tossed it, along with the printer and tape drive and... but I kept the second. Around 2014 I started using it to "randomly"* generate the kids' lunch items. It is still going fine for purpose: boots up at least once per school day, runs the program automatically, shuts down after a minute. I've only replaced the batteries once since then!

*Worst. Randomizer. Ever. I made it a bit better by decoupling the loading of sweets and salty, but it still gives unfortunate runs of selections. Nonetheless because it is a computer the kids quit complaining, which I suppose was the real point after all. ;)

The 'data driven enterprise' is actually just the enterprise

I've been using a catch-all email address on my domain for many years (needs a good spam filter). Originally I was hashing the domains but now I just use the domain name, mostly (e.g. [e-mail]). Until some human looks at it I don't have a problem; when I read it out they usually think I'm some kind of corporate shill, but so far they've always typed it in. I do have certain filters for received address, and when a vendor loses an address I can block it quickly.

I think you can append +xxxxxx to your gmail address, too, if you're into the Google thing.

Why software engineers should ditch Silicon Valley for Austin

That governor did get voted out - but frankly that was the point of the aside. Not wanting to go somewhere because 'the state' is Democratic or Republican is just foolish - regardless of political labeling the urbanites are more urbane and the rural folks are less so. Every coastal state is composed of both. I'm not going to pretend the greater part of NC (or TX, getting back to the article) is a super place to be right now, but you can't judge SF by Barstow or NYC by upstate, either.

I've seen many local businesses with individual restrooms switched to all-gender signs post-HB2. I hope this is a trend nationwide; when I was in Santa Clara last month I didn't see anything similar, but maybe I just didn't go to the right places? While NC HB2 remains a travesty, the legislators from my district are working to kill it, the new governor will sign it into oblivion, and there will remain all-gender bathrooms all over the city and hopefully the rest of the country as well.

All that to say, I originally posted to address Kieren's observation about SV Google vs. the failed Denver startup - there are more failed startups in SV so taking that MS job in Redmond might be the right move for long term CV readability, though it will be easier to get new work when that SV-based "Facebook for suburban irreligious mothers with three children and one dog" fails to get a series B. We all have our different desires for careers and so it's silly to think any one path will fit everyone, or even any one person for their whole working life.

Replace Google with Oracle, SCO, Lucent, MySpace, all the failed YouTube and eBay competitors from SV I don't recall, Amazon/MS in WA, and see it's hard to guess in advance what will sound positive in ten years. Sure the VC money is in SV but real companies have offices everywhere, if you just want a recognizable name on your CV.

Lots of my colleagues moved from SV to RTP, NC for schools, yards, and affordable housing with mostly comparable weather. A handful have moved the other direction - generally, while young and single - for startup opportunities. May be unique to my industries as RTP has large second sites for most of the established NW and storage players, and many of the little ones.

And for you political snobs, the tech hubs throughout the States are mostly large cities, which by and large landslided Clinton. NC, amusingly, had the top few highest-percentage-registered-Democratic counties in the country*, though they are crazy rural so you'd not want to go into them - they probably have guns and wolves and stuff.

*Or at least I recall reading this a few years ago, I can't find any useful analysis now because the 2016 results are overwhelming my search. Several of the counties swing >2/3 D, and one is 75%, according to http://demography.cpc.unc.edu/2016/10/07/nc-in-focus-who-are-ncs-democratic-voters/ , but I can't find national comparisons today.

Teach undergrads ethics to ensure future AI is safe – compsci boffins

Re: Ethics issues

I had an ethics seminar in a US-based EE curriculum. On the other hand, during a senior seminar a dot com millionaire came in and said that ethics were for poor people; he explained how he skirted the law and good behavior to make a quick buck. He got bought by ABC and hopefully is destitute somewhere, post-crash.

Shortly after I took my Prof Eng exam, I asked a group of (quite liberal) software engineering friends whether they ever considered the public at large in their professional work. It took a while for them to even understand the question, obviously the answer was "no". Most of them worked at a big data analysis company at the time, so a lot of their projects impacted well beyond their immediate customers.

PoisonTap fools your PC into thinking the whole internet lives in an rPi

Something missing...

I get the DHCP part, but how do you get the legitimate site data to display while the box is plugged in? Or is it just that you spawn the magic web frame and then pull the fake interface, so normal routing can resume? If someone hops on the computer with an extra USB dongle and no functional networking they are sure to notice...

Computer glitches force US election poll stations to stay open for longer

I know it's late and no one cares, but as a local I wanted to set the record straighter:

- the story is just wrong, at least this area always uses bubble-in paper ballots - the BoE administration is as luddite as you (we) lot. I gather two precincts lost internet connections early in the day (AT&T/TWC area), and those precincts had to revert to paper voter rolls. Presumably it took some extra time to reconcile voters between paper and electronic rolls over the phone or whatever.

- Durham is the largest individual Democratic stronghold in NC, by far - about 75% Democratic to 20% Republican over 90,000 votes, which is not out of line from previous elections. (There are more heavily Democratic places in NC, but with fewer voters.)

- As a result of the reversion to paper rolls, the Durham precincts stayed open 90 minutes after the rest of the state. I don't quite understand this, since we've been voting in the normal timeframe with paper rolls until this year, but I guess the verification delay with territories where the computers worked...?

- By coincidence, the Republican governor was somewhat in the lead until the Durham results came in very late, with almost exactly 90000 votes, and 5000 extra flipping the tally to his Democratic opponent. (Out of 4.5 million votes cast...) Now they are counting provisionals and absentee, and recounting Durham, as it stands it's a complete unknown who will be governor in February.

To be fair I think it was just a random snafu and handled as well as reasonable, but I can see why some people think it was a setup: of all the hundreds of precincts in NC, only the Democratic ones stayed open an extra 1.5 hours, they were open until all the other precincts reported, and then they produced almost exactly enough votes to flip the gubernatorial election.

Also, IT angle, n+1 redundancy - hopefully they'll have 3G modems next year...

Good God, we've found a Google thing we like – the Pixel iPhone killer

Re: I hope...

There is a graffiti keyboard, and you can get a capacitive stylus - I've not seen a case with a pen-slot though.

That said, now that I have been Swyping since WM days, I am much faster than I ever was even with the physical BB or Palm keyboard. I became a Swype convert when I realized I could type to around 80% accuracy without looking at the phone at all - even with the physical keyboards I had a hard time with that.

Before Bitcoin, digital cash was called Beenz – all that's left is a T-shirt

I found a copy of _The Dilbert Principle_ with "Compliments of Compaq" on the cover at a thrift store.

And! it! begins! Yahoo! sued! over! ultra-hack! of! 500m! accounts!

Specificity in reporting please

A bit disappointed in the relatively meaningless sentence:

"If even a fraction of the 500 million Yahoo! users targeted by hackers take action against the company, and win even a miserly award, the potential costs to the biz could count in the high multi-millions."

So many missed potential fractions and costs, and calculations relative to the current price of tea in China. Bonus points for including the inflationary pressures of purchasing so much Chinese tea at once.

Classic Shell, Audacity downloads infected with retro MBR nuke nasty

Cost of the attack?

No estimate of the amount of damage from a well-qualified expert? Surely an attack of this magnitude and duration has IT costs running into the many many millions...

Ban ISPs from 'speeding up' the internet: Ex-Obama tech guru

Eh...

"Please enlighten me, how does one 'speed up' network traffic? Devices can't retransmit any faster than they receive."

Okay, I'm an electrical engineer in license only, but I thought bits traveled about 2/3c on copper and exactly c on fibre. Thus every copper-to-fibre media converter is changing the traffic speed either up or down depending on direction, surely?

Flytenow's other wing clipped: second appeal fails

Re: Hypocrisy

In the US, that was legal, at least back when I was studying. This is a link that describes FAA cost-sharing in the same way I was taught it:

http://pilot-protection-services.aopa.org/News/2014/August/Pro-Rata-Cost-Sharing-The-Math-Matters?WT.mc_id=

Riddle me this: What grows as it shrinks? Answer: LTO tape

> and tape is reliable

Pull the other one!

Child tracker outfit uKnowKids admits breach, kicks off row with security researcher

Re: BBC News Tells the Other Side of the Story

I must have missed it, what was the other side? The story I saw on the BBC was:

- fellow found obvious site error using search tool

- site owner reacted with threats and bluster on the initial report

- fellow was concerned his issue would be swept under the rug

- site fixed a problem and is no longer indexed by the search tool

Which is exactly what I got from this article, too.

Tandy 102 proto-laptop still alive and beeping after 30 years, complete with AA batteries

I have a Model 100 in the kitchen, since last October or so I've used it to pseudo-randomly generate side items for the kids' school lunches. The RNG is horrid, but it looks scientific and thus cuts down on complaints from the kiddos.

I'd considered submitting it, but since it was powered down in my bookshelf for 15 years it seemed unfair. I originally had two, but the other one stopped booting some years back and was discarded.

Disney sitcom says open source is insecure

Independence Day

Wow, that IS a coincidence: I noticed a number of inaccuracies in Independence Day as well.

Death to Office or to Windows - choose wisely, Microsoft

Re: Re: newfound respect for open source

We have lots of expensive commercial Linux software. Most of it supports specific distributions (RedHat mostly, it is a business after all). Installs aren't that bad, and if they are that's why we pay for support. That doesn't necessarily scale well for end-users but for a big rollout you only have to do it once.

If you haven't seen enterprise commercial Linux software then you just haven't been looking.