* Posts by Dave Howe

18 publicly visible posts • joined 20 Apr 2008

Google: You get crypto, you get crypto, almost everyone gets email crypto!

Dave Howe

Centralized vs Personal

To be fair, you don't WANT google to manage your keys for you - if you are a corporate customer, then perhaps managing keys on behalf of your employee is borderline acceptable (after all, that's how EFS works, and it at least secures the key material with the user's login password) but as a home user you wouldn't want anyone to manage your keys but yourself.

Although in practice, all real email security these days is going though oracle based systems (Cisco have CRES, Microsoft have whatever their hosted encryption module is branded as these days, probably "defender for messages" and so forth) rather than S/Mime or PGP (and there are extended rants online about why S/Mime and PGP suck, so not going to get into that one either)

Honestly as a personal user of email encryption, you are better off doing it E2E using either a browser plugin (for webmail) or an encryption-capable full-fat client. That way your keys stay local to you, not where a vendor with a profit motive can get hold of them.

Yep, the 'Who owns Linux?' case is back from the dead

Dave Howe

Well, except...

Way back in 2013, it was found in court that SCO didn't own ANY of the linux rights' they were owned by Novell, SCO were their agent, and were only entitled to keep 5% of the revenue (as a commission).

If I recall from the time, Novell asked that the funds be placed in escrow, to prevent SCO spending them all on their legal case against IBM; While SCO were arguing in court that it wasn't necessary as they had plenty of funds, they were also arguing in a DIFFERENT court that they should be placed in Chapter 11 as they didn't have enough funds to cover both the Novell payment and their own legal bills.

The Groklaw site should still be online, and has blow-by-blow coverage of how badly SCO faired in court (along with some Oracle Vs Google stuff, too)

HOWEVER - I do also recall that Novell were bought out by a venture capital firm and basically stripped down for the parts - so its entirely possible that Novell's IP for unix could now be held by a troll interested in reviving the SCO claims, this time with an actual valid IP in hand.

Sony wins case over pre-installed Windows software

Dave Howe

would be impressed

At someone who can build his own high-end laptop. :D

However, I think the key here is that he wanted to be paid the cost of a retail copy of windows for not using part of a bundle; during that era, the OS often had negative cost (given the company would be paid to include trial copies of office, antivirus etc which could come to more than the oem cost of the OS ) and many vendors had contracts *requiring* all machines to be preinstalled with the software in order to get a per-copy discount.

Nothing in this solution stopped him wiping off windows and installing an OS of his choice - this is purely an attempt to get money for having done so. In that respect, it is a lot like ordering a serving of neapolitan ice cream in a restaurant because you want the chocolate and strawberry, and demanding a refund for the vanilla you didn't eat

Confused by crypto? Here's what that password hashing stuff means in English

Dave Howe

Re: "To obtain a certificate from a CA you have to convince them of your credentials"

Worse yet... effectively to get a certificate from a CA you have to convince them to take money from you. In the case of EV, you need to convince them that you are a company before they will take your money. That doesn't always mean you need to *be* a company, just that you have to convince them you are. Easiest way to convince them of course is to actually be a company, which (taking a quick look at off-the-shelf pre-registered company suppliers) will set you back all of £60....

Under-fire Apple backs down, crafts new iOS to kill security safeguard

Dave Howe

Re: Remains to be seen

Would make more sense to just refuse to honor the new sensor - pop an error dialogue each time someone tries, saying it isn't a valid apple touch sensor, and require the pin to be entered instead.

Confused as to WTF is happening with Apple, the FBI and a killer's iPhone? Let's fix that

Dave Howe

Re: To be clear

They can spin up the vms - but can't do the testing without the physical hardware. While the time delay and wipe functions are software controlled (and are even if there is a "secure enclave") the conversion of pin to candidate key is done "on chip" and the chip will not allow you to view the secret data it uses to do this. The good news is this conversion only takes *80ms*, so you can test a dozen keys per second - provided you can bypass the software time delay. Assuming a 6 digit number for the pin, that's just under a day of testing.

People bored of mobes, say magic quadrant wizards

Dave Howe

market is slowing, but...

Next big apple release will *still* sell like hot cakes - the problem is that THAT displaces a bunch of the current generation of phones, still more than good enough, down the chain to people who buy pre-owned, family and so forth, and a fair few even of the rabid apple fans are skipping one or two releases as what they have now is comfortable, familiar, and more than good enough.

People aren't bored with mobi - but there is a finite market of first buyers that is all but exhausted, and given the cost and the fact other complimentary technologies like wearables are attracting some of the upgrade spend, there is a risk that something else will gain the social prestige argument away from the latest iphone, leaving the market mostly for replacements due to failure (and that's not a large market, made smaller by sales of insurance contracts)

Net neutrality: How to spot an arts graduate in a tech debate

Dave Howe

Re: Poor analogy

That is a poor analogy; let me explain.

Lets say your local road network is owned by a company - you have to pay to connect *your* driveway to the network, and they charge you based on how much weight comes into or out of your driveway (in most cases, they expect the weight into your driveway to be so much larger that they only bother measuring that) - but you are paying based on usage. You reasonably expect that, once you drive off your driveway onto the network, that the speed restrictions are imposed in a equal and fair way to make sure you get your fair share of the benefits of driving - but do does everyone else. Usually, you don't have much choice on which road network to join (after all, it's outside your house!) but on the whole, they don't want the Government stepping in and imposing price restrictions, so they keep their usury within reasonable bounds.

Walmart opens a store near a road network owned by a *different* company - that company is thrilled - the amount Walmart needs to pay to connect their parking lot to the road network is a *lot* more than they would get from the average home driveway, and Walmart expect that as part of the cost of doing business. So, all well and good - when you go to Walmart, that trip has been paid for twice; once by you, to get onto the network, and once by Walmart, to get off the network at their Store (and of course, the reverse to come back).

The problem arises when your company looks at how much money the *other* company is making from Walmart, and starts thinking "how can I get some of that? I want more money". So they try charging the other company to let their customers go from their own road network to the Walmart provider's network. This starts a major battle, where everyone suffers - your company either won't let you get to the Walmart provider's company, or forces you to go via a third or even fourth company's roads, taking much longer and adding traffic to roads that shouldn't need to carry it, simply as leverage to try and extort money out of the other road company.

After a while, the dust on that one settles down - a few smaller road companies are now paying, but the larger companies are in a mexican standoff, lots of money has been spent (and continues to be spent) on lawyers, but the end result is that that money is leaving all the road companies (and going to lawyers) and no new money is coming into the system, so it's a loss for everyone (and yes, there really was a peering war, and it is currently in a standoff)

Your company is now upset. They tried charging another company, and on the whole, made a loss on the whole thing. They are already charging *their* customers as much as they dare, and even charging them more than agreed making them "service charges" and hoping that they don't notice - a lot like surcharges on holiday packages. Then, they have a bright idea. Claiming how unfair it is that so many of their customers drive to Walmart, they start deliberately slowing down or stopping their *own* customers if they are driving to Walmart - then tell Walmart that they will only stop doing that if Walmart gives them money to stop doing so. Walmart says "WTF? you are already being paid for that traffic by your Customers, what business is it of yours if they are coming here! We pay a LOT to our road company for access to that customer base, so take it up with them" and the road company says "well look at it this way. We will charge any of your competitors too; that means you aren't in a worse position, but any small businesses that get caught up in this will be unable to compete, so that extra business will come to you". At this point, the Government looks at the situation and says "WTF guys? you are already being paid for this, and you are getting to the point that you are deliberately making the market anti-competitive by degrading your own service for purposes of extortion. Stop it or we will make you stop it" - to which of course the companies reply "lol, you can't, you have no authority to do that"... which brings us to the new laws on Net Neutrality. NN isn't about if filtering and control should happen, but about motive - filtering should be for legitimate service-improvement purposes, not extortion.

Euroboffins want EU to achieve techno-independence

Dave Howe

was not impressed (one star, would not commission again) :D

Would appear to be compiled by non-technical people from the advice of technical people, which advice they clearly had trouble understanding (and from whom they were unwilling to seek clarification).

I think their experience with LinkedIn says it all, really.

They appear to have selected *one* working group within LinkedIn, posted *one* vague query to that one group, received 11 posts (from 6 distinct individuals) without ever replying to or following up on those posts, then declared *the whole of social media* unsuitable for research and abandoned the attempt.

And this is the quality of research the EU will use to shape future policy? OMG.....

Rackspace in Crawley: This is a local data centre for local people

Dave Howe

oddly...

if a US company had data keys in the US, but a UK individual was able to obtain them, he could be required to under UK law - and the applicable law (RIPa) even allows a gag order to be attached.

Dave Howe

No need for speculation

A US judge ordered the hard drives of a news org (indymedia) removed and handed over to the FBI, and Rackspace complied with that order - In their London datacenter.

'You have no right to see me naked!' Suddenly, everyone wakes up at the Google-EU face-off

Dave Howe

seems to have forgotten

That google is only INDEXING this information. if he wants it gone, why not have it removed from the sites that hold it (then google will remove it from the index for the obvious reasons?)

If he isn't willing to go to that level of censorship, why should google do this?

Banning handheld phone use by drivers had NO effect on accident rate - study

Dave Howe

Problem is...

Observance of the ban seems near non-existent - I have seen people breeze past me at all speeds - from the 20mph zone around Manchester residential areas, to the motorway - with phone firmly clamped to one side of their head and frequent looks down into the passenger seat.

Before we can measure impact, we have to see at least SOME attempt at compliance.

Microsoft: NSA security fallout 'getting worse' ... 'not blowing over'

Dave Howe

But surely....

The very public PR stun... erm, I mean defence of their customer base MS recently staged should instantly restore credibility? After all, of COURSE we believe MS only got one NSL in the last year, and the FBI backed down when faced with MS Lawyers.....

ZX Spectrum REVIVED as Bluetooth keyboard

Dave Howe

Original ZX...

had the same problem. The keyboard was divided down the middle into left and right halves, and each line in each half had one control wire. each top-down column had a second control wire, so they keys shorted a vertical and horizontal wire together - that was fine for one key press, and not terrible for a second, but the third would be an issue. for any hope of handling multiple keypresses, each key had to have at least one wire (horizontal or vertical) unique to it.

Crypto attack unveils hidden backups

Dave Howe

and....?

"We got you, some bits of your hard drive have changed"

"yeah. and?"

"did you write files to that bit of your hard drive?"

"sure, that's what hard drives are for"

"so why aren't they there now?"

"because I wiped them with heidi erasor"

"why would you do a thing like that?"

"because I was going though US customs and its now our company policy to do so in case they (for example) decide to make a "backup copy" of all our valuable customer data"

"we wouldn't do that"

"so where did you get THAT backup from then?"

Google silences Android critics

Dave Howe
Linux

open source licencing

I am obviously confused about something here.

If something is open source, then anyone receiving a binary copy *must* be given access to the source and a free licence to modify, redistribute and use custom compilations of that source.

As far as I know, google hasn't released Android to anyone in any form, not binary *or* source. So until someone can show a binary-only copy of Android and be refused or granted access to download the source, there is no way to make any real statement one way or the other... only a legitimate user of Android has the right to ask.

Citrix goes storage light with XenDesktop

Dave Howe

And how does this differ..

From the usual thin client desktop?

Citrix pretty much invented the concept of a mutiuser, remote terminal windows server (of course, unix had been doing that long before, but xwindows is hardly "thin desktop")

Over a decade ago, their winframe product was delivering complete desktops to wyse dedicated terminals (or dos based 386/486 machines running a client) using ICA to stream the display and keyboard/mouse events in each direction (plus share the local drives in the case of the dos machines). This is what eventually became the Terminal Services (RDP) app that comes with almost all windows servers now.

at the same time, DOS machines were pxe booting from and loading a complete win3.11 environment from netware servers, running applications (from the same servers) selectively depending on if they did (or didn't) have permissions to them at the netware level.

either way, I can recall this technology being in place a decade ago - ok, its a *lot* harder to just run modern software from a remote server; apps have got much, much bigger and rely on registry keys rather than easily-redirectable ini files, but I am not seeing anything new or novel here.