Posts by Norman Nescio

Accused murderer wins right to check source code of DNA testing kit used by police

Re: Repeatable experiment

There have been a few cases where a suspect could prove conclusively that they could not possibly have been anywhere near the place the DNA evidence was found, yet it was a match for their DNA.

A notorious example of this the identification of the German mass murderer (the "Phantom of Heilbronn") whose DNA turned up at many different crime scenes.

It was actually the DNA of a worker in the factory that produce crime scene sampling kits.

The fact that someone's DNA has been found at a crime scene does not mean that they were there.

There are many ways to transfer DNA from place to place, including swabs, dirty handkerchiefs etc. You also have to have rather good lab techniques to avoid cross-contamination. Demonstrating that the forensic lab has followed those techniques is not always easy.

There has to be evidence other than DNA linking the person to the scene. Saying that person X's DNA was found somewhere says very little about whether they were there in person.

ThinkPad T14s AMD Gen 1: Workhorse that does the business – and dares you to push that red button

Re: Red pointy thing

What would make sense (for me at least) would be a keyboard with a trackball located just beneath the space bar.

I saw an interesting approach on an old keyboard: a rotating bar that could slide from side to side on its axle. Rotating moved the mouse pointer up and down the screen, sliding the bar left or right on the axle moved the pointer left and right. Unfortunately, the buttons to click were separate, you could not simply depress the bar, so if anything, it required two hands to operate quickly, or one serially - move the mouse, then click a button.

It obviously never took off.

GitLab removes its 'starter' tier: Users must either pay 5x more or lose features

Github --> Gitlab --> ?

It's a shame, especially as there is a vocal group within the FLOSS ecosystem that have a visceral hatred of anything to do with Microsoft and have been migrating (and campaigning to migrate) projects off GitHub to somewhere not tainted by Microsoft. I don't know what the next best choice from that point of view is.

As pointed out by other commentators in this thread, once you move things into 'the cloud' (i.e. using other people's services on other people's computers), you have a tendency to lose control over your fate. Sometimes, it can be the right decision: the services available to small businesses can seem almost magical when compared to trying to do the same yourself - but if your business is dependant on somebody else's profit margin, you are in a vulnerable position.

It is an MBA's dream to lock in customers so that they find it very difficult to move elsewhere. A lot of services are deliberately designed to do just that: once the transition costs of moving get significantly painful, people choose the lesser pain of staying and enduring 'reasonable' price increases.

No cards, thanks, we're contactless-less: UK supermarket giants hit by card payment TITSUP*

Re: I suffered

I always take a wet anti-bacterial wipe in with me simply because if I do have to touch anything I don't have to worry about using hand gel all the time, other than when I go in and when I leave. After all, I'm touching other stuff too, like the shopping bag handles, pockets, wallet, card etc. Also, the anti-bac wipe, at one layer thick, lets you use the touch screens on a self service till and not have to touch the buttons on the keypad when that has to happen. I'm also, by default, cleaning the keys for the next person who may not have had that foresight.

Given that SARS-CoV-2 is a virus, anti-bacterial wipes may not be giving you the protection you think.

SARS-CoV-2 is an enveloped virus, and it is not clear that, for example, that Quaternary Ammonium compounds such as benzalkonium chloride (BAC) are effective at reducing viral loads on surfaces.

American Chemical Society: Are Quaternary Ammonium Compounds, the Workhorse Disinfectants, Effective against Severe Acute Respiratory Syndrome-Coronavirus-2? doi: 10.1021/acsinfecdis.0c00265

Make sure your hand and/or surface disinfectant is effective against SARS-CoV-2 - not all disinfectants are.

NN

NN

Decade-old bug in Linux world's sudo can be abused by any logged-in user to gain root privileges

Re: Waitaminute...

I don't get it... I'm sure I've seen plenty of posts on here whenever there's a new security issue found in Windows about how Linux doesn't have security issues...

Would you be so kind as to provide links to three of those posts (or more, if you like)?

No true Scotsman..., sorry, I'll start again, no experienced Linux techie would ever claim Linux doesn't have security issues. I expect posts claiming that to be either clueless fanbois, sarcasm (both unappreciated and explicit), or people with a tenuous grasp on reality. Linux, GNU, and FLOSS software in general definitely has security issues, but issues, once found, can be resolved and distributed by anyone: not just the copyright holder. With non-FLOSS software, even clear security problems might not be legally mitigable, and you could well be dependant on a software maintainer that requires some cold hard cash before resolving problems. Which is fine. You can choose to pay. Or not.

I was targeted by North Korean 0-day hackers using a Visual Studio project, vuln hunter tells El Reg

Re: Zero Day

There's more than one ( standard ) definition:

Wikipedia: Zero-day (computing)

I'm sure someone will be along to revise it.

https://xkcd.com/927/

You would expect a qualified electrician to wire a building to spec, right? Trust... but verify

Re: The neutral doesn't join up with anything on the switch!

According to this table, there were just seven deaths registered in 2017 in England where the underlying cause was exposure to electric current at home.

You need to add domestic fire fatalities where the fire was caused by faulty electrical installations. Electrocution is not the only way to die when the electrical installation is faulty.

FIRE0602: Primary fires fatalities and non-fatal casualties by source of ignition, from GOV.UK: Fire statistics data tables

That said, there is an ongoing debate over whether the Part 'P' regulations, by making things more difficult for D-I-Y electrical work, encouraged people to overload and misuse trailing multi-way extension sockets and thereby make overheating problems more likely.

Re: You would expect a qualified electrician to wire a building to spec, right?

Oh the wailing and nashing of teeth when PATT testing met the university engineering dept.

Testing portable appliances three times would be enough to give me paranoid schizophrenia as well (or testing the procedures that test the procedures that test portable appliances). The to and fro of regulations is just a game which will come an equilibrium, even if people don't co-operate; which is a beautiful outcome to my mind.

NN

Must 'completely free' mean 'hard to install'? Newbie gripe sparks some soul-searching among Debian community

Re: Not for noobs

The Debian installer works adequately, but doesn't give complete freedom in setting up partitioning, LVM, LUKS*, various RAID levels, and filesystems in advance (or even during) the install. I understand giving full flexibility is difficult, but doing something non-standard is unreasonably difficult - I have to resort to chrooting and copying things once they have been set up, then fiddling with fstab and GRUB etc.

Debian is, as you say, not difficult to install, so long as it is in a way allowed for in the installer. Which is fine for most cases, but by no means all.

NN

*A case in point: some people like to encrypt the entire hard disk (except for the ESP) then layer LVM on top of the encrypted disk. Others prefer to set up LVM, then encrypt each volume separately. Some like to use non-standard filesystems e.g. if they are using an SSD, they might want to use F2FS or NILFS2 for their root, or even bcachefs. The installer makes this difficult. At least, it did the last time I tried it. Since I don't do a full install that often, I haven't checked the most recent incarnation, and I don't have time to spin up a VM to check for this comment. Sorry, the rest of my life intrudes.

Offshoring is kind of over, says Wipro, as financials surge thanks to offshoring

India employment culture and churn

My experience of offshoring to an in-house business unit based in India was that the Indian employees used the company I worked for as a training opportunity to get more experience/polish their CV, then used that additional experience to get a better paid position elsewhere in the local technology hub/city. It led to continuous employee turnover/churn, and the need to 'on-board' inexperienced employees all the time. Basically, we were training people to get better paid positions elsewhere, which was not a viable business proposition.

Of course, the company I worked for did not want to do the obvious and improve the pay and conditions for the Indian workers, as that would have made offshoring look bad. So we had to put up with the situation. I left not long after, so I don't know how things have ultimately played out. Being unable to guarantee that technical staff would be around for the duration of project roll-outs, let alone the full term of multi-year customer contracts was a big drag on efficiency - Fred isn't worth us any more: meet Joe, who comes to us straight from university/technical college. Please help him come up to speed. Rinse and repeat at the next project meeting. Continuity 'R' us, it wasn't.

My other experience of the large Indian outsourcers is that their project teams seem to be a bubbling maelstrom of people, or to put a positive spin on it - an extremely dynamic environment. Working out whether it cost-effective was above my pay-grade.

Ubiquiti iniquity: Wi-Fi box slinger warns hackers may have peeked at customers' personal information

Avoiding negative added-value cloud encumberments

Well, I think Ubiquiti make some nice hardware for installing OpenWrt on.

https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=Ubiquiti

To be fair, the installation process may be non-trivial.

(Don't all click at once, I think the OpenWrt web-server is a bit of a frayed-shoestring operation.)

Explained: The thinking behind the 32GB Windows Format limit on FAT32

Re: FAT fail

File Allocation Table is terrible design for SSD devices because it requires that the first storage blocks (where the table is stored) are re-written over and over again reducing the life of the device, and is a fixed size irrespective of the size or number of the files .. but has the single advantage of being simple (and standard - copied from CP/M).

Well, it would be if SSDs did not have wear-levelling algorithms which effectively put a Copy-on-write layer underneath whichever filesystem is layered on top. Yes, writing again and again to raw flash is a bad idea, but that was soon recognised. Essentially, every write to the FAT moves that block elsewhere on the SSD, which has pretty much constant seek times for any block read. Of course, write amplification then causes other problems, which TRIMming partially mitigates.

NN

What can the 1944 OSS manual teach us before we all return to sabotage the office?

Re: Reads like a guide of how to achieve maximum possible efficiency rather than sabotage

However if you want to actually sabotage things, there's one guaranteed way to do it. Introduce new systems and procedures as part of an "efficiency drive". Nothing succeeds better in reducing efficiency in a big company than a conscious top-down attempt to improve it.

In addition:

1) Re-organise to improve efficiency. Preferably every half-year.

2) Take a flexible manual process and insist that people use an inflexible computerised process as its replacement. For bonus points, computerise an existing process without talking to, or taking advice from existing users, but only from their managers.

3) Require people to account for time used in 15-minute intervals in a mandatory time-recording system, and ensure that minor administrative work has no cost-centre or booking code, so teaching people to be creative (lie) and causing untold strife over which codes to use and who administers what. For bonus points, the time used for completing and reconciling time-sheets has no associated time code, so management have no clue how much time is wasted. Apparently all employee time is chargeable and people are mightily efficient...

4) Ensure that retention periods for the organisation's email (for arse-covering reasons) is too short, so important information goes missing.

5) Mandate that all important information is placed in SharePoint, with no control over the structure, so you end up with a massive hairball of interconnected documents, most of which are out of date and/or irrelevant.

6) Mandate the use of the organisation's document templates, for which there are several incompatible versions, all of which set up by trainees with no knowledge of document formats. For bonus points make sure they are not available on the Intranet so that various different people swear they have the original source document to be used.

NN

'Following the science' rhetoric led to delay to UK COVID-19 lockdown, face mask rules

Re: Trickledown economics

Just to reinforce the point:

Bloomberg: Trickle-Down Economics Fails a Sophisticated Statistical Test

Linked paper: LSE: The Economic Consequences of Major Tax Cuts for the Rich: David Hope, Julian Limberg

"Abstract: This paper uses data from 18 OECD countries over the last five decades to estimate the causal effect of major tax cuts for the rich on income inequality, economic growth, and un-employment...We find that major reforms reducing taxes on the rich lead to higher income inequality as measured by the top 1% share of pre-tax national income."

tl;dr - 'Trickle Down Economics' doesn't work. Reducing taxes for rich people increases income inequality.

NN

GitHub will no longer present a cookie notification banner – because it's scrapping non-essential cookies

Re: GDPR scope

GDPR applies to people of any citizenship (not just EU) resident in the EU.

It applies whether the company processing the personal data is resident or non-resident in the EU - if it 'offers' services to EU residents (not just EU citizens), then the GDPR applies.

So it applies to (for example) a social media company registered in (non-EU) Ruritania that, by the magic of the Internet, 'offers' services to people resident in the EU. If the company does not wish to comply then it must not offer services to EU residents.

Of course, if the company has no presence in the EU, it is a bit difficult to apply meaningful sanctions, but the basic point is that processing personal data of EU residents is covered by the GDPR.

Note, residents, not citizens. So an EU citizen who happens to reside in (non-EU) Ruritania, using services offered by a (non-EU) Ruritanian company is not covered by the GDPR.

References:

Deloitte: GDPR Top Ten #3: Extraterritorial applicability of the GDPR

clarip: The Extraterritorial Reach of GDPR to United States Businesses

GDPR associates: Myths on the extraterritorial scope of the GDPR

Note (from the third reference): As per recital 23 of the GDPR, the mere accessibility of a website in the EU is not sufficient to ascertain the intention that a company envisages to target EU markets.

NN

FOSS developer survey: Mostly male, employed... and many don't care about 'soul-withering chore' of security

Re: "Math is hard"

And how can you know that the code you just wrote is secure if you cannot produce a mathematical proof that it is secure?

It's not quite that hopeless. I expect that there are engineering practices which can be put in place that will allow secure code to be produced. Those practices must be developed by mathematicians (they will be called "computer scientists"), and strictly enforced to work, however.

I will just address a dangerous and incorrect inference that many will make from your statement: "the code you just wrote is secure if [you can] produce a mathematical proof that it is secure".

For many will assume that mathematically rigorous code is secure.

Mathematical correctness is a necessary condition, but not sufficient.

1) From a mathematical point of view, proven code is demonstrated to follow rigorously from a set of assumptions. The first challenge is making sure that all your assumptions are valid and apply to the 'real' world. This page on the formally proven seL4 microkernel goes into more depth: seL4 - What we prove...what we assume. There is a telling quotation there: "Mathematical proof is proof as long as it talks about formal concepts. It is when assumptions connect to reality where things may still fail. Albert Einstein is quoted as saying 'As far as the laws of mathematics refer to reality, they are not certain; and as far as they are certain, they do not refer to reality.'", which leads on to...

2) While the algorithm may be demonstrated to be secure under the chosen set of assumptions, it is implemented on real world hardware, which is subject to side-channel attack, e.g. timing attacks, power-fuzzing and a panoply of other techniques. AES is a pretty well proven encryption algorithm but difficult to implement in a secure manner in silico ( Cache Based Remote Timing Attack on the AES ). There are decades of work, some of which is either not classified, or now unclassified dealing with working with EAL/Common Criteria and equivalent security requirements and the hardware issues that have to be resolved.

3) The hardware your code is implemented on can be compromised in subtle ways, even at the gate level (Stealthy dopant-level hardware Trojans: Extended version : April 2014Journal of Cryptographic Engineering 4(1):19-31 : DOI: 10.1007/s13389-013-0068-0 ). Bullet-proof code can be compromised by tissue-paper hardware. If you cannot trust the hardware your code is running on, it makes it difficult to claim your system is secure, even if the code itself is formally proven.

There are indeed engineering practices that can mitigate many of the known security vulnerabilities. TEMPEST is one such set of practices which may or may not be over the top for most people.

A formally proven piece of code is only one step on the long path to secure information processing.

NN

Addendum

1a) One person's experience of use of formal verification is here.

Ray Wang: Formal Verification: The Gap Between Perfect Code and Reality

tl;dr Formal Verification is hard, and there are plenty of examples of it going wrong.

That said, from my point of view, formal verification is obviously useful, and is used in many areas (including chip design and cryptocurrency), but has not made inroads into general-purpose computing as yet. And formal verification is only part of the story: it is all well and good showing that the program correctly implements the specification; but humans write the specification, and there is a great deal of room for specifications to be incomplete and/or inaccurate.

Who knew that hosing a table with copious amounts of cubic metres would trip adult filters?

Re: Inside joke?

I had a friend of Breton origin who insisted that his name, beginning with Ker, was spelled K' since it was the proper way to write it down, triggering some failures at the time in all IT system it was entered into...

Thank you for he opportunity to link to one of my favourite informative web-pages:

Falsehoods Programmers Believe About Names

Obviously, old systems had to deal with quite limiting constraints, so blaming an old system for being limited to say, ASCII, would be unfair. On the other hand, there are some brain-dead assumptions being made, even today.

NN

Re: Cubic metres? cm^3? ?? What is its abbrev.??

This is where punctuation becomes useful, as cu. as an abbreviation of cubic would be fine, so cu.m would be cubic metres. I have seen plenty of cu. yds, but no cuyds.

But it shows the problems with simple pattern matching filters - taking context into account would allow things like summa cum laude, end everything would be oojah-cum-spiff.

I wonder what Plum would have made of his novels not making it through spam filters.

How the US attacked Huawei: Former CEO of DocuSign and Ariba turned diplomat Keith Krach tells his tale

Clean Networks?

The lesson of 'Clean Networks' should not be "don't trust China", but in fact, "don't trust anybody, in case they pull a China on you", and that definitely includes the USA.

Essentially, it it a strong argument for FLOSS hardware and software in critical infrastructure, so that you can audit it and assure (by the number of mutually distrusting eyes looking at it) that it is as unknown, uncontrolled backdoor free as possible, according to the competence of the people doing the auditing.

National security services will always want to put their own monitoring in for data crossing national borders, and law enforcement will want the ability to 'tap' communications (with a valid warrant, naturally), so as end end-user of such infrastructure, you will not be free of local (legal) government backdoors/monitoring: but the point is being able to be reasonably sure there are no illegal, hidden backdoors. From a National Security point of view, it should be a no-brainer, especially as history shows that trusting the current 'Great Power' is a poor idea in the long run.

Arguing for 'Clean Networks', is in fact arguing for auditable hardware and software where you can make changes without legal problems, like copyright, patent, and trademark issues. Do you, as a country, want your communications to go through DRMed binary-blob software on hardware manufactured without oversight in another country? Do you feel lucky?

NN

Adiós Arecibo Observatory: America's largest radio telescope faces explosive end after over 50 years of service

Re: Reality

I actually wondered how big a Helium balloon would be needed to hold up the instrument cluster.

From the report recommending demolition, the instrument cluster weighs 1,826 kip (kilopounds), which is near enough 828,260 kilogrammes (roughly 957 tons).

From Wikipedia a cubic metre of Helium at sea level has a buoyancy of roughly 10.9 Newtons, or in other terms, a cubic metre of Helium can lift roughly a kilogram weight. So we need enough Helium to lift 828,260 kilogrammes, which is roughly 828260 cubic metres, which is a sphere of radius 58 metres. this is lot smaller than I thought. As a comparison, the dish at Arecibo is 305 metres in diameter.

Obviously, the balloon material would not weigh zero, but increasing the balloon to radius 60 metres would give you an extra 76518 cubic metres of Helium, which could lift roughly 76 tonnes of balloon material. For a sphere of radius 60 metres, that gives a surface area of 45240 square metres, which gives you about 600 grammes per square metre. Mylar weighs about 1400 kg per cubic metre, so a wall thickness of a third of a millimetre would work (Actual helium balloons have wall thicknesses of as little as 2 hundredths of a millimetre)

It might be easier to have three balloons, one for each apex of the instrument cluster: each could then be roughly 45 metres in radius.

45 metre radius Helium balloons would be difficult to build in a short timescale - but perhaps other balloons could be repurposed. NASA have some meteorological/space research balloons that have a payload capacity of 8000 lbs. Which is roughly 3600 kilogrammes. You'd need roughly 230 of them to hold the Arecibo instrument cluster, which is somewhat impractical. It doesn't look as if you could attach enough of them to relieve sufficient load to make working safe, even if weather conditions allowed.

So yes, an insane idea. A pity.

(Some initial playing around with possibilities was made simpler with this excellent Helium balloon size calculator: OMNIcalculator - Helium Balloons Calculator)

More details

Found via Science^alert:

https://www.sciencealert.com/engineers-race-to-deconstruct-the-arecibo-telescope-before-its-catastrophic-collapse

"The technical reports that spell the death of Arecibo can be found here:

https://media.telemundopr.com/2020/11/EMBARGOED-NSF-Arecibo-call-materials.pdf"

Re: Square Miles?

Will you idiots stop it with the imperial nonsense? We're talking about science here.

Even dem 'Merkins use SI units for the real work.

Wot? Like the Mars Climate Orbiter?

Re: Reality

The problem was that the first hurricane that hit caused the towers and instrument cluster to oscillate which knocked some cables loose from their mounts and caused others to snap. At that point it could have been repaired but the second hurricane hit and caused more damage to the cables.

<u>The instrument cluster weighs about 900 tons and is in danger of plummeting to the ground at any moment. The world's largest heavy lift helicopter can lift about 22 tons.</u>

Much as I wish it weren't so, controlled demolition is probably the best option.

I did have an insane thought that the US national Helium reserve could be used to string up a huge balloon to hold it up, but the first light breeze would probably blow it away, given the size of envelope needed to hold enough helium to relieve a significant amount of the weight. The instrument cluster probably isn't engineered with hard points to allow it, either. Would have looked spectacular, though. Far better than the pig between Battersea power station's chimneys.

Police warn of bad Apples that fell off the back of a truck after highway robbery

Calvados?

I must admit, when I heard the news report on BBC Radio 4, I was mystified why national news was reporting the heist of fruit. Then it struck me when it was reported to be such a high value, I tried to think of what kind of processed apples (apple products) could get to such values, and came to the conclusion that it could only be vintage Calvados.

Doh!

HTTPS-only mode arrives in Firefox 83 as Mozilla finds new home for Rust-y Servo engine

Managing off-Internet kit?

I manage equipment over a network that is not connected to the Internet. It is convenient to use the GUI interface that is implemented using html/http, so I would prefer it if browsers do not remove http access.

From a security and privacy point of view, I really would prefer not to be dependant on a third party for access to 'my' equipment. Some of the kit may well not support https. For the kit that does, I'll have to set up my own local CA, then add that into the trusted CAs in the browsers of all the devices I may use to do management. It will be a faff. Sigh.

It might be worthwhile to reflect on what https is meant to do. It is meant to secure the communications so that untrusted third parties can't eavesdrop or inject fake data/transactions. If you look at the list of trusted CAs baked into browsers, you are trusting rather a lot of organisations not to leak certificates that enable untrusted people to eavesdrop and inject data.

Personally, I'd prefer to be able to secure the communications link without relying on third parties. SSH can use a 'Trust on First Use' (TOFU) model, so what I do, where possible, is set up the device with an Ethernet cable plugged plugged in between the device and my laptop, enable SSH, and subsequent GUI-based management is HTTP tunnelled over SSH. The SSH provides the secure communications channel, and the http supplies the GUI. No certificate required.

Obviously managing SSH keys gets important, but I can do it all without requiring an Internet connection, or by being tied into someone else's idea of optimal certificate/key expiry times, or becoming dependant on a CA's secure storage and use of root certificates.

So please don't get rid of http entirely. There are other networks than the Internet, and if you use other means of securing the communications channel, http can be used and be useful.

NN

Linux Foundation, IBM, Cisco and others back ‘Inclusive Naming Initiative’ to change nasty tech terms

Sapir-Whorf

We have always had Newspeak, and the chocolate ration has been increased again! Doubleplusgood!

Of course, the anticipated beneficial effect of changing language on thought rather depends on whether the strong Sapir-Whorf hypothesis is true. There is some debate over this.

I'm also happy that suggested other choices to replace 'blacklist' do not include the ambiguous term 'blocklist'. In general, I am in favour of using descriptive names that are clear, accurate, unambiguous, and without negative cultural baggage.

NN

Microsoft brings Trusted Platform Module functionality directly to CPUs under securo-silicon architecture Pluton

Re: TPM and Bitlocker

TPM Bitlocker is meant to block physical transplanting of the drive (think an Evil Maintenance Guy attack), and if set accordingly there's no way to bypass it. If it isn't in the same machine as that specific TPM, it's no-go, full stop.

That's not actually completely correct. If you have the Volume Master Key (or indeed the Full Volume Encryption Key), you can decrypt the storage device without the TPM.

The Full Volume Encryption Key (FVEK) is encrypted with the Volume Master Key (VMK) , and stored on the storage device. What's more, if you have a recovery key enabled, then the Volume Master Key is encrypted with the Recovery Key and stored on the storage device. So far, no TPM involvement.

So if you have the FVEK, you can decrypt the device.

If you have the VMK, you can decrypt the device.

If you know the recovery key (and that function is enabled), you can decrypt the device.

All without the TPM.

Getting hold of the above is quite possibly difficult, but not impossible.

Pulse Security: Extracting BitLocker keys from a TPM

Elcomsoft: Unlocking BitLocker: Can You Break That Password?

Note that:

If you have a modern device that supports automatic device encryption, the recovery key will most likely be in your Microsoft account. For more, see Device encryption in Windows 10.

From: Microsoft: Finding your BitLocker recovery key in Windows 10

So getting hold of your storage device's recovery key could be 'as simple' as compromising your Microsoft Account.

NN

US Hegemony

Microsoft, Intel, AMD, and Qualcomm are all companies headquartered in the USA.

Microsoft: headquartered in Redmond, incorporated in Washington State

Intel: headquartered in Santa Clara, incorporated in Delaware

AMD: headquartered in Santa Clara, incorporated in Delaware

Qualcomm: headquartered in San Diego, incorporated in Delaware

That means the NSA back door will be baked in. Which the 5 eyes / 9 eyes / 14 eyes will be happy with, and everyone else is either a minor player who doesn't matter, or 'the enemy'.

Anyone (Government/Private organisation/Individual) not happy with that needs to find a hardware choice that can be audited, and if incorporating similar technology, have local control over master encryption keys. Obviously other large players are not concerned over whether the hardware/software combination is open: only that it is accessible and controllable by them (e.g. China, Russia).

I don't see a bright future for open hardware.

NN

EncroChat hack evidence wasn't obtained illegally, High Court of England and Wales rules – trial judges will decide whether to admit it

Well done, El Reg

Once again, I wish I could 'like' the article. This is the type of reporting on the kind of topic that El Reg does well, and I am very glad this is being subject to public scrutiny. Well done.

Let's Encrypt warns about a third of Android devices will from next year stumble over sites that use its certs

Sigh,

I have a 'landfill' Android tablet stuck on Lollipop 5.1. No updates are available.

I really wish generic Linux tablets had become a thing, but I guess there' s no easy money to be made in such things.

I should have got a PINE64 PINETAB when it was available.

Will there be no end to govt attempts to break encryption? Hand over your data or the kiddies get it, threaten Five Eyes spies

Do not look behind the curtain

While national intelligence agencies are making a lot of noise about encryption, causing outrage and incredulity that they can be so stupid about the 'laws of mathematics', they are busy making use of all the already existing 'back doors', and using this as a pretty successful distraction strategy.

As several commentators have pointed out in this and previous articles on this topic, One Time Pads and dictionaries of code-phrases* are uncrackable in themselves without a copy of the One Time Pad or the code-dictionary.

However, as students of secure communication learn at their mothers knee, it is very important to ensure that your security end-point is separate to your communications end-point. It doesn't matter how well your message is encrypted if you decode it on a completely compromised piece of equipment so the plain text lovingly decoded can be grabbed and exfiltrated. The average member of Joe Public cannot obtain uncompromised hardware. The military find it difficult.

The 'secure' phones compromised by the Dutch police had malware inserted on the phones that took copies of the decoded messages. All of the apps on mobile phones rely on the operating system, the processor, and the modem, none of which the user has control over**.

In addition, theoretically good encryption is compromised by poor implementations that have gaping side channels. The AES code produced to show how AES worked, and used as a basis by many people had not been hardened against timing attacks etc. So a good algorithm generated by an open evaluation process was compromised in many applications because the side channels were easily exploitable. Having a good algorithm is less than half the battle: making sure the implementation in hardware is secure is hard.

So while the security services are making a song and dance about encryption, they are busily exploiting all the flawed implementations, 'influencing' standards committees to adopt standards that are difficult to implement well, and making sure, probably with the help of Hollywood and the MPAA that any equipment you can buy implements 'Trusted Computing', which is to say, trusted by them to execute programs you have no control over.

If you want to send a secure message, encrypt it on hardware you can trust: which might be pencil and paper, and only put the encrypted text on the communications link. Even then, unless you have thought in advance how to deal with the metadata, you won't be as safe from discovery as you think.

It's all a game of misdirection. If you want to send secret messages easily, campaign for open hardware that can be audited down to gate-level, designed by people who understand about side-channels. Even then, unless you have a good plan on how to deal with the metadata trail, you won't be able to hide from 'the authorities' for long if they really want to find you.

NN

*e.g. 'the swan flies south for the winter' means 'cancel the operation to put polonium in the targets tea'

**There are a few nerdy exceptions for the operating system, and possibly the bootloader. Not exactly mainstream, though.

Hey Reg readers, Happy Spreadsheet day! Because there ain't no party like an Excel party

Re: Spreadsheet day

Duly upvoted. I had read that particular posting before, but it was nice to be reminded. Thanks.

NN

Re: VBA

VBA is the tool of choice. Easy for an amateur to program and get right

I would suggest VBA is easy for an amateur to program and get working.

There is a huge amount of value to a business in being able to produce code that works 'well enough' quickly. Problems occur when a quick lash up becomes a production system.

NN

NewBrain

Have an upvote for the NewBrain. I had one too. I eventually donated it to the National Museum of Computing, together with the floppy disk controller. The NewBrain, an Oki dot matrix printer, and a fair bit of programming produced the graphical plots for my degree umpty-um years ago.

NN

Locales and function names

It's not just auto-formatting. Try moving spreadsheets between locales.It's almost as though Microsoft never considered that people might want to share spreadsheets across borders.

And if you want to use functions....well if someone creates a French spreadsheet, the function names are in French. Move it to the UK, and suddenly it doesn't work, because the functions are not tokenised in storage. Quite why some idiot decided to store function names in the language they were input, I don't know. Had they been tokenised, I could open up a French spreadsheet and tell the program to display the tokens in English, or German, or Swahili (other languages are available). As it is, websites that list the translations of various functions names from English to foreign and vice versa are rather useful e.g. https://www.excel-function-translation.com/

Software billionaire accused of hiding $2bn in income from IRS – potentially the largest tax scam in US history

Re: Close, but not Glenn Close with a cigar.

It's not the copy paper that has the encoding in it, that I'm aware, it's the printer that puts the itty bitty dots down.

That what they want you to think!

Actually, the yellow dots thing is well known: https://www.eff.org/issues/printershttps://www.eff.org/issues/printers

Certain papers are identifiable. The paper used for banknotes had specific identifying features that made it more difficult to reproduce, and I am sure a totalitarian regime could do similar for copy paper.

An easy technique would be to mix a small proportion of some artificial fibres in the paper, which could be a mixture of different types of fibre, different lengths and even different colours. There's enough variation to provide a simple encoding mechanism so each batch could have a unique identifying number, which could be extracted by microscopic analysis of the fibre content of the paper by someone in the know. Kind of variation of the theme of 'DNA water' used to mark high value objects.

LibreOffice rains on OpenOffice's 20th anniversary parade, tells rival project to 'do the right thing' and die

Re: Outlook? Nope

I mean, I know this is an argument for the argument's sake, but, any suite, any OS aside, who in their right mind would want to run a 13-years old piece of software to process emails, aka basically mini web pages with attachments that include probably about 5,000 security fixes in the intervening 13 years? Scary!

Someone with a mail client that doesn't process HTML and/or Java/ECMAscript perhaps?

Basically, treat HTML as plain text, treat attachments as things that are shown to the user with their full file names, including extensions, and need to be explicitly detached - no double-click-to-'accidentally'-run-a-dot-exe-file. A mail client that shows the sender domain in full as well as the 'display name'.

Emails should not be 'mini web pages', as history has shown.

Someone not only created a comment-spewing Reddit bot powered by OpenAI's GPT-3, it offered bizarre life advice

...bizarre life advice from bot?

Life? Don't talk to me about life. I've got a pain in the diodes all down my left hand side.

Facebook's anti-trademark bot torpedoes .org website that just so happened to criticize Zuck's sucky ethics board

Convention

It wasn't particularly sensible to use the name 'The Real Facebook Oversight Board'. While I can sympathise with the intent, it is rather difficult to defend yourself against an assertion of 'passing off'.

On the other hand we could do with a convention that allowed people to use trademarked names for commentary and criticism and made it explicit to readers (both human and automated) that it is not phishing/fraudulently misrepresenting themselves as the organisation being commented on. E.g prefix the name with the character !, or ¬ (U+00AC NOT SIGN = angled dash in typography). Unfortunately, the rules about which characters are acceptable in domain names precludes this, and even resorting to Internationalized Domain Names and punycode doesn't resolve it. We might have to extend the hegemony of the English language and simply say that prefixing trademarks with 'not-' provides sufficient warning that it is not a phishing site.

Excel Hell: It's not just blame for pandemic pandemonium being spread between the sheets

Re: Relax...

The sad thing is there are quick and dirty solutions out there...a simple bash script could have done what this fuckwit tried to build in Excel.

Speaking from experience here as a low paid administrator (I have other experience), the locked down laptop does not have bash available, and it is not available in the corporate-approved portfolio of applications available via IT. Neither is, for example, SQLite.

On many occasions I have been reduced to bringing in my personal laptop to get stuff done that simply wasn't possible using the corporate IT set-up available to end users. Can't do that with health data as GDPR and basic data privacy rules mean I can't move the data out of the 'secure' corporate environment - which is correct, and I would not break those rules. It makes life challenging.

Re: If your only tool is a hammer

If you have tabular data -- where the rows and columns have clearly established meanings as numbers or strings -- then ok use a spreadsheat.

Nope. Excel cannot even cope with tabular data where you want to use logical operations across columns. Give me a count of instances where field 1 has value w, field 2 has value x or y and field 3 has value z, and field 4 is not any of a, b, or c. Loop through all unique values in field 1. It is possible to do with some pretty hairy expressions, but if you are trying to produce a summary tab that works on data in other tabs, or, heaven forfend, external files, you are in for a world of pain.

Re: Relax...

While I agree with most of what you say, it's worth noting that almost all the actual uses of Excel in practice are as a simple spreadsheet. Which is undeniably useful, and something Excel is pretty good at. That's why it's ubiquitous.

A good, simple spreadsheet would be useful.

Excel is not a good, simple spreadsheet. It has needless 'helpful' complexity, such as interpreting numbers as dates and applying other formatting rules in difficult to reverse ways. Inserting new, and cutting and pasting rows and columns can have unexpected and unintended effects that are not immediately apparent. Referencing data in external flat files and other spreadsheets is incredibly painful, so you are forced to take unmaintained copies of masters and import the data.

It is ubiquitous because it comes 'free' in Microsoft Office, not because it is any good, but it is just functional enough to prevent people looking for better choices.

Microsoft Exchange 2010 support ends in a matter of days and there are 139,000 internet-facing servers still up

Re: Plus addressing

The problem with hiding the complexity is that if you are successful at it, people think what you do is simple, and, therefore, anyone can do it.

An issue with producing systems that can be administrated by people with less-than-comprehensive skill-sets is that management can be tempted to dispense with the producer's services because a cheaper administrator can do the visible job. This is not to say that one should deliberately make things complicated as job-security: but be aware that people can be lulled into a false sense of security by using a simplified interface that covers most of the functionality to do a complex job. When the extra competence is needed, and is not readily available, problems occur.

It is bit like writing: text lacking proper punctuation, and missing out odd words and mistyping/misspelling others means that text takes longer to unpick and understand, so good writing is in a style made easy for others to follow. I tend to be a bit verbose and convoluted, but appreciate good writing because it is hard to do.

Windows to become emulation layer atop Linux kernel, predicts Eric Raymond

Re: Sadly... this is the beginning of the end

I would agree with you, but they cannot take components out from under the GPL, not legally at least unless the person who wrote the code and all the people who modified it agree. I don't see that happening any time soon.

I'm sure Microsoft are eyeing what Red Hat did with systemd and wondering how to apply the same strategy, except with non-GPL software. Google did the same with Android: a free, libre, kernel, but Google Play Services binds people nicely into the Google ecosystem.

Windows as a proprietary 'Google Play Services' layer on top of the Linux kernel is entirely possible, and reduces the amount of money needed to develop and maintain the operating system. Linux will have 'won', but if the end-user experience requires the proprietary layer on top, it isn't free.

Google/Alphabet appear to be keeping their options open so they have the technical ability to replace Linux with Fucsia (or similar), should the need arise.

UK, US hospital computers are down, early unofficial diagnosis is a suspected outbreak of Ryuk ransomware

Many healthcare organisations outsource a proportion of their IT. The issue then arises that the IT provider is willing and capable of patching, etc, but the end users are reluctant to agree to the downtime; and in some cases the end-user organisations are either unwilling or unable to pay for the maintenance of the systems in use. There's then a game of to-and-fro as the outsourcer tries to convince the healthcare organisation that the patching is necessary and they really do need to find the resources to allow major upgrades to take place. Those resources are not only money: but also people in the healthcare organisations who understand enough IT to push things through and say, set up projects to educate end users in the new system (why do we need a new system when the old one works perfectly well?...and so on).

Sometimes, the 'responsible' IT person in the healthcare organisation can be, for example, a surgeon, who is used to people doing what they say and doesn't take kindly to IT oiks saying that the old radiology application needs to be replaced with one that works on Windows 10.

If you care about patient well-being, healthcare IT will give you stress-related disorders in no time flat.

Spain's highway agency is monitoring speeding hotspots using bulk phone location data

Re: M.L.O.C.

On night about 1a.m. I pulled off the A1 and on to the M18, there in the distance I see some clown in the middle lane of an otherwise empty motorway.

As I arrived at a "little" over the prescribed speed, I gave a quick flash of the lights from lane 1, then again from lane 2 before overtaking and moving back to lane 1.

During this "at speed" manoeuvre I'd noticed another set of lights some distance behind, as they approached said moron, they also follwed the first two steps. Step 3 however was some pretty flashing blue lights. Genuine LOL moment

Sigh, I may as well attract some downvotes.

1) An (otherwise empty) motorway with a middle lane has a WHOLE LANE in which you can overtake said 'clown'. What is your problem?

2) If said 'clown' is already travelling at the motorway speed limit, you are in breach of the law in overtaking. Most people don't care, regarding speeding as somehow macho. Any fool can speed*.

3) The quality of many British motorways is dire, especially in lane 1, which has rutted pits/tracks worn into them by the HGVs (You are also liable to find all sorts of things in lane 1 that have dropped off HGVs, including bricks from between the tyres of tippers that have come off demolition sites, delaminated HGV tyres and items of inadequately secured loads). Driving at speed is more comfortable and less distracting on the less used pavement. If it is raining ( a whole new ballgame ), even better not to be driving through the continuous puddle in the rut.

4) Unless you have unusual (and probably illegal) headlights, you cannot see within your stopping distance** on unlit motorways when driving at the maximum speed limit***. This means that if there is anything on the hard-shoulder (where it exists) that might impinge on lane 1, you won't see it until until you are too late to stop, and might be forced to take avoiding action. Not a problem on an otherwise empty motorway, but good driving minimises risks both to yourself and to others, especially the poor sods stuck at night on the hard shoulder without lights.***

5) I will give you one point: a good driver should have seen you coming and moved over into lane 1 and moved back out again after you passed. (This is what I do).

I am not a perfect driver, so hopefully not preaching from a sanctimonious pedestal. I have had four accidents: one due to passenger distraction, two due to the other driver driving into me (rear-ended at traffic lights; other driver pulled out from side-road into my wing; and one stupid low speed damage to an alloy wheel in an unfamiliar car and an unfamiliar petrol station with high metal kerbs around the pumps)

NN

*When I was younger and more foolish and the M40 had just been opened, I had some joyous runs between London and Manchester in the early mornings/late evenings, so I'm not immune to the speed bug. I can't pretend what I did was justified, or safe. But it was fun. A colleague of mine had a ZZR1100 and gave it up as he found it too difficult to remain legal (pulling wheelies past police cars on the M4 is not advisable). I'm older now, and more cognisant of my limitations (and the limitations of others). Track days at Brands Hatch convinced me I was not God's gift to driving. Some people are naturally very good drivers. I have been privileged to know several, and understand very well I am not one of them, so I drive very defensively.

**Minor anecdote: I do not want to repeat the experience of coming to a safe halt on lane 1 of the M4 in fog and hearing the impacts of cars barrelling past me in lane 2 as they hit the pile up in front of me. It was a sphincter-tightening (or maybe loosening) moment wondering if someone was going to rear end me, until enough cars had come to a halt behind me. The pile-up was big enough to get onto national news.

***It's actually marginal for the average car. The 'average family car' has a stopping distance on dry roads at 70 mph of roughly 96 metres (call it 100). Road legal headlights will give enough light to illuminate somewhere between 50 and 100 metres ahead of you. You can buy after-market halogen and LED bulbs that have higher (not road legal ) output. Driving at night is unlikely to be the physiologically optimum time, so your reaction time is likely to be increased. Of course, the majority of drivers somewhat statistically improbably regard themselves as 'above average', so their performance car will stop in a shorter distance and their razor-sharp reactions further decrease the stopping distance, so they can safely drive at 80 (average car + average driver stopping distance roughly 120 metres) or 90 (average car + average driver stopping distance roughly 150 metres). Frankly, if you are that good, please use your skills to compensate for the deficiencies of others. If you are lucky, you too will experience ageing, and all that goes with it.

He was a skater boy. We said, 'see you later, boy' – and the VAX machine mysteriously began to work as intended

Re: Mountaineering

Yes, well, our ops were a well behaved bunch. We never did identify the source of the footprints on top of the cabinets.

[Object of the task was to circumnavigate the machine room without touching the floor. The Krone frames for all the hard-wired terminals were tricky: narrow, and tall, so there was only room to lie on top of them.]

0ops. 1,OOO-plus parking fine refunds ordered after drivers typed 'O' instead of '0'

Re: Strewth

Do what IBM did. Put a dot in the middle of the zero(0).

The power of Bill compels you: A server room possessed by a Microsoft-hating, Linux-loving Demon

Earth/Ground/CPC

Much like the writer above with the poorly manufactured HP power cables, I have experience of an unexpected manufacturing fault...

One of the 9-track tape drives in our data centre gave an unhealthy electric shock to an operator one day. He survived, but the problem was finding the fault. After 'a bit' of investigation, it turned out that the sealed power cable had been miswired - I don't know the precise details, but I suspect that the CPC and neutral had been swapped (this was in the days before RCDs, which would have tripped instantly).

The ops manager was an unhappy bunny after that, and made it a rule that all power cables used in the data centre were tested to check they were correctly wired before use (this was also way before PAT, which would not have applied anyway, because none of the kit he was responsible for could be remotely described as portable, usually requiring specialist delivery lorries and strengthened floors.).

Paragon 'optimistic' that its NTFS driver will be accepted into the Linux Kernel

Re: Whatever for?

I really don't think the Linux kernel needs to add another 27,000 lines of code to get ... nothing?

You are free to:

a) not load the ntfs kernel module.

b) compile your kernel leaving out any particular chosen filesystem support. Compile what you need from the choice available to you.

So, with Linux, you are free to not use the Paragon-originated kernel driver. However, some people could well have good reasons for wanting a better performing driver than a FUSE driver, or one with more options (like encryption and sparse file support), so it is good that they could get a GPL-licenced option.

I hope the quality is good enough for inclusion, and that long-term maintenance can be assured.