Posts by Dr Dan Holdsworth 592 publicly visible posts • joined 16 May 2008
That the NHS app has taken up all of Google/Apple's advice is not surprising; what is surprising is how fully and wholly this has happened. I do hope that this is a portent of things to come; the UK government actually acting sensibly in the face of adversity, as opposed to merely handing out contracts to the Usual Suspects in return for the usual graft.
Hey, I can dream.
Actually the lock-making company Masterlock has for a very long time worked on the principle that 99% of the time the people they are aiming to defeat are in fact quite stunningly stupid, and unable to watch YouTube videos on how to pick locks (or, in the case of one especially crap series of Masterlock padlocks, unable to buy a specially designed defeat device).
Padlocks which are nigh-on unpickable do exist; disc detainer locks such as those made by Abloy are well known for being extremely difficult to break, cut, destroy or pick and they are not much more expensive than truly bad designs of lock. It is just that most of the time, a crap padlock will defeat a twit of a thief.
Decades ago at an open day at Aberystwyth University I encountered groups of the local schoolkids (I was a PhD student there at the time). What they spoke was very interesting; their teachers always addressed them in Welsh and they understood this perfectly. In between themselves, they always spoke grammatically correct English.
That is the crux of the matter: languages are for talking to people with, not for distinguishing you from other people with. If a language does not allow communication, then it isn't actually doing what language is supposed to be doing. Thus all this government-sponsored life support for languages is quite likely a waste of time.
So now we have Blackbaud joining the ranks of the people who have paid extortion money, and think that a criminal is going to suddenly turn white as snow just because they have managed to screw some money out of a mark. This is the height of folly; paying a ransom merely demonstrates to the criminal that the info is worth money, something that they didn't know beforehand. Oh lookey here, now we have something of value in our hands; let's hawk it round the darknet forums and see what anyone else will pay for it...
Idiots.
If you think that PhDs are just a way to get more researchers, then there is a huge over-production of PhDs in progress, and always has been. In truth not every PhD graduate will make a good researcher, and fewer still can stand the poor wages and itinerant lifestyle of a pos-doc researcher. The majority of PhDs do that degree, take a look at the job market and head off somewhere else.
It is also a mistake to think of PhDs as super-intelligent rare individuals. Gaining a PhD takes some brains, but most of the skillset is thinking on your feet and sheer, bloody-minded persistence in the face of repeated set-backs. These make for fairly decent IT techies.
This is the classic trick for landing someone you don't like in the smelly. Take a list of, say, people banking with a tax haven that you have managed to lift from somewhere and add a few extra names and details to it. Hey presto, guilt by association, and the reason that American courts use a principle that evidence obtained illegally is inadmissible in court.
If the police are relying on metadata, then the obvious thing to do is to deny them the metadata.
This is what numbers stations do. If only the recipient can decrypt a message, then it doesn't matter who else can eavesdrop on that message, hence you might as well transmit the message as widely as possible to obfuscate who you are sending the messages to. Numbers stations use radio; an Internet version might be to use Usenet to propagate the messages.
The final point is that encrypted messaging is only worthwhile if the users are smart enough to use it properly, and if the police really want to catch them. Low-level drugs dealers are generally pretty stupid and are easier to catch by simpler means.
There are people out there stupid enough to speed in their cars hugely in excess of the published speed limit, film this while they are doing it, and post it on Facebook publicly, where it then forms the basis of a criminal case against them.
There is truly no limit to human stupidity, and anyone who'd been behind these drone sightings would undoubtedly have made at least some noise about it. And yet, not a squeak has been heard.
After the drone flap started, you had an airport thronged with press photographers with the best photographic equipment money can buy, with huge amounts of motivation to photograph the drone that was causing the problems, together with tens of thousands of twerps with mobile phones all of whom had similar levels of motivation.
One of them should surely have got a photo of the drone, had there been a drone.
There never was a drone being flown over that airport.
No, until old-age senility is setting in, one's age is not a mitigating factor in believing any old tripe spouted on the internet. Radio waves do not produce viruses. Vaccines are heavily tested and actually do work rather well, despite what all the anti-vaxers would have you believe (and said anti-vaxers have forgotten about the death and disability toll of the diseases the vaccines are there to prevent).
Even being stupid is no excuse for criminal damage.
The app is reputedly complete crap, with an incomplete and frankly risable codebase. That rather precludes it coming from Sourceforge, since people tend to at least make a minimal effort there to make the thing work.
Then we have the fact that both Apple and Google know that there are a lot of truly crap coders out there, and neither wants their product to be seen as less impressive than the other lot's product. So, both Android and iOS on mobiles have very aggressive cpu and power saving systems in place, to the extent that on Apple devices an app practically has to be in the foreground with the screen active to be guaranteed activity.
Applications made by Google and Apple can run in the background since any product from the OS makers will be very thoroughly tested. So, the Apple/Google covid-19 tracer will work, work well and operate within strict privacy rules since neither really wants to be seen to be touting a privacy-invading infovore product (that's what Google search is for).
Precisely why the UK government is so dense as not to realise this is anybody's guess, but it will cost them and the rest of us dear until the powers that be finally wise up (which, given who we're talking about, may take quite a while).
One would have thought that after so many repetitions, the UK government would have learned not to try to impose spyware onto people. Especially not battery-draining spyware which has a possible future downside to installing it.
Oh well, seems they just have to learn the same lessons over and over again.
No, the situation is not different at all. In both countries you have an infectious virus that spreads through close contact with infected individuals, and the infected individuals can spread virus before clinical symptoms of disease.
The circumstances of transmission are identical.
Therefore, the contact-tracing system needs to be very similar as well.
The virus enters cells using the ACE2 receptor, of which men have more than women. Levels of ACE2 receptors vary genetically, and it seems that persons of Asian or African descent have more ACE2 than do the Western Europeans; probably just founder effect more than anything else.
Once in cells, the virus as a side effect of its reproduction causes blood problems. These are exacerbated by conditions like diabetes, high blood pressure and so on (which these BAME minorities suffer from more than do Western Europeans).
Finally, there is a weird oddity whereby nicotine seems to decrease the numbers of ACE2 receptors. Smoking, the primary nicotine administration route, causes circulatory issues so ex-smokers may be less prone to complications from the virus, and active smokers more prone.
If you can make a watch or other timepiece, with an e-ink display to reduce power consumption and a Bluetooth proximity detector as described, then this would likely be the most acceptable form of location tag.
It would first of all be useful, so people would have more reason to carry it. It should not have wifi, but should have induction charging. Limit the storage capacity to, say, 30 days max but set a software limit to 14 days initially, and give no way to access the data other than Bluetooth via an authorised (by cryptographic key) Bluetooth station or electrical contacts actually on the device its self.
In other words, you want a tag that is useful and does only the minimum that you want it to do and no more. Possibly a time-signal receiver as well, but definitely no WiFi system.
Finally, make the devices freely available and explicitly permit people to dismantle them, complete with schematics and tamper-evident seals, to see what is inside.
Far, far back in the mists of time I was a humble PhD student in a certain exceedingly old research station in Hertfordshire and, one night having signed into the buildings I was going to be working in, went perambulating from Entomology/Nematology over the road to Insecticides/Fungicides.
I let myself in via the outside door, locked but the general key did the trick, and stepped forwards into the dark corridor. I took perhaps three steps, then the next one simply wasn't there.
It was an open manhole, and I was lucky to have been striding forwards, since I fell over the thing and could scramble out again. This I did, and forgot all about whatever research I was doing and merely reported back to Security, reported the accident and handed in my key.
Next morning, instant bollocking from Head of Department. It seemed that Security had quietly doctored the sign-in records so I didn't look to have signed into the second building, thus in their tiny minds making it my fault that I fell down a hole, not theirs for not having barriers up and the door deadlocked.
Birds like wild geese are typically very frightened of weird, fast-moving unidentified things, and a spot of laser light from a nice bright green laser looks to birds like an extremely dodgy thing, especially when the laser is waved around in a threatening way.
Effectively all you need is a fairly persistent and childish individual with a laser to frighten geese all day long, until they get fed up of being tormented and depart for somewhere else.
So rent an office on the tower block next door, and use a directional antenna to hack their wifi directly. Odds are they'll have very vulnerable wifi "because nobody can ever get an attacking device close enough to be harmful".
Even if this isn't possible, a wifi pineapple mounted on a drone would do the same thing, only more expensively. Once you've broken their security (if you even have to break anything), you use the drone as a relay station to attack that network.
Simples...
I rather think that a large amount of hand-waving and systematic bullshit will be used to try to baffle the jury into accepting the prosecution view of things.
Were I in charge of setting up a system to hold secrets, I would make very sure that the security of the system was based around centralised tokens and preferably several separated central token-issuing servers to get into any particular secure vault. I would also try my best to ensure that as little as possible was kept on the client machines as possible, using encrypted network filesystems and encrypted local disks. Thus when I lock out a client, I simply void all their central tokens and force them to re-authenticate to get back in, and with a lower security clearance they aren't going to get at very much. With next to nothing stored on the client machine stealing data is going to be challenging.
The CIA are trying to imply that far from being a masterful agency of computer security experts, they are actually really quite stunningly stupid, and rely on client-side authentication to control access. Furthermore, their client-side tokens don't seem to be time-stamped thus when the accused rolled back his workstation to an earlier version, the changed timestamp on the authentication tokens wasn't noticed! The CIA argument may well be on the lines of "Yes, our security sucks and we trusted a man we shouldn't have trusted, and we may have accused the wrong man, but we're the good guys so trust everything we say whilst we frame this possibly-innocent but very unlovable man".
It will therefore be rather interesting to see how this one pans out; I doubt that the CIA will come out of this one smelling entirely of roses.
OK, so the Ballie is a ball-shaped robot with a camera at floor level, looking up. Now, imagine the view it will get if it encounters, say, a Scotsman wearing a kilt in traditional fashion?
No, that isn't an image I'd want broadcasting to the world either.
Basically this thing is a sexual harassment offense waiting to happen. What on earth were Samsung thinking of?
They get the donkey work of filtering the hundred-odd CVs that most tech jobs attract to weed out the absolute no-hoper candidates. The problem is that HR, whilst trying their best, aren't much good at this and don't quite know how to tell the difference between a crap CV from a superstar and that of an idiot.
The result is that to get to the hiring stage, you have to pass the not-very-good filter system.
There are worse things than noisy AC and silent racks. One of these is silent AC and noisy racks, because the blissful silence of the lack of AC is very soon punctuated by screams of panic and the sound of big unix kit being emergency shut down.
Yes, this happened at a site I know of. It is quite an old centre for computing excellence, which once produced a book on why outsourcing was a bad idea right at the same time as an outsourcing attempt was going wrong...
Way back in the days of the Cold War, it was well known to absolutely everyone who mattered that Soviet soldiers were amazingly tough individuals who positively thrived on not having any luxuries whatsoever. As a result of this knowledge, the Soviet forces on exercise in various Eastern Bloc countries would sally forth unequipped with any form of toilet paper.
The actual forces themselves, however, were actually quite used to the concept of toilet paper and of wiping one's backside on completing one's business in the privy and bitterly disliked this paperless policy. As a result they got into the habit of using any old waste paper they could get their hands on, and this tended to include even quite highly classified military documents. Digging into an old latrine pit one day, someone with connections to Western intelligence noticed the abundance of printed pages and forwarded them, suitably decontaminated, to a spying organisation.
Thus were born a couple of the worst Cold War jobs in history: dunnykin diving for documents, and processing said treasures to produce a readable output cleaned of the *other* output which could be photocopied and sent off to Western spooks.
If you're cycling, then a few factors do tremendously improve your chances of not getting hurt. Wearing bright and reflective clothing, preferably clothing made to the relevant UK/EU visibility standards (as opposed to what some cycle clothing designer thinks looks good) means that motorists can see you from a long way back. A daylight-rated rear light also helps immensely; these are bright and have an irregular flash pattern to catch motorists' attention.
Not riding like an idiot, not riding up the inside of traffic queues, and not undertaking traffic when it is waiting at lights is also most effective; you're aiming to be seen and not to be annoying. Do that and motorists will be a lot more polite, and politeness all round helps immensely. Where big vehicles are concerned, stay away from them.
For years, the cycling and mountain biking world has been grappling with the knotty problem of rough tracks and wheels, and the tendency of front wheels to vanish into pot-holes, stop and send the rider flying. There is even a joke club for those thus affected: The Over-The-Bars Club or OTBC, and pretty much every cyclist is a member.
The smaller the wheel, the greater the risk of a pothole-induced dismount. This is why mountain bikes started out at 26" and are currently around 29" or even more on e-MTBs. This is also why road cycles use wheels around the 27" size, and why only the craziest of folding bike users go below 18"; the smaller the wheel, the more dangerous the bike.
Scooters have wheels around 6" in diameter. They are death-traps, and this is why.
Way back in the mists of time, I was working for an ISP which was essentially just a tax fiddle for a certain (now defunct) large PC seller. Every few days, a database transfer from the PC seller's systems went into the ISP database, and a Perl script of mine ran to try and pull out the details of any user daft enough to hand over their phone number to the box-shifter, and discerning enough not to sign up with the ISP.
These poor people would then get a phone call from the box-shifter asking why they hadn't signed up with the lovely ISP, and wouldn't they like a free month's service or something? This all worked very well, until disaster struck: my script spat out the name and phone number of someone who was vaguely related to the owners of both companies.
The result: I get a bollocking because apparently my script is supposed to be psychic and not do such terrible things as this, despite my not knowing any names or addresses that I ought to have been avoiding. Pointing this out was hopeless; a bollocking had been ordered, therefore I had to receive a bollocking and no, I was not to get an avoid-list to prevent future trouble. Discarding a certain common Asian forename would have done the job, but being where this company was this would have dropped the number of victims down to a trickle.
I left the company soon after this, and was most amused to later hear of their going bust; they bloody well deserved to go bust for being such an unremittingly grim load of arseholes!
The investigation is now dead, and should be stopped immediately. Airport CCTV didn't spot any drones. Airport plane spotters didn't spot any drones. Myriads of tourists with smartphone cameras didn't spot any drones, nor even any flies photographed very close up. Hundreds of highly motivated amateurs and paparazzi with state of the art cameras and very high motivation to photograph drones didn't see any. We haven't even had any enterprising teenager with a mini-drone flying it with the airport in the background trying to claim footage.
Lots and lots of very good witnesses equipped with amazingly good kit and with very strong motivation to get a shot of a drone, and nobody spots a bloody thing.
There weren't any drones.
It was all mass hysteria, on the lines of African "penis theft" panics and the like.
To be honest, it is difficult to see why the UK police and UK taxpayer should be doing anything other than trying to diplomatically light a fire under the Portuguese police force. The disappearance happened under the jurisdiction of Portugal, and international convention is that each country's police force is responsible for each jurisdiction. So, prod them but it ain't any business of UK plod.
If you're going to buy kit for work use, then there are two routes you can go. Firstly, you buy really good stuff that can be expected to last for ages, like Apple kit used to do (but doesn't any more), or you buy the cheapest stuff you can find that will still do the job intended, in the expectation of a horrendously high failure rate.
Chrome books fall into the latter category, with the added benefit that they have very little user-side storage on board, thus the users have little scope for filling them full of valuable data which they can then lose (forcing the secure encryption of mobile devices is an on-going but necessary headache for us techies).
What you don't want is expensive kit that falls into semi-disposable chrome book territory. The Sale of Goods Act and similar consumer protection laws were designed to cover this sort of thing, so the retailers can expect to be on the receiving end of legal action from customers if this sort of thing carries on (under UK and EU law, the company the customer bought the goods from is liable for sorting out the problems; doesn't matter if they consistently whinge that this is the manufacturer's fault, they have the legal responsibility for sorting out faulty goods sold to customers).
The Home Office has the reputation of being something analogous to the tar-pit of the Civil Service, where the terminally thick are sent to languish until retirement if they cannot be sacked. Thus we have this repeated series of attempts to make the laws of humans triumph over the laws of physics and mathematics.
Once more the same points will have to be made: strong encryption methods exist already in the wild and people know what they are and how to use time. Unbreakable encryption such as one-time pads also exist, and people know that these are unbreakable if used correctly (and thanks to innumerable Cold War spy dramas, everybody knows how to use one-time pads; the clue is in the name).
So, if you try to insert holes into encryption products, people will simply layer more encryption over the top of the leaky product and defeat you.
Actually, we're steadily heading in this direction already. 2.4 GHz wifi penetrates walls quite well, 5 GHz has better bandwidth but much less range, and 5G mobile telephone signals are even higher frequency and penetrate solid objects even less well.
Skipping a section of the EM spectrum and moving on to near infrared or visible spectrum is just a logical next step, which would once again increase the possible bandwidth and would allow/force more transceivers to be put in close proximity.
I strongly distrust technology like this, mostly because I have encountered Nissan's take on this and have found it to be an utter pain in the bum.
Nissan cars have a millimetre radar unit hiding behind the logo panel. This millimeter wave is supposed to detect obstacles in the road ahead, but the defective unit my car was supplied with (now replaced under warranty) detected a whole lot more than that. Road signs, for instance, were thought by it to be deadly obstacles worthy of jamming the brakes on to avoid, which doesn't half wake the tailgating driver behind you up.
The replacement unit is fully working, or as working as this wretched abomination ever can be. The radar is absorbed by water, so a rainy evening or even slight sleet will render this autonomous braking unusable (the machine shows a warning that it has deactivated the autonomous braking system).
Worryingly, Nissan is now working on an even more sophisticated system, which also ropes in a camera into this mobile circus of a system (although Nissan's response to the diesel NOx problem is rather more robust now, and involves adblue).
It is actually easier to deal just with metadata than with content, given the number of bullshitting blowhards on the Internet. People tend to talk a load of complete crap on the Internet, so some silly billy busily ranting away at the evils of the current government and how everything is a conspiracy run by the Milk Marketing Board is not actually very much in demand by the security services.
What they would like to know about are people who know people who are on one side competent chemists, and on the other extremist religious sorts. That's a mix you don't want to encourage, unless they are playing with fluorides and fulminating oils in which case at some point you're going to be scooping up their remains with a brush and shovel after the decontamination people have finished.
Metadata is everything in the spying game, and has been so ever since the days of the Spanish Inquisition (who were remarkably modern in some respects, along with being thoroughly medieval god-bothering nutcases in others).
The original author is clearly a coward, a complete wuss and lacking in the knowledge of the more adventurous chemist. To get rid of things, fluoro-oxy-oxy-fluorine is clearly the best agent going, although a Heath-Robinson contrivance to mix hydrazine and hydrogen peroxide is probably the next best thing.
Provided you use a firearm of suitably high muzzle energy, know where to aim and can hit what you aim at then shooting foxes is not illegal in the slightest, provided the shot does not leave your land and no other firearms laws are contravened.
In most urban settings, the best option is to get the foxes used to the idea that food is available, then put out traps baited with the same stuff, then humanely kill the trapped foxes somewhere where you do have permission to be using a firearm. You will end up killing an awful lot of foxes since the remainder will spread out their territories as members of the local population are killed, but eventually you'll mitigate the problem.
If you are a terrorist and wish to further your cause, then you need to recruit followers. Recruiting followers by definition means talking to people whom you do not know, in an open and entirely clear-text sort of way. You have to have publicity, and it is this need for publicity that enables law enforcement to make a list of potential suspects.
Once you have identified a recruiter and started to analyse the terrorist network, you once again do not need to break their codes. It is nice if you can, but most of the time knowing who is talking to whom is much more use; this again does not need encryption compromise.
Finally, when you have a terrorist network identified, then you will have a network of cells who mostly don't know each other. The thing here is that you don't need to know what this lot are saying to further compromise them; repeatedly getting local law enforcement to pick up key figures and then let them go without charge very quickly is one good way of convincing the rest of the paranoids that their network is compromised and that these key figures are police stooges.
Mostly, you do not need to be able to break terrorist comms to disrupt their networks.
I am reminded of a tale from way back in the 1960s, where a cafe frequented by many folks that the police and authorities greatly distrusted were wont to gather and talk. Whenever anyone got up to leave this cafe, the owner would step over, hand them a coin and a the cafe's phone number on a piece of paper and ask them to phone the cafe from a phonebox a long way away, any phonebox as long as it was not the same one all the time.
The patron would call the cafe, and be told that the riot was to be at such-and-such park on a set date.
The day of the riot came, and the police were all there, arrayed in their ranks with full firearms, TSG and air support. Hundreds and hundreds of them were there, waiting for the trouble. Also present was a very elderly man with an even more antiquated scottie dog.
The moral is this: if criminal know that a medium is mnitored as that phone was, they'll send false messages. The police appear to have forgotten this.
An exam is a test of intelligence, memory, knowledge and of course the ability to follow instructions. It is, basically, a filter to separate those who can from those who can't.
If the poor wee mites cannot follow simple instructions and fail the exam as a result of this, then the exam is working as designed.
To be honest even manufacturers of old-fashioned mechanical locks can turn out some astonishingly crap devices. The American manufacturer Masterlock is the most famous of these; their padlocks are normally very robust against the standard "Ape with big hammer", but the moment said ape grows a brain and uses even a modicum of intelligence, their products often fail and fail badly. For instance, if one puts tension on some of their padlocks then taps gently and repeatedly with a hammer, the locking pawls creep open and the lock fails.
Masterlock locks are also noted for not using any of the many techniques available to frustrate bump key users and novice lock pickers. They have even included the classic "one key-like device opens everything" on some models, by leaving a bypass vulnerability open.
Like all the Internet of Things makers, they are relying on thieves being uncommon and generally spectacularly stupid, so even a little security will defeat them.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
