Posts by Charles 9

Windows 10 backlash: Which? demands compo for forced upgrades

Re: Damage is done

Assuming they're not already on razor-thin margins or in razor-margin industries where there's no room to spare for testing...

Re: Damage is done

"Maybe not an "appreciable migration", but there is a continuous trickle, and a slow bleed in the right place can be as bad as an open wound."

You're lucky. Many other businesses are locked in to Windows, not because of Microsoft itself but because their critical, irreplaceable, custom application was built exclusively for Windows by a company that probably went out of business and has no direct replacement; either that or getting a new version would kill the business faster than a crash would.

Re: Damage is done

"I certainly hope Linux will take some serious market share away from MS and if some serious AAA Vulkan games in Linux could be released then who knows !"

Good Luck. Bethesda (makers of one of the recent AAA's, Fallout 4) went on record swearing off Linux as too difficult to develop because it doesn't have a united user front (IOW, will be Red Hat or Ubuntu or whatever). Not even Valve's SteamOS is making any headway, and for whatever reason WINE (even a self-contained type a la DOOM using DOSBox) isn't even being considered.

Re: <gets popcorn>

Cutting edge games are among the most difficult to get through WINE, and you can probably forget about DX12 games working on them. As for a VM, that incurs serious performance penalties, not to mention, again, the newer a game is, the less likely it is to be VM-friendly due to the need to get closer to the GPU's metal.

Re: <gets popcorn>

But too many apps are Windows ONLY, to say nothing of games...

Malware figures out it's running on VMs and refuses to execute

That would be something if malware will only infect if it detects another malware in the system, at the risk of missing pristine systems.

Re: So..

Lower risk, yes, but higher reward as well, so there will be blokes out there trying to escape the honeypots.

Re: So..

But each program you're forced to add in raises the threat envelope, because each app could itself become a vector, raising the chance the VM can jump the tracks and get pwned in a way the researcher doesn't detect, even to the point of possible hyperjacking (Red Pill attack).

Re: Hide, hide, hide ...

And that's only because the malware doesn't have a Red Pill payload: one specifically designed to be run in a VM to break out and attack the hypervisor...

Game over: IANA power-grab block pulled from Congress funding bill

Re: I'm confused...

"Just because something is bad, it does not mean that something opposed to it is good. The world turns out to be complicated and trying to reduce stuff to simple narratives where 'good guys' take out 'bad guys' usually doesn't work very well. The world would be a considerably better place if the general citizenry of most Western democracies realised that."

But of course, the average human (Western or otherwise) is pretty stupid about stuff like that and simply want to see tomorrow (there have been studies mentioned on El Reg about this). You have to take Stupid into consideration. That also explains how the likes of Cruz get into office in the first place.

Re: I don't see how that would work

The general understanding (supported by SCOTUS decisions) is that the primary condition is that citizenship was granted upon birth. This also implies that no procedure was taken to affirm this (no oath taken like in Naturalization). This happens to be consistent with English Law prior to the US's independence. Only jus soli is explicitly mentioned in the Constitution via the 14th Amendment (and reinforced in US v. Wong Kim Ark, 1898). Since jus sanguinis is neither allowed nor disallowed, under Article I, Section 8, it's left to Congress to clarify, which is does with the Immigration and Nationality Acts, amended over the years (and no document other than the Constitution itself can make the call for them, as Article VI explicitly states the Constitution stands alone as ultimate authority in the US).

Re: I'm confused...

"Until you manage to clear out all of the lobbyists, power-brokers, and pork-barrelling that is so prevalent in the US political scene, I think you should avoid calling other institutions "corrupt"."

And that'll never happen.

1) It's impossible to remove lobbyists completely. Even if you take the money angle out, there's still the "nice cushy job after you leave" angle as well as other, non-monetary, post-position influences that are pretty much protected on First Amendment grounds, as well as influence from actual constituents who can't be blocked without interfering with their primary duties. Finally, there's the family angle. How do you block lobbyists if they're spouses, who MUST be able to talk in order to raise their families?

2) Politics is a power magnet; it simply comes with the territory. And as long as there's power, there WILL be power brokers due to the human condition.

3) As for pork-barrelling, recent Congressional experience has demonstrated it to be a necessary evil. Part of the reason for the "Do Nothing" Congress' reputation is that they voluntarily limited themselves in the name of ethics but found their hands tied when it came to big bills. Smaller representatives basically have nothing to lose with voting against the grain because the communities they represent are too insular for greater politics to affect them. You need something close to home to sway them, and that means give-and-take, and the only things that will influence them enough is pork-barrel projects. In other words, pork is pretty much the only thing that can "grease" smaller representatives into getting on board broader projects that need their vote to pass.

So in the end, if you want a better government, you're going to need a better HUMAN first.

Re: The irony

"I've commented in the other thread about the fact that those most critical of ICANN have vested interests. Most people who've actually dealt with ICANN are perfectly happy, except for people whose particular get-rich-quick-with-DNS scheme was knocked back."

ORLY?

But the incumbent can influence things to squelch challengers. Plus, the idea is that it shouldn't come to re-election. Politicians should be held to extremely high standards of ethics and conduct. For example, not being allowed to lie would be a nice start.

Valid logins to your workplace are on the net, right now

Re: The IT Security counterpart of the Central Banking mentality.

"Once the penalties for leaking PII are reset to sane (ie,. expensive) levels, and a few companies have gone down in flames after a BEC or other financial fraud, the calculation will shift and more orgs will be motivated to do it properly - or at least try to."

It'll probably prove cheaper to bribe the governments that set the regulations when that happens...

Not enough personality: Google Now becomes Google Not Anymore

Re: A childhood? WTF!

Except SHAZAM has an interest in limiting access to its services to human eyeballs. And since neither Siri nor Cortana have comprehensively passed a Turing Test, there WILL be ways to tell them apart, meaning it will NOT have access to everything willy-nilly to answer the question transparently for you. An assistant can't well do its job if the sign on the door clearly reads "NO PROXIES."

Self-stocking internet fridge faces a delivery come down

Re: Self what!!

Oh? What about war casualties or those born with bad legs?

Re: Wait.. What?!

Hmm, considering that these pipes would have to accommodate some 350 million people, then these look about right.

Zombie Moore's Law shows hardware is eating software

Re: "we’re seeing a migration away from software and into hardware"

"A transistor in a circuit dedicated to video decompression for example sits doing nothing when you are not decompressing video."

But if the times when it's NOT decompressing video (or compositing a UI or whatever task it is dedicated to perform) are few and far between, then odds are you get a net benefit for it. That's part of what's happening now. They're taking a look at what things CPUs have to do all the time and offloading them so that the CPU has more time for more generalized workloads, much like having a specialist for handling particular jobs that happen to come up quite frequently.

Half! a! billion! Yahoo! email! accounts! raided! by! 'state! hackers!'

Re: Dilemma

The trouble is that it's a dilemma. With the first, you MAY have a crack team running the place...or you could have a bunch of idiots who couldn't be asked to fix a breach on a weekend. With the second, when something happens, you can nip on down yourself and work on it...if you have the time and wherewithal to do it.

As for limiting scope, guess what's one of the hottest things in the exploit trade? Privilege escalation. With them, it doesn't matter how limited the entry point is, it becomes like the proverbial foot in the door: all they need to bust the pinata wide open no matter how hard you set things up. Use a VM? Red Pill. Separated machines? Gather credentials then traverse the intranet. Quite simply, if there's a door, someone can kick it down, and because physical presence is not required unlike your front door, everyone's going to come knocking eventually.

I frankly think this'll come to a head and start asking existential questions about the Internet: questions about whether or not we need to start over using a whole different model of statefulness and (dis)trust. Kinda like how open season eventually gives way to necessary regulation.

Samsung’s consumer IoT vision – stupid, desperate, creepy

Re: Brainstorming here....

What about people with FAULTY eyeballs? Or bad memories? AND no help? Just because YOU have a fully-functioning human system doesn't mean everyone else does. Or are you saying we should take the Spartan route with them?

I want to remotely disable Londoners' cars, says Met's top cop

Re: Helicopter & Electromagnet

One word: UNDERPASSES.

New Gnome emerges blinking into the sunlight

"No, my point is that you must always make sure you don't run software from untrustworthy sources."

And MY point is, "I'm with stupid." As long as you have to deal with stupid, you WILL have to deal with people running things from untrustworthy sources. Make people jump through hoops and people start finding ways around the hoops; it's human nature.

If you don't take stupid into consideration (because as the comedian said, you can't fix stupid), you're doing it wrong.

"They even believe unlogical things, like that you can trust on sandboxes and therefore run malware inside of them."

I thought the idea behind sandboxes WAS that if malware tried to run it would be contained. Or are you saying as long as malware exists, SOME malware will ALWAYS find a way to escape the sandbox?

Samsung intros super-speedy consumer SSDs, 'fastest M.2s ever'

Re: Lovely for a micro server

M.2 supports NVMe. The article IIRC notes they use the four-lane PCIe v.3 configuration.

Re: I want to get WORMs when my spinning disks die.

High bit-per-cell drives are meant for WORM-like usage: call it WIRE usage: write infrequently, read extensively. You still need to worry about bit rot (provision error codes or similar) and controller failure (sudden catastrophic filure, have a duplicate)

EyePhones packing Iris-scanning authentication to go mainstream

My question is how it will be able to tell the difference between a real iris and a duplicate designed to fool it (even fiction has done this).

Victoria Police warn of malware-laden USB sticks in letterboxes

Re: If something is free...

"The Church is one of the wealthiest organisations, that has a massive property portfolio and pays no tax."

I said SMALL churches. These usually don't have much of the backing of Rome and have to operate out of THEIR OWN pockets.

And explain people like the late Saint Theresa.

Re: Live Linux?

"Raspberry Pi running from write-protected SD-card."

Known hardware. Would probably find a way to pwn the SoC and find firmware to overwrite from there. Plus there's no guarantee the evil device doesn't include an internal whispernet adapter that means it can link up simply by plugging in.

Re: What size?

"A really malicious device subverts the BIOS. So do the initial usb wipe on a machine you can afford to lose. And then wipe your BIOS."

Unless, of course, BadUSB prevents you from doing so. Plus if it manages to get onto a system and find a way to root it or whatever, it may go on to silently infect other firmware it could find (like drive controllers) and infect them one-way, to the point not even nuking from orbit can be sure.

Re: The urge to execute arbitrary code is growing stronger...

So what are you going to do? Go back to the Sears catalog? Oh, that's right. The State is now savvy enough to pose as Sears. Back to horse and manure piles and life expectancies under 60?

AT&T tries broadband over power lines again

Re: And another thing...

They'll do it at the transformer points, then, which you've admitted are ABOVE ground.

Re: Missed by this much!

Still, you have to wonder if trying this surface wave thing at the GHz range can cause resonance or other interference to filter back down into the MHz range. El Reg, after all, is full of complaints by amateur radio operators after earlier BPL attempts were introduced, and many of them weren't even that close to the units in use.

Lethal 4-hour-erection-causing spiders spill out of bunch of ASDA bananas

Re: Typical Asda

Oh? I thought the Brazilian wandering spider WAS the most venomous spider out there, with the Australian funnel web at #2.

IPv4 apocalypse means we just can't measure the internet any more

Re: NAT and firewalling and stuff

"Well, if their games were to want to support it, they could also STUN their way through, just the same as we telephony types do. But that would mean that the gamers wouldn't need the games comany's services, and that means a reduction in revenue. Guess why those games don't support it..."

Guess why many PC games DO support it? Because many PC gamers are savvy and know company support disappears after a while but user support lasts as long as there are fans for the game, which is why they insist on systems that allow for user-run dedicated servers. Otherwise, players don't buy the game at all, leaving the sellers in a quandry: 50% of something or 100% of nothing?

"No, I don't think that's true. Any internet is a "network of networks"; the interaction between those networks is at the discretion of the network owners, not the endpoints."

Not AN internet. THE Internet (proper noun), and yes that was one of the basic goals: to be able to connect anyone to anyone. NAT (especially at the carrier level) breaks that promise. If you don't feel this is the case, perhaps one should produce a new Internet (proper noun again) based o DIStrust instead.

"We all know that IPv6 doesn't require NAT in the way that IPv4 now does; but the opposition to people using it if they want to is simply irrational. It solves a problem for some people, and doesn't impinge upon anyone else except those that believe they have a right to unfettered access to everyone else's devices."

Oh? What about carrier-grade NAT? That's definitely NOT the user's choice and prevents the user from choosing to be visible because it's hard to STUN or otherwise route through a carrier-grade NAT, and doubly so if BOTH ends are NAT-ed.

Re: NAT and firewalling and stuff

OK, since you spoke so politely.

1. For NAT to perform two-way communications, it can do one of two things:

(a) the inside computer can initiate a connection to the outside. The NAT records this and maintains the relationship for as long as the connection is open. Once it closes, the relationship is removed. Now, this usually only works for stateful TCP-based connections (UDP doesn't work this way so requires something cleverer to deal with it) and only if the connection is initiated from the inside. Now, it works most of the time because most connections on the Internet are TCP-based and from the inside.

(b) A skilled user can tell the NAT to forward certain classes of incoming connections (like specific ports) to specific machines. This is the usual means for a home user to expose a server or similar thing (like a P2P unit) to the outside. Otherwise, the server has to rely on outside help, making a bridging connection to some point on the outside.

2. Going back to 1(a), since HTTP, POP3, etc. are all TCP-based (stateful) and initiated from the inside, NAT can maintain these connections.

3. Gamers have one of two options. They can either open ports (solution 2) or use solution 1 to establish a bridge connection to a point outside. Your friends link up there and the system then passes the connections along.

One of the arguments for using NAT is that it's a different kind of firewall operation: furthermore, it's one that (by design) has to block incoming connections by default, providing a line against automated attacks (targeted attacks can get around this by exploiting already-opened connections the way web exploits work). The counterargument is that in IPv6, this is little more or less than another firewall, and you can achieve the same function with a second (or better) firewall.

Furthermore, it's not NAT in general that's being frowned upon: it's one-to-many NAT they don't want (because the spirit of the Internet is that any connected device should be reachable by any other device if it wishes to). Especially at the ISP/carrier level, this makes many endpoint invisible by force. They have no problem at all with one-to-one NAT, and indeed many techniques brought forth to mask a subnet's map rely on things that are essentially one-to-one NAT. It's like with the UNIX philosophy: one fundamental assumption is that policing should be a program's (or in this case, device's) own responsibility. Trouble is, reality intrudes and you find misbehaving UNIX programs and badly-configured endpoint devices, so the NAT proponents at least have a point. What some are wondering, though, is if the "automatic" shielding can't be achieved simply by offering a firewall with something like a "drop incoming by default, allow outgoing by default" ruleset.

Re: Work of the Devil, etc...

"So we can internet enable ebvery grain of sand, which is good because connectivity internetofthings future"

It's basically a way to ensure we don't run out again, much like how ZFS uses 128-bit provisioning to ensure filesystem limitations are never reached in real life (and before you quote 640K, physical limits would be hit first).

'Inherent risk' to untried and untested 4G emergency services network – NAO

Even if it had A LOT of power behind it or the device has a high gain? Or if it can just sweep frequencies up and down a la a carcinotron? It wouldn't have to jam frequencies all the time, just periodically over short periods. It's the only way you can deal with frequency-agile systems.

Dark web drug sellers shutter location-tracking EXIF data from photos

Re: Simple editing

Cameras have started adding cryptographic signatures to safeguard against spoofing. Some implementations are better than others.

Hackers hijack Tesla Model S from afar, while the cars are moving

Re: Onestar

What happened when you told them if they don't fix it, you're going to turn it in and buy a different make instead? Threats of a defection tend to make company types pay attention.

Re: What's worrying is that it's a Tesla

Corporations aren't afraid of no liability. That's why they're structured the way they are: to assure scapegoats. That's why executives NEVER go to jail unless it's for a PERSONAL crime.

PS. Don't forget radio jammers are illegal under the Telecommunications Act AND they're easy to detect. And the only legal alternative, shunting, has two strikes against it in a car: windows and lack of a ground.

And how much longer do you think it'll be considered street legal?

Re: There is no fix for this

Then we're all lost because the two MUST be linked in some way, hands-free, in case of emergency a la OnStar. It'll become mandatory soon enough to save lives.

Re: What's worrying is that it's a Tesla

So what happens WHEN (not IF) it becomes required by law?

Re: Another reason to remove/block the cellular modem in any car you buy

And if EVERYONE is FORCED to sell nothing but by law and your old car's days get numbered? Do you give up or stop driving?

Want a Dell printer? Unlucky – they've just stopped selling them

Re: Hands up

I wouldn't know about lasting five years. First off, I buy all my printers secondhand. Secondly, I tend to replace printers when I find bargains on better ones, repurposing the old one or turning it in to a charity shop. But for the record, I haven't had any of them really break except for a LaserJet 6L that IIRC tended to lose grip with its main paper feed roller after some time (a problem it shared with the 5L).

I know for a fact at least one class of business MFP laser printers sold by Dell (333x series) are Lexmarks (Dell 3335dn = Lexmark X460).

Opera debuts free VPN built into desktop browser

Re: An interesting move

Just a heads up, I checked out PureVPN in the past but ended up at nVPN (nvpn.net). I find them to be more flexible for experienced computer users. They offer dedicated IPs, port forwarding, and HTTP and SOCKS5 proxies. For all that, I found $60/year to be a reasonable price compared to the other options at hand.

Brave telco giants kill threat of decent internet service in rural North Carolina

Re: business perspective

There's the third option: that it's CONDITIONALLY profitable, that is profitable if and only if they alone control it. If anyone else gets it, that's competition that could later intrude on their existing business (making it counterproductive). So for them only two states are acceptable: THEIR control or NO control.

Radar missile decoys will draw enemy missiles away from RAF jets

Re: That's Fine, Unless They Change Transmitted Patterns Or End Run Using Lasers

"We must agree with our enemies they won't make changes to their transmitted patterns OR to switch to laser guidance for the last few seconds. Then it might work."

The can may be able to adapt to patterns (the lookup table may be based on frequencies and strengths to distinguish ground from aerial radar). As for the laser, that may have limited functionality in an air-to-air encounter where the quarry is moving at over Mach 1 and can turn pretty sharply, which is why most A2A trackers today have pretty large fields of "vision".