Posts by copsewood

Google geek slammed over XP exploit

incompetent development methodology

Open source security bugs on any program in much use tend to get fixed in less time than this following disclosure. If not, the person informing a lead developer of a bug, morally deserves to be recompensed for the delay to their career resulting from being expected to sit on this information for longer than needed.

What is it about Microsoft in particular that makes their cumbersome and monopolistic internal development and maintenance processes deserving of more leeway than they would be given if they published their source code, allowed distribution of user modifications, developed code within the public domain and were open to peer review ?

Tories declare students a burden on us all

knowledge-based or low wage economy ?

You pays your money and takes your choice. Personally I'd rather live in an economy which gives average 10X earnings compared to a low wage economy. Even if it means having to pay more taxes.

NetSecure SmartSwipe credit card reader

more thorough review needed

I can see potential benefit in dedicated hardware for e-commerce authentication so long as it can't be trivially defeated. This requires more detailed review of such devices than in this article. If the manufacturer doesn't publish the design and protocol to maximise independent peer review, Kerckhoff's Law and experience of thousands of badly designed and insecure products proves vendors' "security by obscurity" claims to be worthless and such reviews need to point this out. If these details are published, a quality review needs to consider the implementation details more expertly.

Gadget tax needed 'to save US newspapers'

100,000 a day

Owning a newspaper beats owning a football team for some rich people and I can understand why. If you are sitting on a huge pile of cash you may as well either have some fun or make some noise using it.

bring it on

The day doesn't need to be saved for the journalism and content industries, because money wants a voice and is willing to pay for it. That provides the subsidy for the Guardian and similar lossmakers which keeps them going and corporate sponsorship of the arts etc. The claimed crisis is more an opportunity to democratise the process, once we consider that the creative content sells the higher market-valued mechanisms used to carry the content. If there isn't a shortage of people spending money on audio reproduction equipment and audio carrying bandwidth, should the fact people don't want to spend money directly on individual recordings need to matter ?

So the article is a poor argument not give the creative content producers a sales commission in respect of the valuable mechanisms used for delivery (consumer electronics and Net bandwidth). If you really were ideologically opposed to all kinds of taxation in principle, then of course you would oppose this: because no market can deliver it directly, the state has to intervene for similar reasons that the state builds and maintains roads and passes laws without which markets could not exist.

But this money shouldn't be a tax in the conventional sense because it should not go through the accounts of the state. It will be charged to a very few industries through a little accountancy work. Politicians are not needed to vote where it goes though will have to decide how much should be paid, and consumers seeing slightly higher prices on Net connections and consumer electronics should get to decide which content creators benefit based upon the content which we actually use. So instead of opposing the inevitable, better to start thinking about how this process can be democratised, so that all who pay the commission on media carrying products we use can get to vote on who the content-providing beneficiaries should be based upon the music we listen to and the films we see. Unless you really want only the rich to have a voice in deciding what the content should be that is, as with the current system.

Google tells staff to snub Windows after China hack snafu

Linux distributions are secure up to a point

Technically Linux is just the kernel program. It's the Linux distributions people use that are likely to be secure relative to Windows. And occasionally not: Puppy Linux used to have the default desktop user running everything as root a few years ago, but too few people used it for many to notice. Also if and when world + dog are using Linux and point and click Linux executables are therefore in a high proportion of dodgy emails and on most compromised web servers, Linux distros won't then be very secure unless the browser and desktop middleware ensure each such executable can only be executed or installed easily inside its own disposable sandbox.

Met lab claims 'biggest breakthrough since Watergate'

Same in London, Glasgow and a faker's audio lab ?

This is because the entire UK grid is synchronised. You wouldn't get the same variation pattern in London as in Paris because mains electricity is exchanged between the UK and France using DC and not AC. But you'd get the same pattern in Paris as in Frankfurt. And if the historical frequency variation data isn't already published somewhere on the Net it probably soon will be.

Let's hypothesise you wanted to create a faked signature and you had access to the historical data of the AC variation within the AC control region against base 50Hz frequency from the date and time you wished to simulate. You then transform the mains using a DC converter (e.g. go through a bank of 12V car batteries) and then modulate the local AC mains as output from the AC->DC->AC converter to the same time signature you wished to recreate. If we don't yet know whether this is possible, it would take further research to prove or disprove whether this approach could fool this forensic method. If it could, then someone wanting to claim a recording was faked would presumably have to demonstrate a probability that this approach was used to reinforce the faking of a date/timestamp on a recording.

While we will welcome use of such approaches to convict the guilty, this could be of interest to someone genuinely believing they were framed by this approach. Let's face it, history isn't short of examples of supposedly unchallengeable forensic methods found to have been used to wrongly convict the innocent.

Apple picks death not compliance for open source iPhone game

Go probably matters enough to some IPad users

Who are very unlikely to buy I-anything in future because of this. If free software is worth developing and promoting, business models based upon controlling users will ultimately have to be destroyed. If that means killing the market for user-controlling devices all well and good.

Pirate Bay now run from Pirate Party 'mountain bunker'

privacy and expression

Your copyright does not give you a right to have my letters steamed open because my privacy right supercedes your copyright here. You should also have no right to have my Internet connection spied upon (same idea), but some governments seem wrongly to think that it should.

As to freedom of expression being suppressed, Disney's Mickey Mouse plagiarised Steamboat Willy, because SW was out of 30 year copyright in the 1920's, but MM is still in copyright jail 90 years later. As the useful public domain depletes due to extreme copyright duration, many new expressions becomes genuinely more difficult. For example, I saw a TV program describing the impossibility of creating a historical program reviewing a number of civil rights documentaries made during the 1960ies because each documentary would require contacting hundreds of rights holders, who are difficult or impossible to trace and if interested likely to be too expensive to deal with. Consequently copyright interferes with freedom of expression in a world where preservation of history is important, and our ability to represent important parts of it becomes impossible, or in any kind of artistic situation where new work requires representation or inclusion of old work.

'Bulletproof' ISP for crimeware gangs knocked offline

honeypots and honeynets

One problem with these is that the analyst simulating an infection in order to monitor black hat/malware behaviour has to make sure their infection behaves closely enough to what the blackhat is controlling to fool the blackhat, while also making sure the simulated infection does not behave like a real one in the sense the honeypot/honeynet needs to be part of the solution rather than part of the problem. Various approaches are used, including having outgoing connections go through a custom very restrictive rate-limiting firewall. Most typically a honeynet is setup to become infected, while being strictly monitored and controlled, in order to study the malware used to infect it.

Possibly one of the most useful and effective honeynet techniques is the fully automated spamtrap which attracts great volumes of spam, measuring the addresses from where the spam is relayed so these bot addresses get onto the DNSBL blacklists used by most MTA mail servers in real time.

no global routing table

There is no global routing table. Every router has and regularly updates its own viewpoint of which neighbouring node to go through in order to forward to a particular address range. Each router also regularly advertises to its neighbours the address ranges it can help forward the packets it receives.

The Net was designed this way in order to avoid single points of failure, as was the telephone network before it.

There is a centralised system of address block allocation, analogous to the allocation of telephone dialling country codes. To find out more about that a good starting point is the Wikipedia article on Regional Internet Registries http://en.wikipedia.org/wiki/Regional_Internet_registry .

Biometric cash machine lands in Europe

finger simulation

How long before crooks figure out how to simulate your live finger by reading it and then creating a prosthetic one that reads the same in these machines ? Don't see the need for cutting fingers off, all they need to do is mount a scanner inside a door handle.

Exam board deletes C and PHP from CompSci A-levels

Can you educate without a language ?

Of course teaching ideas, principles, problem solving, critical ability etc. are what education is about. Teaching language and mathematics is fundamental to these things. When it comes to the natural language in which teaching and learning occurs, schools have little choice, but a natural language has to be used or little education could occur. I'm all in favour of children learning a second natural language at a young age as this promotes much greater flexibility of thought.

If learning computer use in any deep sense is to be a required part of education, this clearly cannot occur from the perspective of a dashboard set of controls liable to change every few years. That is all most schools do, unfortunately, and this in practice is analogous to teaching a bit of reading while leaving all writing to a priesthood whose mystical secret knowledge is considered too abstract and elusive for mere mortals to understand. This is how things were with literacy in the middle ages, and we are now repeating this mistake in computing education if we don't teach programming in some language.

So either an artificial language choice has to be made or our computing education won't go beyond the superficial. Clearly the choice of artificial language for the purpose of teaching is important - in the sense of the choice we make not putting students off, and helping them to learn the underlying principles and concepts of computing as well as possible. The number of responses in this discussion topic suggest others think so too.

Python

Python is excellent as a teaching language, because it is cross platform and you can get useful stuff done with very little knowledge of it and this then leads naturally to more advanced concepts. Python also has no redundant syntax. Once you learn that the code won't compile until you indent it the way you should indent code in any language to make it readable, you'll be over the one arguable nuisance factor Python seems to have. Also to make indentation bugs less of a nuisance, the student will very soon be splitting coding into smaller components and files which has to be a great improvement over what most beginners do.

I agree that 'C' is better for teaching data structures and algorithms from the point of view of resource optimisation, but I really don't think 'C' pointers should have to be handled by a student learning their first programming language. Also relatively few programmers who already know how to use language provided and library sorts and hashes etc. need to worry much about optimisation.

New attack bypasses virtually all AV protection

dont run untrusted code

At least with Linux you can decide which software repositories you trust the QA of, and the PKI attached to signed packages means you have a certificated supply chain for all the software that gets installed and executed on your system. Sure you can still make a bad decision to trust a supplier who provides their own repository and allows bad stuff it, but if you are worried about that you could always setup virtual machines for less trusted software suppliers who have not yet got their software packages accepted by the mainstream package repositories.

No system is immune against an end user who doesn't think about trust issues while knowing enough to download and execute code other than in a transitory sandbox (e.g. as with Javascript).

Email 2.0: Trying to catch up with the web

DKIM requires knowledge of domain reputation

Domain reputation is much more likely to be reliable than the reputation attachable using one or more DNSBLs to the originating IP address. We'll still need white/black/grey listing systems, but these will no longer relate to the IP address. They will relate to the goodness/badness that can be automatically derived concerning the reputation of the authenticated domain name e.g. by counting whatever arrives at very large spamtraps that isn't NDNs with null sender address. Then the spammers will have to pay mules to register their domains for them, but it won't take them very long to burn out a domain.

Vote Lib Dem, doom humanity to extinction

more probable delivery systems

"If some mad mullah developed a nuclear bomb and decided to hit us with it, they wouldn't send it in a fancy ICBM with a smoke trail leading back to their homeland. They'd put it in the back of a Transit and drive it to the target."

More likely a shipping container shuffled through enough container ports to achieve plausible deniability as to origin. Which makes the whole idea of deterrence using expensive survivable submarine ICBM systems a bit like the Maginot Line - a very expensive system designed for the last war, not the current one.

Cameron aims to bring LibDems into government

Labservatives

Well from our (the LibDem) point of view the 2 main parties do have more in common with each other than either has with us. But it seems very unlikely they will be able to do a deal with each other for historical reasons and because they don't like to admit how much they have in common with each other to their supporters because this invalidates all the bogeymen arguments of the past (When they have claimed a LibDem vote was really a vote for the bogeyman because it lets the bogeyman in).

However, the needs of the voters have to take priority over the interests of parties, so I guess someone will have to hold their noses to enable government to occur, and I really can't see Brown desperately hanging onto power doing his own party any good by not resigning, or it doing us any good by accepting promises of electoral reform from Brown which he no longer has any ability to deliver.

I'd also much rather have a minority Conservative administration having to moderate their policies by making these more acceptable to the majority of voters who didn't vote for them than by Cameron doing a dodgy deal with the Ulster Unionist parties resulting in Northern Ireland abandoning the peace process.

Pirate Party UK sinks on maiden voyage

good on them

I wouldn't have voted for them if they had stood in my constituency. My name was on the nomination form of the local Liberal Democrat candidate, the party I've been a member of and supported for a few decades now. But any political movement has to start somewhere and I see no harm in a few young people learning about politics the hard way.

Their arguments have also influenced the stance my own party took on the dogs' dinner known as the Digital Economy Bill. We were in favour of it to start with but ended up against. Yes, single issue parties are for a season: either they develop into something with a useful philosophical input into more areas of life, or they influence others to adopt their specific policies (e.g. as the Monster Raving Loony Party influenced reducing the voting age to 18), or they fail to persuade anyone about anything.

Besides, someone has to try to replace the benign and comedic influence of Screaming Lord Sutch on UK politics. There's a great need for a bit of harmless fun here, even though Sutch himself could never be replaced.

Hawking: Aliens are out there, likely to be Bad News

Reservations

How can we be sure the Solar System (or observable parts of it) are not a reservation already, with the observable universe arranged to appear to be what the technically more advanced colonists of our sector want us to see ? E.G. if they don't want us to contemplate interplanetary travel yet, why not make the local speed of light and locally observable distances make it look as if it would take too much energy and time for us to escape the boundaries placed upon our reservation ?

Use of extraterrestrial explanation icon somewhat obvious !

Microsoft wins big in Chinese piracy lawsuit

the first few shots of heroin are always free

Bill Gates said "About 3 million computers get sold every year in China, but people don't pay for the software. Someday they will, though. As long as they are going to steal it, we want them to steal ours. They'll get sort of addicted, and then we'll somehow figure out how to collect sometime in the next decade." * Speech at the University of Washington, as reported in "Gates, Buffett a bit bearish" CNET News (2 July 1998) [1]

The Chinese it seems, having swallowed the bait, hook, line and sinker, now have to figure out if they are smart enough to migrate to free software before Microsoft rips their intestines out.

Workers scared to befriend bosses on Facebook

compartmentalise

1 reason I am on facebook with a picture that isn't my face and a name that isn't my name is to keep those who know me through who my friends are and those who don't apart. I also don't want to have to refuse friend requests from students and the fact they can't easily find me on FB sorts that one out.

While the custom privacy settings may allow some compartmentalisation that depends upon how much you trust Facebook security wrt the rest of the world, given they will either have to figure our how to make money by marketing your data or close down due to lack of revenue.

No harm in keeping different FB accounts for different contexts, using different virtual machines so FB can't correlate the cookies.

Obama open sources custom White House code

indeed

Proprietary vendors are not going to understand the specialised scaling requirements of individual users as well as the users themselves, assuming the latter have a clue. Contributing patches upstream and maintaining them there reduces the duplication of effort involved in maintaining a local fork.

Epic Fail: How the photographers won, while digital rights failed

both sides lost

I'd have thought what the ORG campaign is for is obvious:

a. greater freedom of expression in a world where expression requires an element of reuse and little that is new is created without reference to what went before, and

b. greater privacy of communications in a world where such rights have higher legal status than copyrights. The content industry doesn't have the right to steam open our snail mail. So why should we put up with this in connection with our network connections ?

What the content industry loses here is the ability to obtain a sales commission from a much larger IT and communications pie they are helping to grow, where a significant motivation to purchase a bigger pipe is the content that can flow over it, as with a substantial proportion of the products of the electronics industry, the output of which is designed to copy information from one format to another.

Yes of course it is time for the 2 sides to negotiate a deal and this malformed legislative dogs dinner will not help. However, Andrew needs to consider further the extent to which creators rights are negotiable, given that if content copyright content is not for sale or can't infect other valuable work into a more accessible state, this is worth no more than vanity to those who own it. Profitable sales commissions probably could be negotiated by the ISP/electronics industry side in exchange for content made freely redistributable which helps sell the network and devices which transform the content, but freedom of expression and privacy have to be non negotiable for those who care about such rights.

The industry that sells the ability to copy information from one place to another or to transform content from one format to another probably exceeds the content industry by a significant multiple. Talk about the tail trying to wag the dog - it would appear a content industry lacking any imagination and claiming to sell nothing else is lobbying for its short term interests at the expense of its longer term good at a time when politicians seeking re-election are unlikely to want to start arguments with media owners who purchase ink by the barrel.

Microsoft clutches open source to its corporate heart

And then you win

This probably isn't an April fools joke: if Microsoft don't do what this article says they are toast, because their customers won't want desktops that can only talk to the same as much as more open and flexible desktops. Microsoft must also be aware that they are losing large chunks of the browser market to Firefox and the Office market to OO, and as far as Internet hosted servers and embedded systems including mobiles are concerned they are way behind.

Microsoft learned that they couldn't replace the open source Internet with a proprietary network of their own devising by the mid nineties, and their embrace and extend strategy towards the Internet then didn't stop the latter being open source. IBM before them knew the mainframe monopoly was going to become a declining share of the total industry, so IBM had to become primarily a services and support company in order to defend their position and grow in the longer term. As Internet and embedded applications increase in value, desktops are also set to become a declining share. The real question is whether Microsoft can shake off enough of their monopoly product-driven culture to become a successful services and support company.

The Pirate Party is the shape of things to come

Welcome back to the UK ?

"Ah, so you advocate stripping rights from people with creative talent.What a bitter man you are!"

The history of your nation's constitution started, I seem to recall, with the stripping of property rights from the British crown in 1776 ? So to apply your arguments to your own history, this history of political right stripping makes any sense of US national pride a matter of spite, bitterness and jealousy ? Andrew, the more I manage to wind you up, the funnier you sound. Besides, I'm not sure we would want all those Americans taking up seats in our Parliament, so good riddance !

@George

George, your posting is so full of wrong assumptions and errors its difficult to know where to start. I also worked for many years on the technology that made the Net possible and stopped earning money from my engineering work when I went into teaching, which was right and proper. Copyrights and patents are different things, and I have no problem with copyright applying to commercial use, and enabling further commercial areas of use (sale of bandwidth supported by content) by legitimising non-commercial use. So I suggest you reread my arguments and try to think carefully about what I am saying rather than what you seem to be imagining I'm saying.

Wrong again

Andrew, my son, based upon a few other objective metrics, is clearly a great deal smarter than either of us, very much his own man and he makes his own choices about how he licenses his music. You can hear his latest album on http://warfreak2.org.uk/ if you want.

copyrights don't trump the ECHR

"Licensing that exclusive right is best done voluntarily, by the rightsholders themselves, I think you would agree."

I don't. You, Andrew, are arguing as if rights never change, never come into conflict with other rights, and exist independently of politically-motivated lawmaking. You need to learn some history. A claimed right which conflicts with more fundamental rights has to be negotiated through the political process or will be challenged through use of political process, as the activities of the UK and other Pirate Parties demonstrate.

Wrong marketplace and wrong motivation

Andrew, you're totally wrong, I've got nothing against musicians. My son is one and he's just released his latest album on Creative Commons terms. But this doesn't stop him working at something else for his living which others are prepared to pay for. I'm an amateur musician myself on occasion. After I left college some of my best friends were a group of musicians who tried but failed to become famous. I've still got their music and enjoy it, and enjoyed the times I went to see them play.

But after about 10 years or so they gave up and got proper jobs. So you think copyright motivation should have made them waste 5 years more or 5 years fewer at this game, before they stopped living off dole money at the public expense and starting working as teachers and engineers paying taxes and supporting their families which is what they did once reality dawned on them ?

I'm also unconvinced it's better for musicians who make themselves rich enough not to have to work again. Having to work again tends to have the effect of making people into more responsible citizens like the guy from a one hit sixties band who manages a pub and serves customers a few miles from me, which has to be better than aging rock stars burning themselves out on booze and drugs.

coherent justification

The 2 sets of rights being asserted here are not compatible.

a. The conflict between the free expression right to be able to make fair comment using extracts of work made many years earlier where the rights holders have lost interest and are not contactable (ECHR section 10) but we don't know that for sure, and they could still sue concerns incompatible rights.

b. The conflict between the right to be able to communicate freely with friends and others without having communications spied upon (ECHR section 8) unless overriding reasons (e.g. national security) are at stake and justify surveillance, versus copyright holders claimed rights to be able to control all distribution of work concerns incompatible rights.

Legislators have to compromise between incompatible rights asserted by different political interests. This, Mr Orlowski, is what politics is about: who gets what, when and how often. The UK Pirate Party may well be less mature in the presentation of their politics than their Swedish counterparts, but this fact doesn't make the core values behind their arguments any less legitimate. It can take a single issue party to force major parties to stop being one sided on such issues, e.g. because conventional publishers can swing many votes and have failed to present the side of this debate which doesn't suit their interests.

As to how content creators should get paid, that seems obvious. If a clothes shop plays music they are making money from it and have to pay a license to copyright holders for public performance. When non-profit making distribution is made legal, the ISP industry and vendors of blank media will be making money from customers' distribution of content and should, like the clothes shop playing music, have to pay for licenses which can be justified on grounds of sales commissions. Without the content, it seems clear that less bandwidth and blank media would be sold.

Wrong marketplace and wrong motivation

There isn't exactly a shortage of places for people to have a 'shot at the big time' elsewhere from the content biz, including casinos, stock investment scams or lotteries with null return for the majority of punters and the odd stinking rich exception to motivate the losers. Even with defensible copyright terms and scope (much shorter terms, enforcement limited to commercial use only) there will be no shortage of wannabees trying their hand in the content biz. The Freakonomics book equates this kind of motivation to street corner drug dealers willing to risk a high chance of getting jailed or shot for the outside chance of becoming Mr Big. So Mr Orlowski wants us to negotiate away fundamental human rights (expression and privacy) so a few more losers can be tempted to waste away the best years of their lives for such motivations ?

Hackers hit where they live

check your Received header chain

You need to look at a few full email headers. If your postmaster rips open your envelopes, throws these away and cuts off your letterheadings as some webmail providers do, then you'll stay ignorant until you choose to use a decent incoming mail delivery service. When you can check your full headers, the IP address delivering to the first trusted gateway in your trusted incoming chain is the one you filter/reject it on, blacklist if you want to and check blacklists for. This can all be done automatically.

Times websites want £1 a day from June

wont pay

Havn't bought anything from Murdoch since he cheated redundancy money due to the Fleet St printers using underhand tactics, by putting them in a position where they had no alternative but to strike. He then sacked them as he'd previously intended, having secretly built the replacement Wapping plant . I'm not going to buy anything from him now. My sister will simply have to copy me the letters she gets published in his filthy rag if she wants me to read them.

BCS turns down e-signature petition

Should one aggrieved hacker get an EGM ?

The history of electronic voting doesn't inspire much confidence, including many rigged TV polls where members of the public have wasted a great deal of money on rigged votes that were decided in advance and the attempted votes were not counted at all, and TV companies were charged large fines when the truth got out. I imagine when the BCS do accept EV, it will be based on some kind of PKI its members can verify and use. Chances are that they know enough about this to know that their members can't yet realistically all go to keysigning parties and handle rollover and revocation reliably. Doing PKI right is expensive and hard, and beyond the means of most voluntary organisations. I would imagine the BCS know more than most how much cost and time doing the job properly involves.

'Go veggie to save the planet' UN, EU plans debunked

closer but not quite there

The correct comparison would be which of the following generates how much GHG:

a. Wilderness of various kinds including wetlands.

b. Arable farming

c. Livestock farming based on grassland suitable for arable

d. Livestock farming based on grassland unsuitable for arable

e.Livestock farming based on grain fed livestock.

As I understand it wet wilderness generates a great deal of GHG. We call methane "marsh gas" because that is how methane occurs in nature. Clearly draining wetlands, which has occurred extensively to provide agricultural land removes natural sources of GHG, as well as destroying a great deal of biodiversity. But we do need scientifically motivated and full comparisons here, not religiously motivated selective ones coming from those who imagine vegetarianism to be holier than meat eating so report science selectively in order to impose their religious views upon others.

Badgers, because badgers, rabbits and wild animals fart too.

Pirate Party UK launches manifesto

XP without security patches

Gets itself compromised in minutes leaving you with a nest of viruses.

The security patches you need will still be within copyright even if copyright on them is reduced to 12 months.

Nerd alert: First Lucid Lynx Ubuntu beta fun

Customisable when you want it

I've had no trouble customising my Ubuntu desktop with my somewhat exotic email requirements which go way beyond what I've ever seen achieved on Windows or Mac. Under the hood it's little different from its parent Debian distribution which I still use on my hosted server and this gives it the customisability needed. However, having things just work with popular defaults and being able to use GUI administration tools for the most common things saves me time where I do not want to have to spend it. Also without the Ubuntu ease of use, my 90 year old Dad would probably have had to give up using a computer once he had to replace his Windows 98 system a couple of years ago. Windows XP was then no longer a desktop option from his preferred hardware supplier (Dell) and the demands Vista was making upon him on his new computer were completely beyond his tolerance threshhold.

Zeus botnets suffer mighty blow after ISP taken offline

reputation and externalities

In the financial world reputation (i.e. the ability to provide a credit contol reference) is in the hands of a few specialist companies. In the bricks and mortar world if you live or landlord in an area with many crooked neighbours you either bear a share of the costs of the bad neighborhood or you move somewhere else. We're likely to see similar economic and social pressures in the Internet world. Reputation providers such as Spamhaus or the Denyhosts data sharing server blacklist addresses responsible for bad traffic and those running SMTP or SSH servers which don't use these blacklists or are subject to higher volume attacks than those which do. Eventually if too high a proportion of an ISPs addresses emit bad traffic then other ISPs won't peer, because for them the costs of keeping a peg on their noses can become greater than the benefits of the traffic sharing peering arrangement.

This isn't an issue of fair or not fair, it's to do with economic and social realities which occur in other contexts catching up with the Internet world.

It's official: Adobe Reader is world's most-exploited app

Evince

Evince can be studied by anyone for bugs as it is open source. It also respects the legitimate needs of the person viewing a PDF and not the very easily overcome DRM intentions of the document provider, see:

http://bcu.copsewood.net/sectheory/drm/ProtectedPdfCanBeCopied.jpg

Opening a PDF on Windows from an untrusted origin using a closed-source viewer is asking for trouble, almost an invitation to a stack overflow attack. Anyone who uses software which meets the needs of the software supplier more than those of the software user deserves what they get.

Crap Scottish weather favours ginger hair

Vitamin D and sunburn

People with darker skins are more likely to suffer Vitamin D deficiency syndromes in places with abysmal winter light intensities. Gingers are more likely to suffer sunburn and skin cancer given excessive sun exposure in hotter climes. Nowadays darker skinned people can take winter supplements and fair skinned people can easily use suncream and hats, so its easier for people to live where a few hundred years ago they would have been genetically unsuited.

DARPA wants military iPhone and Android apps

software supply chain integration and QA

Open source distributions quality assure and source verify the supply chain for tens of thousands of software components coming from very many original suppliers. Proprietary software does not achieve this because intellectual property road blocks prevent this integration from occurring. The outcome for defence supply where lives of troops and mission outcomes depend upon reliable equipment is hardly surprising.

Silicon Valley hypegasm for miracle shoebox powerplants

Don't think so

If nuclear power were that profitable then why would they need to offload the long term storage costs and insurance cost onto the taxpayer ?

Polygamist Microsoft picks Amazon as latest Linux wife

GPL3 and patent arms decomissioning

Once Amazon sells electronics with GPLv3 licensed software inside they become obliged to pass on any patent indemnity they may have covering this software to whoever buys these electronics goods with software from them. If Amazon don't extend this indemnity they are distributing this software unlicensed and would be in simple breach of copyright. This would put them in the exact same position they would be in if they sold DVD copies of Holywood movies made on their own in-house copiers. Does Amazon even know which of the products in their catalogue has GPLv3 licensed software inside ?

Hand grenade for reasons which should by now be obvious.

Microsoft chucks bargain bin at world's youth

Heroin - just say no

The first few hits are always free.

Ex-Army man cracks popular security chip

US law != world law

The DMCA only applies to those willing to risk travel to the US or indigenous serfs of the corporations there who buy such laws from US Congress inc.

Experts reboot list of 25 most dangerous coding errors

Indemnification is for lawyers with large budgets

It's a good thing to have well trained developers who understand coding with reference to security issues. (That's how I make some of my money.) But unless you are developing from scratch for a trivial microprocessor (itself developed from scratch) using machine code you are relying on code created by tens or hundreds of thousands of previous software engineers working in thousands of different organisations, either as part of the toolchain used to create your application, or your operating platform, or recursively in respect of earlier systems where these platform and toolchain artefacts came from.

Open source distributions are developing an effective form of suppy chain management with cryptographic signoff by developers and integrators. This is something likely far better than anything achieved in the complex and closed source world. But either way, the integrity of any final system beyond a given level of complexity still depends upon a web of trust with a great number of people past and present involved and it won't be possible to get them all to sign the proposed contracts. So if the platforms and toolchains are not going to be indemnified, what value is it to the customer of a more expensive application in practice if the latter is indemnified regardless of the legal status of the former ?

This one isn't going to fly in the open source world where licenses specifically disclaim developer liability, though there is nothing to prevent specific code being developed and released open source with side agreements. And if the source code supply chain isn't open source the customer has no way of knowing where all the platform and toolchain code came from or who checked it to what extent anyway.

MPs, Lords ask if Mandybill is human rights friendly

@iggle piggle - What Right ?

"and those are the rights of the copyright holder not to have their work blatantly copied around the internet with no consideration of their wishes."

What right do copyright holders have if the laws supporting their vested and vocal interests are unenforceable and generally ignored ? Were London cabbies really supposed to keep bales of hay in their cab boots for horses long since retired until the 1970ies when this long obsolete law was finally revoked ? And should this question have been considered differently had the producers of hay bales owned the printing presses ?

Copyright laws based upon 20 - 30 year terms prior to work entering the public domain, when these affected the behaviour of a few dozen rich owners of printing presses were proportionate. Copyright laws based incrementally on these earlier laws but extended to 50 - 90 years, theoretically affecting the behaviour of everyone capable of copying anything for any purpose whether profit making or not are treated with the contempt these deserve .

Apache terminates 'outdated' web server

It served me well

The reason I suffered a few day's pain upgrading from Apache 1.3 to 2.2. last summer was because 1.3 was no longer security supported on the newer Lenny Debian stable and I had to upgrade to Lenny from Etch. My Apache 1.3 configuration was so convoluted after many years of accretions that it took me a few day's work to unpick it, and I had to put various of the applications and site areas served into separate virtual domains with URL redirects. Things are much more modular and maintainable now that I've done all that. Moved on at the right time for me and the sites I support, but 1.3 served very well for many years with few if any problems.

ARM boss forecasts mass migration to netbooks

been there done that

I got a cheap Acer Aspire one SSD with Linux on it because no other OS would have been of any use at all. The limitation isn't the processor, because with X forwarding, offloading processor intensive jobs to be done elsewhere is very easy. For me the limitation is the keyboard and eye and shoulder strain. The keyboard is just large enough to touch type on but not very accurately, which can be a problem in command line mode. I got it because I can't be bothered to lug a large laptop around when I could use mobile computing. It is useful to have the option to use it when I'm traveling, remotely to manage my servers, find a place to visit, check a weather forecast, other occasional web browsing, showing and uploading photos etc. but half an hour a day on this thing is about my limit. Doing this on a lower power ARM chip with longer battery life would make a lot of sense, given all the software I want to use on it is available in source code form and can be recompiled for the more power efficient chip.