Posts by Crazy Operations Guy

Naming computers endangers privacy, say 'Net standards boffins

Re: If you want to start an argument..

My company ran into that, until we realized that DNS was a thing and you can assign as many damn hostnames to the same machine as you want.

In my network, systems tend to have 4-5 hostnames, one that represents the psychical rack location of the system, it would also have an A record for its Asset ID, another for its purpose (like US-NY-Filer-02), and another for application-specific purposes. Many machines holding multiple roles will have multiple host names, so like our multi-purpose Email server is known as pop3-01.<domain>, IMAP4-02.<Domain>, ActSync01, MTA-01, SMTP-05 (application roles), etc as well as B22-Rm2501-Rk15-St15 (Location), Ast0023875 (Asset tag), and MAIL.<domain>.com (for user access).

Re: A bit out of context perhaps?

You also have systems that love to attach whatever DNS suffix the DHCP gave them, so "Donald's_Samsung_S3" may well become Donald's_Samsung_S3.whitehouse.gov, which makes it -really- obvious who owns it...

That and most people are going to be scanning for host names from within the network, so that really narrows down who those names could belong to.

Re: So

That's what I do at home, my desktop is WS35 (the others in the house are WS21, WS15, WS31), the laptop is LT17 (With others being LT11, LT12, etc), and so. Servers are named the same, but also have CNAMEs in DNS to point clients to the services on the boxes (So FS01 is really known as SR01-20 when probed directly)

The number is incremented each time the OS is rebuilt, the letters indicate the device type, but nothing else. My side job is to migrate applications from HP 9000 hardware to x86, so I have quite a few machines on my network and don;t want to accidentally have code point to WA01 when it was suppose to only work with the previous incarnation of that system (so if I see a system attempting to communicate with SU21, I know the machine was part of a migration of a particular app and can fix the reference)

Do you use .home and .mail on your network? ICANN mulls .corp, .mail, .home dot-word domains

Re: Alternate DNS roots

I've built my own DNS boxes specifically for that purpose. The server runs a script that pulls https://www.internic.net/domain/root.zone, compares it with the previous version and adds the changes to my stripped-down DNS zone to serve up. I have yet to see anything worth a damn on any of these new TLDs and did it to avoid all the malware and pointless bullshit that infests domains in those TLDs. My users complain that they can't access anything under .buzz, but those sites are already against the AUP anyway, so no loss there.

I've found that nothing useful uses anything other than the generics (.com, .net, .org, .edu, etc) or a ccTLD (.uk, .de, .sv, etc).

Nearly all the new TLDs are owned by companies trying to protect their IP, or domain squatters (With have of those being owned by a single troll based in Bellevue, WA)

Re: .local

I've always just registered .net along with my domains and use .net for all my internal operations (Its why its there, after all). I avoid using .local or anything like that because OS X craps the bed when trying to authenticate against an Active Directory with a .local domain, or any other non-existent TLD. OR at least that is what I saw back in 2012 when I worked for a company that had OS-X based machines.

.net domains are like $5 a year, with most registrars offering discounts for multi year or buying the .net along with other domain names, there is no excuse for not just buying a real domain name. In external DNS, I just use an @ CNAME to point everything from .net to .com, and is otherwise empty; all the real .net DNS zone info is on the internal DNS servers.

Smart sex toys firm coughs up $3.75m in privacy lawsuit

I'd think 'medical equipment'. Or at least that is what happens in Alabama where you need to get a doctor's permission to purchase one...

Look who's bailed out internet-satellite provider Intelsat? It's... Softbank?

Re: Obsolete technology

Only obsolete for stationary systems (Of course it is still quite useful if a ship drags its anchor across a fiber link and severs it).

But it is quite useful for communication with ships, aircraft, and people that are in areas that a fiber link wouldn't handle. InMarSat is currently working with the aviation industry to start streaming the CVR / CDR (Black Box) data live from all aircraft to a ground station to avoid something like MH-370. Same story with ships.

There are also plenty of people (such as myself) that work in areas where even copper doesn't reach. Its also useful for personal and vehicle emergency beacons or just remote data logging from remote experiments (such as volcano and Tsunami warning systems).

Re: It is InTelSat, not IntelSat

It may be now, but its certainly not IntelSat.

It is InTelSat, not IntelSat

The 'T' is capitalized. The company's name is assembled from International Telecommunications Satellite Network. It has nothing to do with the silicon company or spies. It was originally built to relay analog phone lines overseas and over long distances where copper was impractical.

That big scary 1.4bn leak was 100s of millions of email, postal addresses

"so people were sick and dying and doctors couldn't get internet"

Email is not internet. The lists that Spamhaus produce are intended as part of a spam reduction system, not for just out-right blocking. The intention is that organizations would use their lists in calculating the probability of the message being spam (Spam filters tend to look at multiple factors, not just origin to determine if a message is spam)

Of course, those Hospitals / schools are likely to have been blocked because they were sending out spam. I have seen numerous hospitals and schools that were compromised and used to relay spam . Just this morning, I got a message from compromised email account at UC Berkley trying to sell me Viagra. I had another form a hospital trying to to sell knock-off designer clothing. Students and doctors tend to be the worst when it comes to InfoSec and if the IT folk aren't paying attention, the organization may well be a major source of spam. That does discount the malicious admins out there working for peanuts that sell access to their servers to spammers to amke some cash on the side (Hospitals and schools tend to pay their IT personnel quite badly, many working for not much more than minimum wage)

Re: "The new tlds have only worsened the problem."

And that would be why I've a script for my DNS servers that periodically grabs the root zone from the InterNic FTP site and removes every TLD longer than 3 characters (so the internationalized ones still work). So far, I have missed nothing of value.

Re: " force the spammers to spend a couple of days and change their domain names. "

The spammers are constantly building new domains and doing the warm-up procedures. They'll have dozens, if not hundreds, or domains at the ready.

From some of the reports I've seen, most spam operations will be cooking 20 or so domains at a time, building up reputations, so if one is found out, it is immediately replaced with another. One of the spam operations I've seen actually did so right in the middle of a campaign.

New prison law will let UK mobile networks deploy IMSI catchers

Re: how about..

"The solution is to use femcell"

I've always wondered why they didn't just blanket jail and prisons in a fine mesh, then implement a femto-cell within the cage. Set it up so that during the connection process it brings up a message stating that the local network is being actively monitored. Maybe just inform the person through a text message that the phone owner would answer:

"I consent, but check with me later",

"I consent and don't ask again"

"I don't consent, but ask again later", and

"I do not consent, never try to allow my phone to associate again"

With it being in a Faraday cage, people who do not consent to the monitoring aren't tracked and their phone just doesn't work while being able to track the phones of people who do consent. For people being held, they'd either have to consent to being tracked or to go without connectivity.

Toxic Uber sued after driver allegedly tried to rape passenger in car

"Jaquez remains an authorized Uber driver to the present time."

Why the actual hell is that guy not in jail? Sexual Assault is a serious crime, so what is wrong with Minnesota that a rapist can just go free like that? It wouldn't be hard to track them down, what with the Uber app tracking the location of their phone and the make / model / license plate number of the vehicle is known.

Pai, Pai, Mr American spy: FCC supremo rips up privacy protections for broadband punters

Improper to compare ISPs to Facebook / Google

A better comparison would be to compare an ISP to FedEx / UPS / DHL / Postal Service / etc. in that they are paid to move items from one place to another. Even if it is clearly labeled what is in the package, they cannot sell or give that information to a 3rd party without your consent, or at least inform you about it. The entity or sender can use the packages contents how they see fit, but they agreed to that (and there are laws governing that data sharing).

There is a big different between being an endpoint and being the communication medium. If I send a post-card home during a vacation, I might expect the recipients to suggest other places they've been, but certainly not from the letter carrier (which it is technically illegal for the post worker to look at a letter beyond what they'd need to deliver it).

I remember a court case from several years ago where someone mentioned drug use on a post card, the postal worker reported it, and the sender was arrested for drug possession. The defendant was then successful in suing the postal service for invasion of privacy.

Surveillance software boss thrown in the clink for cooking the books

Crap company, crap CEO

30 months isn't long enough for scum like this, not even 30 years is long enough.

New UK laws address driverless cars insurance and liability

Re: Appropriate

I figure that road would be painted with a special symbol indicating that driver-less cars can be used on it. Something certifying that it has clean and clearly painted lines, is on a maintenance routine to keep it usable, and that there aren't any blind corners. Maybe implement it as a QR-like code or something on the bottom of speed signs so that the vehicle would identify it, read its ID, download the appropriate information for that stretch of road. After it downloads the data, it'd do some processing to determine if it is capable of going autonomous safely. The vehicle will only go into automated mode when it has been determine that is safe to do so. A sort of positive control system.

I figure the signs would be good for a certain length of road with 'refresh' marked mid-way through that zone. If the car misses the refresh marker, it'd have enough time to warn the driver and return to manual mode before the stretch ended (EG, the marker is good for 10 miles with a refresh marker at 7.5 miles, so a driver would have 2.5 miles to regain control and start driving manually).

As for how it communicates, I figure that the manufacturers would be able to make the same deal that Amazon did to get free 3G service into its Kindle readers.

Finally proof that Apple copies Samsung: iPhone 7 Plus halts, catches fire like a Galaxy Note 7

Apple Parts, Samsung Parts...

...all made in Taiwan!

Phones nowadays end up using the same components, so an issue plaguing multiple phones isn't all that surprising. Both phones probably use the same exact Texas Instruments charging IC, or probably batteries using the same exact manufacturing process.

Mysterious Gmail account lockouts prompt hack fears

Happened on my edu account

woke up this morning to find my email address through my school required re-authentication. They had just migrated over to Google for hosting email.

Although looking at what happened, I think its that their infrastructure fell over and lost a large number of authentication data, so devices would have to re-create tokens.

Facebook scoffed at $500m damages. Now Oculus faces nerd goggles injunction

"Just a 1Kx1Kx1K volumetric display, 32 bits per voxel (you now MUST include the alpha element), updated 15 times a second will require 60GB (yes, gigaBYTES) of bandwidth to keep up."

No, that would only need to be what the rending device need to send to a display. A single DVI link is capable of 16 GB/s (3840x2160 x 32-bit color x 60fps) but the CPU only needs to send a few megabytes per second to the GPU to render that picture.

Besides, a 3D display like the one you describe wouldn't even need to that much bandwidth since it would only need to render all visible surfaces such as if you had a 100px cube, it wouldn't bother rendering all 1,000,000 pixels that make up the object, but rather just the 6000 px that make up its visible sides.

And even then, it wouldn't need to render all visible side if one is obscured by another object (like if that cube was on top of a simple plane). Bandwidth could be further reduced by tracking the location, angle, and focus of the user's eyes and only render the surfaces that would be visible to them, similar to how 3d applications / games currently work.

Yeah, the technology for it does not yet exist, but it isn't all that far away (May already exist in a lab somewhere).

Re: Why VR is doomed to be nothing more than a Niche within a Niche

Well, Apple already has a long track record with their Reality Distortion Field...

Sysadmin's sole client was his wife – and she queried his bill

My family doesn't even know I do IT work...

I've led them to believe that I am doing pharmaceutical research (My degree is in Organic Chem). I've seen too many of my friends end up losing sleep to help a family member fix something stupid, so I decided to hide my IT prowess.

I've been referring them to a friend of mine that still live in our old neighborhood and runs his own shop. I do work for him periodically to make up for the costs of supporting my parents. He is excellent at the most common 95% of problems, so I'll help him out with that last 5% or on jobs that require stuff that is out of his depth.

'First ever' SHA-1 hash collision calculated. All it took were five clever brains... and 6,610 years of processor time

This is why I use multiple hashes

Hashes are quick and easy to compute, so there is no reason to not calculate multiple hashes for the same data.

How much compute power would be required to create a counterfeit document that matches both the original's SHA-1 *and* MD5 hashes.

Since its so quick and easy to do, I've calculated the MD5, SHA-1, and SHA-256 hashes for everything important on my systems / network.

Intel scales Atom to 16 cores, updates Xeon SoCs

Re: Get into cars !!!

I'm a bit concerned about running safety-critical systems on commodity silicon...

I would much prefer that the vehicles run on a set of FPGAs running externally-audited VHDL code. There should be at least 3 such FPGAs running redundantly tied together with voting logic.

I would not feel comfortable trusting my safety to a piece of silicon that can be wedged by masking interrupts, then putting the chip into sleep.

More brilliant Internet of Things gadgetry: A £1,300 mousetrap

How about just mouse-proofing the home?

For £1,300 it'll be a hell of a lot cheaper to just go around the exterior of the house and fill in the cracks with silicone caulk and spray-insulation. Replace / re-attach the mesh screen with liquid tar (or whatever that glue is called now). Also, ensuring that the weather seals on doors and windows are in good repair and are of the right sizes.

As for the interior, put all your food into air-tight containers and make sure the trash receptacle is sealed. Do that for 1-2 months and any rodents inside would starve, getting rid of those. Although you should be sealing food anyway to keep it fresh.

Why spend £1,300 to catch mice in the building when it'd be cheaper to just fix the place to prevent them from entering in the first place. Plus doing those fixes would keep out insects, birds, other pests while helping to keep in heat.

Regular mouse traps exists because they are a cheap solution to the problem that sealing buildings can be expensive. But this contraption is more expensive than that problem, especially since you'll most likely need more than one of the damned things.

How's your online bank security looking? The Dutch studied theirs and... yeah, not great

But how does it compare to the rest of the world?

I'm willing to bet that that 6% figure is far higher than the majority of the world has managed...

Drop the F-bomb, get your coding typos auto-corrected

Re: The F*ck

My most common typo has to be "suod", "sl", "gerp", or the many other typos due to my left hand being just a millisecond slower than my right... (and in regular text: "teh" and "int he")

Java and Python have unpatched firewall-crossing FTP SNAFU

They call me mad

I work for a small bank (Well, technically a Credit Union). They built their original infrastructure on top of several old HP 9000/T520 systems. They also created an online-banking system on those systems as well. That infrastructure and online banking site is still fully operational. The whole thing works on HTML with content created by C-based CGIs (The CGIs generate the HTML based on the user inputs).

It's been running smoothly since 1995 with minor upgrades to support new security standards (All https, TLS1.2 with SSL disabled, a simple two-factor authentication system implemented).

It still baffles me at how often people over-design things to the point of becoming over-complicated, where half the infrastructure exists only to support the other half. So many times I see people metaphorically build a hydrogen bomb when all they needed was a fly swatter. At least that is what I tend to feel when I see public facing websites that obviously use something like Java to generate content (the payment system for Sprint even shows the Sun Microsystems Logo as the Favicon for the page...).

But then, a lot of the technology sector is now based on "because we can" rather than what would actually make our lives better.

Meet the chap open-sourcing US govt code – Paul, an ex-Microsoft anti-piracy engineer

What license is he going for?

I sure hope its something permissive like an adaptation of the BSD license. Something short and sweet that doesn't require a goddamn law degree to figure out if you can include it in your product.

"owing to national security considerations"

I hate that excuse more and more each day. Its the government equivalent of 'security purely through obscurity' bullshit that has plagued the technology industries for years...

European Space Agency slaps CC licences on its pics and vids

Copyright in space

this got me thinking, do copyright laws actually apply in space? What would happen if someone jammed a server into a satellite and started broadcasting data down to Earth? What about serving up torrents?

This also goes to a a question I've always had about software export rights in the US. An American cannot export encryption code to anywhere expect Canada if the code hasn't been licensed for export. But what about someone sitting in the US using an ssh session to a server elsewhere in the world, would that still fall under export restrictions? The machine with the code on it is in another nation that would allow export such data. What if the terminal session was done through a satellite repeater and the code happened to be sent to another country by someone listening to those frequencies?

I've always wondered about stuff like that. Especially since I like to write encryption software but I am, unfortunately, an American... Although the same could be said of security researchers writing multi-purpose code in countries that restrict "Hacker tools".

Surprise! HPE says nothing about ProLiant server hardware for SimpliVity OmniCubes

Re: @COG

And that is why I wonder why they aren't just building standard boxes with the FPGA / ASIC built into the storage controller. It's much easier to design and build storage solution in that case. It'd be much easier for them to just take an off-the-shelf DL380, pop the fancy RAID card into it, and sell it as a high-end storage system. Heck, then they could market the controller as an add-on for all the existing boxes they sell. Throw a 10/40-Gig NIC onto the card for replication, then you could cross-connect a pair of systems together and have a pretty resilient cluster with minimal effort.

For extra points, add a pair of M.2 or SD-card slots to the RAID controller to hold the OS.

They could cut down drastically on producing multiple chassis types as well as needed inventory.

But then it wouldn't be HP. Once the kings of the datacenter, now gasping for life as they drown under their acquisitions and mismanagement. Their downfall really started when they started making dozens and dozens of different products, with very little differentiating them, and never making any of them -good-. This applies to everything they made from laptop, desktop and printers; to their servers and networking devices; and even up to their blade servers and mainframes. Now with storage, they have their own MSA/VSA-series stuff, 3PAR, Simplivity, and then there are the ProLiant storage systems, which are just DL380s with an MSA-80 glued to the front...

"It will be interesting to see what HPE does with the OmniCube data reduction FPGA, with the potential there for a combined 3PAR+OmniCube ASIC."

Why not just cram it into their RAID adapters? But then they couldn't charge ridiculous premiums on special-purpose drive arrays. The only thing I see that Simplivity actually does is some fancy de-duplication and compression bits. And all that savings is pissed away with the mark-up on the hardware and the licensing bullshit.

For the last few years, I've forgone expensive arrays and went with some cheap SuperMicro 24-bay boxes, filled it with high speed / low capacity 120-GB SSDs, throw in a couple of LSI / Avago -4i4e cards with the battery backup and SSD cache modules turned on, and then stuck a 90-bay/4u JBOD array onto the back filled with 4 TB SATA disks. Comes out a hell of a lot cheaper than the Simplivity boxes I tried out, even performs better than them too. Also tested them against a bunch of the other storage boxes as well, like NetApp's and EMC's offerings. And with recent price drops, I've been able to use 240 GB SSDs and 8 TB spinning rust for a total of 4 TB of ridiculously fast cache and 600 TB of still pretty damn fast storage (Hard drives may be slow, but when you have 90 or them, it all adds up pretty quickly). At this point, the bottleneck is the PCIe bus coming off the processors...

Beeps, roots and leaves: Car-controlling Android apps create theft risk

Re: Why would anyone want to unlock the doors [remotely]

Whenever I park my car in a large lot or garage, I take photos of the space, then either direction in the row, then at the end of the row, and so on. I do this whenever I need to park my car in the long-term garage at the airport. I've never failed to find my car afterwards.

Before that, I'd use a notepad and a pen to write down the instruction to get from my car to the lift. Put the note into my wallet, then just followed the instructions backwards to find my car.

These techniques work for the largest parking garage in the world (SeaTac Airport) as well as many other parking lots I've used in the last few years, so there is no reason it wouldn't work anywhere else. I was taught to do that by my father during a family trip to Disney world.

Never once have I used an app to find my car (even after leaving it in a parking garage for 3 months).

People wonder why I don't get a new car

I have a mid-60's VW Beetle since I was a teenager learning to drive. Stuff like this only makes me want to keep it more and more. I paid $300 for it when I got it and probably dumped $3000 in parts into over the 15+ years I've had it (most of that was getting a new interior installed). If someone steals it, whatever, I got my money's worth long ago.

Yeah, it doesn't get as good gas mileage as a modern vehicle, but its not bad either. And then, there is figuring in the energy and resources that would've been used building a new vehicle, and then the cost of disposing of the vehicle once it reaches end of life. So with that, it is probably greener in the grand scheme of things.

The thing is painted bright orange (It was originally painted like the "General Lee" from the 'Dukes of Hazard', painted it orange to get rid of the flag on the roof and to fix the heavily sun-burnt paint). Makes it so vary easy to spot in a parking lot as well as easy to spot by the police if it ever gets stolen.

BT and Virgin Media claim 'broadband' tax will cost £1.3bn

Someone clearly doesn't understand the tax code

"it’s a backwards step to hike business rates"

Back in the 1950s it was quite common to have business tax rates in the 80-90% in western nations. However, your tax bill could be lowered by spending money in improving infrastructure (Which was the intent of higher taxes). In many cases (Not sure about the current UK tax code) you'd get a deduction of 1.1 Euros for every Euro spent on business expansion costs, and in many countries the ratio is higher. Beside, most tax codes also allow you to deduct the "retail" value of any improvements make, so they wouldn't even have to spend that much.

Its not like there isn't anything productive they could spend money on. They could spend a Billion Pounds on replacing all the corroding copper with fiber; replacing the broken antennas on cell phone towers; fixing their routers; investing in undersea links; anything really... And all that spent money will end up coming right back to them in the form of higher rates due to much higher speeds, more loyalty from customers, etc.

Smash up your kid's Bluetooth-connected Cayla 'surveillance' doll, Germany urges parents

Re: Thanks for nothing, TECHNOLOGY

Because now all the people that would normally create those technologies are salving away so they can just barely make rent on a crappy apartment (Just forget about the concept of paying for a mortgage nowadays...)

Installing disks is basically LEGO, right? This admin failed LEGO

Re: "...making firewall changes that cut off all their traffic..."

I'd add doing "rm -rf" on the root directory of a remote server.

Did that when deleting some old auto-generated status emails, ended up running "rm -rf / var/log/mail/" and hit enter before I realized the typo. Had to get the hosting provider to restore an old backup since there was no way I was going to fly 5000 miles to fix it.

Mystery deepens over Android spyware targeting Israeli soldiers

Re: Russia

The entity that wrote it doesn't have to be the one behind its use. Malware has moved towards more of a free-lance / contract model versus the old "Build your own team" model of yesteryear. This malware is probably built, under contract, by a software shop that builds legitimate apps with a side business building malware.

With a contracted model, the actual entity behind it would be completely anonymous so long as the contractor doesn't rat out their clients. Hell, they could be playing all sides and constructing malware for the highest bidder. They could run their own CnC infrastructure and just pipe the data to whomever is paying while using the same bit of malware to everyone.

GitLab invokes the startup defence to explain data loss woes

Re: Maybe backup your own stuff?!

Not defending lazy customers, but when you offer a paid-for service that includes backups of the data, you damn well better do some bloody backups. I could only forgive a company not backing up client data if they explicitly said that they aren't going to back up my stuff. Not backing up customer data is a stupid thing to do even from a business perspective since if the customers are responsible for backups and you lose their data, they are quite likely to just restore their backups to your competitor's service.

Re: Lucky!!

"What do you do?"

I would perform a full backup of the machine, confirm that the backup worked, then carefully construct the options I'm passing to rm (specifying the full path, running it with -i, prototyping it with using ls to ensure I am deleting the correct files). Then I'll have someone else look a the command before I finally run it. Nothing is so important that it can't wait a few minutes to ensure its being fixed properly.

I work as an IT Risk Auditor usually contracted by massive investment firms wanting a report on start-up companies before they risk millions on them.

I've found that a lot of start-up companies try to pinch every penny they can on the boring stuff like infrastructure so they can waste it on cultivating the kooky San Francisco Start-up image.

Had one company forgo purchasing tape drives and tape (as I suggested) and instead spent it on a new open-plan office just off Market Street. The tapes would've cost about $20,000 initially for drives and media, and around $500 a month afterwards for additional tape and off-site storage. The office, which only fit about 2 dozen people, cost them an additional $30,000 per month more than their previous, much larger, office in Reno (where everyone lived). I kept trying to reason with them that they needed something more than a couple of portable hard drives hooked up to their laptops (No actual backup software, just copying files manually), but they wouldn't hear it. I ended up recommending that the investors look elsewhere due to their blatant disregard for proper IT safeguards. But I should have suspected something when some representatives from the investment bank, my fellow auditors and I had a meeting with the company founder. He rolled in on one of those aluminium scooters 5 minutes late wearing a t-shirt with a suit printed on it when everyone else was wearing an actual suit and tie (myself included).

Another client blew all the money the Angel Investors gave them on a holding an insanely expensive employee meeting in Monaco, flying everyone First Class and renting out a massive night club and conference space in the resort. That and buying everyone ipads and iphones for personal use.

Each year, it becomes harder and harder to find a start-up that doesn't absolutely suck at IT, which also happens to be the start-ups that become ridiculously successful, get bought out by a large company and continue to thrive while netting the founders hundreds of millions of dollars in profit. The reckless companies end up failing fairly quickly.

Re: Lesson learned here ...

The lesson my company learned was to pony up the cash and build our own git servers. 4 modest 1U boxes deployed in two geographically separated datacenters (Amsterdam and Mexico City). Each box has a near continuous backup job to a massive SAN that is itself backed up to a tape library. The git servers replicate to a matching server in the other DC constantly.

At home, I installed Git onto an old Pentium-4 machine I had rusting away in the closet, it backs itself up to an AWS micro instance with a glacial volume attached to it.

That way I actually own my code rather than it being copyright of whomever owns the server like most of the online source repositories try to do. My code stay private and if it blows up and I don't have a backup, well, that's my own problem.

Rasputin whips out large intimidating tool, penetrates uni, city, govt databases – new claim

Re: they tried the stick?

Or do what my company did, all input is encoded in Base64 before getting put into an SQL query, the data in the DB itself is also base64 encoded. We did it to solve all kinds of problems. If you want your username to be "Robert'); DROP TABLE Students;--", go for it, all the query is going to see is "Um9iZXJ0Jyk7IERST1AgVEFCTEUgU3R1ZGVudHM7LS0=". We did this as part of an internationalization project so we can support other character sets, unusual names, or just other cultural oddities, the fact that it protects against SQL injection is just gravy.

Pwnd Android conference phone exposes risk of spies in the boardroom

Re: Android 2.3?

Funny enough, Windows 3.11 (and DOS 6.2.2) is still supported by Microsoft (if you have an agreement with them)... It was very popular for applications where you needed just a basic UI. I've seen it in automation systems, factory control units, point-of-sale terminals, ATMs, military weapons systems, and even Vehicle Control systems (Such as trains, aircraft, and passenger/cargo ships).

It was the perfect combination of features, customization, and size. I have an old system sitting on my desk with a customized version of Windows 3.11 burned into a bank of a PROM chips (16x 16 Mbit chips), 32 MB of Static RAM, a 10-BaseT network card, a 28.8k modem, 8 RS-232 compliant serial ports, a floppy disk controller with two drives, and a massive proprietary card (Three slots wide, and full length, has a couple of odd connectors on the back, no markings other than a hand-written serial number)

Toshiba chairman quits over $6bn nuclear loss

Re: Time for some <sarcasm>traditional</sarcasm> Japanese 'restoration of honor' at Westinghouse

Ah, a commentor with the handle "Fat Man" commenting on an article about Japanese nuclear energy while misunderstanding a foreign culture. I think I'm safe in assuming that you are an American...

Magic Leap sued for sex discrimination … by woman it hired to stamp out sex discrimination

There are two types of Start-up founders

In my experience working with start ups, I've noticed that their founders tend to fall within one of two archetypes:

1) Ambitious and driven folk that need to create their own company to create the product they want

2) Pathetic and self-absorbed assholes that set out on their own because no one wanted to be around them for long.

Pretty sure I know which category Rony fits into...

Google to cough up $20m after Chrome rips off anti-malware patents

"intended its invention to do anything other than protect ‘critical files’"

So they patented removing the 'write' flag from a file?

Worldwide bank attack blitz linked to Sony Pictures hacking crew

"The attackers appear to be using compromised websites"

There should be some kind of certification process required before a website is allowed on the internet. Even basic questionnaire would suffice, something along the lines of:

-Does the website run as root?

-Are any of the website's resources marked as 777 (Or anything else idiotically loose like that)?

-Are users allowed to upload files with +x permissions?

-Is the admin page accessible by everyone?

Any of those should be grounds for the website being denied from serving pages to the world. It bothers me how many websites out there are set up where the process serving pages is also granted permissions to modify the files it is serving or even files outside of the website's directories. Or in some cases, CGIs that run as root and have both write and execute turned on.

NORKS fires missile that India reckons it could shoot down in flight

Re: All automated, but..

If this missile is like any of the off-shoring companies I've worked with, their 'automation' is likely to be some college kid stuffed inside the missile guiding it manually.

I had to find a new off shore company the other day after finding out the one I was using was just using an intern to do the work manually rather than trying to build a script like I had requested. The job was to build 100 VMs for a test, but only 94 of them came back correct with the other 6 suffering from typos in their configurations (Typos that would be almost impossible for a script, but easy for a human to make).