Posts by Glen Turner 666

As RHEL clones hit version 10, Rocky and Alma chart diverging paths

The big ISOs contain all packages, for smaller download use network install.

A nice review, thank you.

On the download sizes of 8GB (RHEL) and 7GB (Rocky and Alma), these are for the ISO images containing all packages. The sort of installation which might be done for a machine isolated from the internet. A typical installation doesn't select all packages, and so the installed operating system on disk is smaller than the distribution's ISO.

For a machine connected to the internet choose the "boot" image. Say the image Rocky-10.0-x86_64-boot.iso, which is 817MB. After writing this image to a USB and booting from it. select the "Network install" path through the installer. Only the packages required for the type of installation requested will be downloaded. Better still, it will download the most recent of the required packages, so there will be no large update required after the installation.

Network installs are important, as that is the way RHEL-family installations are done for the many hundreds of servers in server farms.

The essential difference is that corporate installs have the computer boot the "boot image" across the network using PXE and TFTP rather than from the USB. Then the "kickstarter" facility provides pre-canned answers to the network install. The network install typically uses a copy of the package repositories located on a web server within the organisation, rather than across the Internet to Rocky's servers.

The "kickstarter" approach also allows the equivalent to Window's "slipstreaming". Example Corp creates its own package, say examplecorp-server. That package lists as dependencies the organisation's baseline of packages to install. The second-last command in the kickstarter configuration installs examplecorp-server (and its automatically-determined dependencies); and the last command runs Ansible to apply the corporate configuration to packages. This technique has two nice outcomes: (1) the first boot of the machine into the new operating system has it fully up-to-date and fully-configured, there's no race against malware; (2) the machine is fully described in Git (where the DHCP, kickstarter, examplecorp-server.spec package definition, and Ansible configurations are maintained). Therefore the only data which needs to be backed up is user and service data, not umpteen copies of the operating system. It typically takes 20 minutes to automatically install and configure up a new server after it is powered on.

Open Source Initiative defends disallowing board candidate after timezone SNAFU

why use a timezone?

Which is why so many conferences give deadlines as "anywhere on earth".

Techie left 'For support, contact me' sign on a server. Twenty years later, someone did

Y2K

There was a rush of these in the lead-up to Y2K. Minions from the Big 8 (as it was then) accounting firms contacting me and asking me to warrant that freeware I had written back in the 1980s was Y2K-compliant. Sometimes they'd accompany that with a request to sign a legal document saying the software was Y2K-compliant, and if that warranty was faulty then I would have unlimited liability and indemnify the losses of the Big 8 firm. In the end I had a form letter I'd send back, basically a quote for consulting services to determine the status of the software, which they never took me up on.

Datacenter CEO faked top-tier IT reliability cert to snag $10.7M SEC deal, DoJ claims

You absolutely have to go through a datacentre yourself with a checklist. Certifications fail to capture some important aspects of datacenters -- car parking, ability to take deliveries in a sane way, billing structures for cross-connects and other ancillary services. Marketing materials often refer to the completed state of the datacentre, which might take several years to achieve; the current reality can be much more sparse.

One datacentre I looked at had rooms for the second set of generators, but no generators installed. You need to walk the site, viewing every feature of the datacentre in their marketing, and every requirement in your RFQ.

Opening up the WinAmp source to all goes badly as owners delete entire repo

Working in a multi-OS development, Git does it right. Otherwise there will be lots of commits which do nothing but change line endings when diffed. And CI chains which work fine, right up until a commit from a rare operating system. Githouses need to understand line endings somewhere -- either when the commit arrives, or when handling the code base, such as showing differences, annotating lines with the last change, etc. There's a lot more tooling than just editors. I'd rather than file mangling happen once at commit rather than in every item of tooling.

SBF's right-hand woman praised for testimony – and jailed for two years

Re: Question to the knowledgeable

She will be allowed to take receipt of the funds. But there's a catch.

Although the criminal litigation against her has concluded, her guilty plea opens the door to civil litigation from people at Alameda who had losses. So there will be little chance she will keep income in excess of her requirements for living.

Intel thinks it's got a final microcode fix for recalcitrant Raptor Lake processors

Re: ARM chips are every bit as complex

You are arguing that a problem with thermal management is more complex in Apple Silicon ARM chips of much less thermal dispersion then the Intel chips; and arguing that the clock tree of Apple Silicon ARM is as complex as Intel despite the smaller silicon area needing to be serviced for Apple Silicon. You'll excuse my doubts.

House to grill CrowdStrike exec on epic IT meltdown... no, not the CEO

Re: Blame Microsoft, not Crowdstrike

What Crowdstrike was doing -- intercepting system calls and analysing combinations of those for malware behaviours -- was innovative. Thus there were no operating facilities, and a hack to use a device driver to gain access into the kernel of the operating system had to be used. That device driver would offer functions to loadable programs which did the sensing and analysis -- an architecture not too different to IBM mainframe "channel programs" to do I/O, and thus Crowdstrike "channel files".

But this doesn't let Microsoft off the hook. After this initial period of experimentation, and after creating its own endpoint detection software, there should have been proper operating system support for these sensors and analysis. Then the device driver -- with its excessive access, and a security issue in its own right -- could be replaced.

Offering a operating system facility would also have removed the largest problem with channel programs: the need for their runtime not to fail, the need for a perfect compiler. Operating system facilities get far more testing, and denial of service opportunities taken far more seriously, than in a third-party device driver. As it is, Microsoft and Crowdstrike have no choice now bit to build robust operating system support, because every item of malware is going to be looking at leveraging endpoint detection and response systems.

Elon Musk’s Starlink won't block Elon Musk’s X in Brazil, as required by court order

It's likely a threat to use an Investor State Dispute Settlement in a country where Brasil has a trade agreement.

US judges are also far too keen to hear extra-territorial disputes. And if Brazil lose (even by default such as not showing up) and don't pay because they don't recognise the jurisdiction of the US court, then Musk could ask the US court to cease goods belonging to Brazil which are located in the US.

The thing to remember here is that Brazil cutting off X is not a whim. X was outrageously involved in the cultivation of fake news to bolster attempts to overthrow the elected government.

So Brazil isn't backing down. Any penalty Musk might arrange for Brazil will have an immediate effect on Brazil - US relations. At a government level. But also at the level of ordinary people.

Kamala Harris's $7M support from LinkedIn founder comes with a request: Fire Lina Khan

Money to open doors

Harris will win or lose without Reid Hoffman's money. So this isn't bribery -- Harris is hardly going to be swayed. This is to create obligation should Harris win, the open door available to a "donor" to have their issue heard. But having heard Hoffman out, Harris's administration may well say no.

Is this a corruption of the political process? Well yes. The average citizen wouldn't get a hearing from a new administration, they've got too much else happening.

Microsoft CEO of AI: Your online content is 'freeware' fodder for training models

"freeware" licenses

Even freeware has licenses. It's plain that Microsoft are not adhering to the GPLv2 when incorporating my programs into their training data.

It looks a lot like VMware just lost a 24,000-VM customer

Re: What is their strategy with their new, smaller, customer base?

KVM is a VM facility in the Linux kernel -- the "kernel virtual machine". Each VM appears as a Linux process, just like running any other program. There are user space applications which then use KVM to implement virtual machines for various user bases. The most common is Qemu. That in turn has front ends, from the desktop GNOME Boxes through to industrial systems like OpenStack. These front ends funnel through a common VM management library -- libvirtd -- which greatly simplifies debugging provisioning faults.

Using a 'real' operating system kernel, rather than a 'hypervisor' kernel which only runs VMs, is seen as advantageous. Since each VM appears as a Linux process, a lot of existing Linux tooling can be used. As a result the management of KVM can seem sparse, in reality for some purposes you use the same management tools as for other processes -- such as network alarming and collecting performance data for capacity planning. Sometimes a VM-specific tool is needed. Often this tool works through libvirtd, making it possible to use one vendor's tool to control another vendor's VM. Many of the technologies for managing Linux containers to also be used to manage Linux VMs, such as Kubernetes and Terraform.

Why Nutanix's KVM product rather than another KVM product?

I would be interested in their consideration or otherwise of other products which use Linux's KVM to implement VMs. Say, OpenStack or Proxmox VE with Kubernetes and Terraform for orchestration and provisioning. Such a choice could drive their software acquisition costs to not much above the training budget if the base Linux was Debian (a common enough choice by cloud vendors). Maybe they feel they need paid support? In any case, the reasons would be interesting.

GCC 15 dropping IA64 support is final nail in the coffin for Itanium architecture

Re: "celebrated industry diplomat Linus Torvalds"

Linus has been diplomatic for much of his career. A reason Linux took off the way it did is that getting a bux fixed in a Linux system was far easier than getting a bug fixed in BSD Unix. Sure BSD eventually fixed that, but by then it had lost the opportunity to be the major '386 Unix.

There was a period where Linus was far far too blunt for the size of the community which had grown around Linux. Force multipliers like fan channels and the trade press meant that previous behaviour was now amplified into being unwelcoming. But Linus is no fool, has demonstrated personal growth throughout his career, and got on top of that issue.

In this case, Linus was diplomatic. His offer was generous, and whilst he didn't expect it to be fulfilled, it was a clever way of demonstrating the actual resources available to maintain a Itanium port (ie, expected to be zero).

Malicious SSH backdoor sneaks into xz, Linux world's data compression library

Re: It Was In Debian Unstable --- *buntu LTS

The "system does appear to work" is too much. It was the merest fluke this issue was found, relying on the availability of one Microsoft employee to do their micro benchmarking of Postgres performance.

The system certainly did not work in getting the Xz maintainer the help they needed. This after the measures taken for the same issue in OpenSSL. So that part of "the system* also failed.

There is a lot of micro failures. Hand waving commit messages. Procedural code in build systems. An integrity gap between a git repo and a tarball. Binary test files.

That's without the whole issue of how to monitor the behaviour of developers. This wasn't the first subversion they had tried.

There is a lot to take away from this incident. That things can keep working as they are is not one of them.

That runaway datacenter power grab is the best news for net zero this century

Living in a world without project management concerns

"So imagine if the world's datacenter industry got together – yes, a fantasy, but these are needful items - and issued a specification for a standard, modular, small nuclear power plant." That's not a promising outlook. Take the Rolls Royce PWR3, an adaptation of GE's S9G. Even those small variations in specification have made the project five years late, mostly because of delays in construction of test facilities. Moreover, it's not just a specification which is required. Most of the infrastructure for the development, test and maintenance of these plants is at classified facilities which are unable to accept commercial tasks. So the datacentre industry would also be paying for a building and staffing programme for all of those facilities. The small design means that there is only limited opportunity for re-use of test facilities designed for larger commercial plants.

All this delivery risk is occurring when solutions to power generation for datacentres are needed within a short timeframe.

If latency is unimportant -- as the author claims but I doubt -- then there's a far simpler solution: build a global ring of datacentres to operate at times of local peak PV solar.

LibreOffice 7.6 arrives: Open source stalwart is showing its maturity

Re: long-form writers...

Sort of. Book publishers want material in Word format, but they don't want material which uses Word features. As simple example, one wants to see bold text as ***BOLD***example***BOLD***. The killer feature of Word is change tracking, allowing a back-and-forth of chapters with the copy editors, discussing any contested changes.

In my personal experience, the issue with using LibreOffice with professional publishers isn't the integrity of the .docx formatting (because there is none), but the round-trip integrity of change tracking.

The reason for this odd use of the Word format is that the pubisher will then mark up the text, get diagrams professionally redrawn, and flow them into a desktop publishing package which works like Scribus, usually Adobe's InDesign. But the publisher wants to do that, as then they can lay out the book according to their corporate look and feel. They don't want glitches like the text in the corporate choice, but the bold text in Arial.

Obviously if you're doing your own publishing, then LibreOffice and Scribus are a fine combination. You can even re-work any diagrams in Inkscape.

The big strength of LaTeX is that it sufficiently separates the content from the format so that a corporate format can be applied and the pages generated with very little work. That's why it's still widely used in engineering academic journals.

ICANN warns UN may sideline tech community from future internet governance

Re: So ICANN

Although I can understand that attitude for ICANN, the regional NICs are another matter. It's difficult to think which organisation other than APNIC would be representative of the Asia-Pacific internet technical community.

NASA mistakenly severs communication to Voyager 2

Re: Off topic

300bps was not adequate. Even for grown-up text. With a start bit and a stop bit, 300bps conveniently converts to 30 characters a second. Or under half of a 80-column line. Of a 24-line display. In practical terms, that's 30 seconds to display the 1st ed UNIX manual page for the 'cat' command, a manual page of twelve lines.

Local terminals were attached to the computer using RS-232 running at 9600bps. In practice that was fast enough for a full page refresh in about a second.

Australia to phase out checks by 2030

Cheques are so dead that there are a lot of uncashed cheques in Oz

Cheques have become like corporate gift cards. If a company owes a lot of people money, say they've overcharged like so many insurance companies did for the past two years, then they'll send cheques because the company knows full well that they won't be cashed by 100% of recipients.

Judge grants subpoena to ID Twitter source code leaker

> GitHub said it treats each fork as a distinct repository that must be identified separately

Which makes sense from a legal standpoint. Not all repositories marked as a "fork" may be infringing, as the fork may have happened before the claimed infringing code was added to the repo (as a trivial example, an un-updated fork of the initially empty repo is not infringing). So only Twitter can say which repos it claims are infringing; Github cannot read Twitter's mind, and the law doesn't require it to try.

Twitter also needs to be careful which forked repos it claims are infringing, particularly for private repos. It should not be assumed that the Twitter code is itself in non-infringing, and including a party with an infringement counter-claim could be devastating. So Twitter's lawyers are obviously going to be cautious in adding additional parties.

Risk-averse Kyocera gambles nearly $10b of own shares on semiconductor growth

Kyocera do ceramics, and things which use ceramics

Kyocera basically do what it is on the tin -- Kyoto Ceramics.

Kyocera got into laser printers via ceramic components in the high-temperature fuser unit. Kyocera got into kitchenware via knives via ceramic blades. Kyocera got into smartphones via ceramic speakers, which are now the norm across all thin devices from phones to TVs. Their newer rugged phones use the entire front glass as both a speaker and a tissue conduction actuator (which means you can use the phone without removing hearing protection, just hold the phone touching the earmuffs).

Basically the company makes components and if it sees a hole in the market it is selling components into, then it fills the gap.

Elon Musk to step down as Twitter CEO: Help us pick his replacement

Twitter already has engineers from SpaceX, so why not a CEO too?

Since Musk always seems to make the worst choice with no consideration of the future, the new Twitter CEO will be Gwynne Shotwell, the Chief Operating Officer of SpaceX. She will do a fine job, just as she has done with SpaceX. Meanwhile, at SpaceX, the only Musk organisation so far untouched by this rolling disaster....

Janet Jackson music video declared a cybersecurity exploit

Chain printers too

People used to do this with chain printers.

Those printers rotate a chain containing characters at high speed past 132 hammers. As the character to be printed passes the hammer, the hammer strikes the chain, the chain then punches onto the paper via the inked ribbon. With each hammer strike the paper advances one line. This gives about the quality of text you'd expect. But they were fast, since they printed an entire line very quickly.

With rotating chains, hammering and paper being pulled through at a high speed, these printers were open to all sorts of physical nastiness by people carefully choosing text to print. Beginners would fire all hammers at once, experts would fire them all, wait, and fire them all again, and maybe throw in a page feed, to initiate a harmonic rocking of the printer. The godlike could time hammer strikes to make the chain temporarily halt, leading to a sideways rocking of the printer.

Elon Musk puts Twitter deal on hold over bot numbers claim

With the fall in the stock price of Tesla, the cost of Musk's funding for the acquisition of Twitter has risen -- Musk will need to stake more of his Tesla shares to purchase Twitter. One way to address that situation is to require less funding in the first place. Raising doubt about Twitter's number of users and the level of misuse of the platform are both ways to do that.

Why the Linux desktop is the best desktop

Re: Linux "Desktop"

Linux has equivalent -- and better tools -- they are just different enough that they're not on the radar of people looking for a one-for-one branded replacement.

Group membership in Linux is easily enough driven from LDAP. Red Hat has a nice sssd wrapper around that set of technologies.

Group policy is more often then not used as a proxy for configuration control, and under Linux you do that configuration control directly. Ansible is the weapon of choice. This has the huge advantage of allowing the 'playbooks' to be stored in Git. Which means that there's far better administrative and audit control of changes then done with Group Policy. That's why AD is the #1 goal of hackers, because change there is organisation-wide and auditing isn't done because the mechanism is too difficult. Compare with Git pumping Git summary lines and diffs of Ansible playbooks (and thus enterprise-wide machine configuration files) into a Slack channel for continual casual review by the operational staff.

Linux tends to pull forward cutting-edge security technologies. The machine I am writing this on runs Secure Boot, to an encrypted drive based on a key in the TPM, with all system executable files and libraries under Integrity Management. It remotely logs to a server analysing activity for misuse patterns -- exactly the same software as used for our big internet-facing servers. Login requires a Yubikey to be inserted, if that's removed the screen locks. Windows is catching up, but in a typically Microsoft way -- using these desirable features to push their sales agenda, so use of a WebAuthn key requires cloud authentication rather than site-hosted AD.

Network equipment lead times to remain painfully long into 2023: Gartner

Gartner was very timid

I think Gartner could have gone further. Although I do understand that even suggesting some vendor-independence is contrary to the way enterprise works and to some of Gartner's revenue.

Firstly, to warn of vendor lock-in via element manager software. If you'd chosen to do your switch port provisioning via generic tools -- say, Netbox and Ansible -- and monitoring via one of the good open SNMP platforms -- say LibreNMS -- then picking up whatever switching hardware is available doesn't raise massive integration and ongoing cost-of-management hassles.

Secondly, to fill out the suggestion for x86. A lot of 'appliance' middleboxes which do packet manipulation are already x86 underneath. There can be large savings in making that explicit. There's a spectrum of choices, from firewalls in VMs, to proprietary software in containers, to generic tools in containers. The state of the art is Linux's XDP software and the fd.io VPP software. Both of these will do high-touch packet manipulation at high rates (over 10Gbps on a modest server). Both can be run in easy-to-manage containers with little performance hit by selecting network interface cards with the SR-IOV feature.

A real cost of moving is in the firewall rules: and again avoiding firewall-specific element management can pay off (added to which, most firewall element managers lack sufficiently powerful storage of firewall rules: lacking auditing of change, a lot of them not even able to carry a JIRA issue ID to identify why the rule even exists; and lacking the abilities of modern configuration management like Git, such as to remove a faulty rule some months old without disturbing the changes made since). There's a lot to be said for maintaining the firewall rules off the firewall, in a YAML file, with symbolic names rather than IP addresses, and then 'compiling' that down to the vendor's format via a continuous integration job which then stages the change into Ansible.

Running a VPN server on x86 is another task best made explicit rather than using an appliance. By running the VPN server explicitly you can divorce it's authentication from corporate user authentication -- replacing corporate passwords with corporate-issued tokens or keys. Then losing a phone or laptop doesn't leak that all-powerful password in some configuration file somewhere. A password loss via client VPN software appears to be the say the Colonial Pipeline was hacked -- that password didn't just allow access to the VPN the say a token might, but onto servers within the network too. Running your own infrastructure also allows multiple types of VPN -- say OpenVPN and Cisco IPsec -- which then allows the use of the VPN clients provided with the device. Avoiding the installation of client VPN software is a substantial saving of helpdesk hassle. Back those VPN servers with a firewall and a Zeek instance to do intrusion detection and the result is as secure as the vendor offerings, easier to use, and runs much faster (because it can be run on this years' x86, not one from 5 years ago packaged into an 'appliance').

Thirdly, these 'some assembly required' systems don't bit-and-dime additional features. If you want active-active or routing protocol support then the questions are technical and management rather than financial -- is resilience best done with load sharing or with a proxy or with anycast; is the added complexity of a routing protocol worthwhile? There are so many firewall pairs configured as active-passive which would be better configured as active-active with a routing protocol, but the clients can't afford that 'added value' solution from a vendor.

Gartner doesn't often give the strengths of these 'some assembly required' solutions. Which is weird as they have massive mission-critical use by the FAANG networks. I would speculate that perhaps those analyses don't look beyond vendors who promote products, to investigate the full range of heavily-used software.

Worst of CES Awards: The least private, least secure, least repairable, and least sustainable

unintelligible random sound from person in bed

> "This is a device that you put next to your bed, that if you make an unintelligible random sound, turns on and starts listening to everything you say," Doctorow said

He means sex sounds and Amazon recording sex, right?

MySQL a 'pretty poor database' says departing Oracle engineer

Re: There is no reason not to choose Postgres

"The biggest impediment on those two vs Excel is recreating the environment"

Have a look at Juypter Notebook. It's a cloud-hosted web presentation of Python, R and other languages in a "engineering notebook" style. To recreate the environment you just log into the page again. It's excellent for a quick analysis, since if you have to return to the analysis later then the data exploration you did is presented in a narrative, making it easy to track what you were thinking at all those months ago.

Juypter has very quickly become the weapon of choice for analyzing science data.

Typical. Crap weather halts work on subsea fibre-optic cable between UK and France

Re: Tunnel

The rights to place or use fibre in the Channel Tunnel are exclusive.

Microsoft does and doesn't want you to know it won't stop you manually installing Windows 11 on older PCs

Not removing authentication, but removing authentication which uses passwords and replacing it with something better.

This is good: passwords are no longer fit for purpose. People simply can't think of ten mathematically-random characters for every website they use.

Rather authentication uses an attribute of yourself: such as fingerprints or face. And maybe a button-press to signal that you do mean to login.

Asahi Linux progress: Apple Silicon OS works – though it's 'rough around the edges' and has no GUI acceleration

Re: Warantless

Apple have been upfront about the way they scan user's phone content, and that's not a backdoored CPU.

If you disbelieve Apple's description, then if anyone is going to find unexplained mailboxes to secret off-board processors or to find missing CPU cycles, then it's this very project.

Documentation of CPU functions doesn't help solve your concern -- Apple can simply not document the CPU functions which concern you. What you want is forward- and reverse-traceability from requirement to implementation. So you can prove that there's not a single gate in the CPU silicon which can't be traced back to a requirement. This is expensive and isn't offered outside of cryptographic processors.

The difficulty in providing a design is trustworthy is so hard that it's unlikely that any commodity CPU would meet this level of trust. It's just too easy for chip fabrication tooling to add covert CPU gates or chip initialisation code to your design. Similarly in verifying that the semiconductor fabrication mask doesn't have covertly-added etching. Bunny Huang goes through this in some detail in his effort to build a trustworthy laptop.

VC's paper claims cost of cloud is twice as much as running on-premises. Let's have a look at that

There's more choice for us folk who aren't a16z startups

Casado and Wang are talking about startups. A particular sort of startup -- a Andreessen Horowitz client, with a lot of venture capital cash and with lots of compute and storage at the core of what they do. In that case, the $1k/sq.ft to pay for a datacentre build can be funded from opex savings from cloud. They are simply paying a cloud vendor that much.

Quinn's counterpoint is really about venture capital too. His argument is that first-to-market is everything for these types of startups -- that promise of future monopoly profits is *why* Andreessen Horowitz is giving the startup those truckloads of cash. Everything is secondary to building market share, even if that's paying too much for compute, because stopping to re-engineer compute is worse. Quinn's other argument is also very Silicon Valley -- the shortage of "good" people, which really means engineering staff across the current Silicon Valley toolset who live on the US west coast.

This is such a peculiar environment that lessons for those of us outside of the hothouse aren't that applicable.

For a start a more typical business might be more interested in cloud applications rather than cloud compute and storage. There's certainly cost savings in cloud email and specialist applications such as accounting, HR systems, payroll, and client relations.

Secondly, us mortals have a range of choices between the extremes of DIY datacenter build and cloud. There's a lot to be said for the midpoint of hiring racks in a datacenter, and then arranging two diverse dark fibre services to that. There's also a lot of be said for taking the lessons of the cloud, such as easy to provision VMs and containers, and making that available via corporate infrastructure -- in other words, OpenStack.

'I put the interests of the country first': Colonial Pipeline CEO on why oil biz paid off ransomware crooks

Re: I Regret that I Have Only One Country to Give for My Money!

The CEO said that their finance system just came back online this week. So they're obviously happy to run the pipeline first and work out the bills later.

It was the production supervisor who used their "stop work" power to halt the pipeline, without reference up the management chain. The supervisor did this because a hack of the SCADA systems which control the pipeline could kill people across the east coast of the USA. When the pipeline was shut down it wasn't clear if the ransomware had got that far, but the production supervisor simply followed the firm's safety policy that people matter first and acted to minimise the risk to people.

As for recovery, that's a fair argument. The pipeline was restarted manually. Using the expertise of long-serving employees from the era when manual operation was the norm. Many of those employees are near retirement age. The CEO said to the Senate Committee that they'll make manual operation part of training going forward.

It took until two weeks after the incident for Mandiant, the contractors Colonial employed, to determine that the SCADA system hadn't been affected. So it's unreasonable to think that someone at Colonial could have made that decision shortly after the ransonware attack. There's a lesson there for SCADA software developers -- it shouldn't be that hard to determine the integrity of the software.

[The facts above are from the CEO's evidence to the Senate Committee, the interpretation is mine.]

Re: Er ...

A "complex password" can't be brute-forced. So the password was picked up from the configuration of the VPN client on an employee's laptop. That's most likely because the employee's laptop was hacked and that VPN configuration file was one of the files exfiltrated and then offered for sale on a darkweb site.

Later evidence by Colonial's CEO mentioned locking accounts of departed staff. That might be a generic suggestion, or it might be a hint.

The main VPN used by the company already had 2FA. So there's also a lesson here about withdrawing old services, and in making sure replacement services fulfill the full range of requirements so that old services can be withdrawn.

Free Software Foundation urged to free itself of Richard Stallman by hundreds of developers and techies

Re: want to control what everyone is allowed to say or think.

> He hasn't harassed any women though to my knowledge.

Women employed by FSF gave examples of their harassment on Twitter yesterday. Some women who worked in the vicinity of Stallman's office at MIT gave examples of their harassment in the leaked CSAIL email thread of September 2019.

Across decades, many senior staff at FSF and other organisations have had in-depth discussions with Stallman about his behaviour. Again, yesterday's Twitter has examples.

Stallman's defence of Minsky's sexual assault of Giuffre at Epstein's residence was the last straw -- the catalyst -- rather than sufficient reason of itself.

That the Board of the Free Software Foundation would welcome back Stallman -- there are no words. The threat to the FSF's own staff would alone be ample reason not to do it. Which is why so many other free software organisations are cutting ties with the FSF.

Australian police suggests app to record consent to sexual activity

Re: Of course policeman is thinking how to solve the problem

The world deals with "A said, B said" all the time.

Every day insurance companies pay out on your assertion that you owned a good which you now don't have, even despite claims of the likely thief that they didn't nick the item. You can see that for property we've built an "alternative justice system" for property theft to make this crime less traumatic for its victims. The question is why we haven't done the same for cases of sexual assault. Despite many sexual assaults being less suited to the criminal justice system than property crime.

Before we go any further, most sexual assaults aren't A-said, B-said. It's common for one of the parties to have a great deal of corroborating evidence, often across some years. Unfortunately it's rare that this is treated as evidence at the time. If a friend discusses an assault with you, then do them a huge favour and make a note of that discussion.

In the criminal court case you have have at the top of your mind the issue comes down to what sort of evidence is allowed. For example, what is the weight for arguing supporting evidence, is tendency evidence permitted, how difficult is it to join cases. There's still a great deal of double standard in dealing with evidence in sexual assault cases: take alcohol, when a victim is drunk that suggests their evidence is less reliable, but the same argument would never fly for the questioning the assailant's denial. Joint cases is even worse: two women discussing the same experience with the same assailant and then going to police to prevent further harm by this assailant is a prosecutorial disaster: the defence will argue that there was collusion to make a false accusation. An argument which would never fly if the occasion was two businessman in casual conversation discovering a fraudster in common.

The bar for a criminal finding of guilt in a sexual assault case is very high: the High Court of Australia in Pell v The Queen said that sufficient doubt was created by the mere habit of the accused Pell standing on the steps of the church after services, and thus likely not in the sacristy raping the boy. This was sufficient to defend against the boy's excellent recollection. The defence didn't have to show that Pell was on the steps on the particular day in question: testimony from witnesses who saw Pell on the steps a few times that year was sufficient.

So it's pretty plain that the full process of the criminal law is a poor fit to most people's experience of sexual assault. Some alternative path to justice -- not necessarily outside the criminal justice system -- is needed.

'Meritless': Exam software maker under fire for suing teacher who tweeted links to biz's unlisted YouTube vids

Proctoring software, unreliability coupled with high stakes consequences

A common configuration for "online proctoring" software is that being "flagged" by the software halts the online exam. This supposedly prevents people blatantly cheating and selling the exam answers in real time.

Even more moderate conditions still suck. If the software flags the student and then the exams invigilators check the recorded video, and then allow the exam to continue, that's a time penalty which may result in marks lower than the student's actual knowledge and skill.

If the proctoring software fails, then the student's examination is invalid. Putting that another way, better pray your operating system is no good at detecting malware-like behaviour.

Proctoring software usually objects to other people in the room. Students can't reliably take an exam from a public library, or from a share house, or from a room with popstar posters.

The software objects to the student's face leaving the camera's frame. Better not drop a pencil, be harassed by your little sister, knock the laptop lid.

The software does eye tracking, the idea being to detect use of notes. Better not sneeze.

Some proctoring software fails to detect people present when their skin colour has insufficient contrast. Got to love that the "systematic racism" here involves two meanings of "system".

For high-stakes exams the invigilators will often want the laptop's camera taken on a tour of the room. Bedrooms are sometimes too complex a space to pass this inspection. Of course students don't know this until just before the exam.

The presence of proctoring software increases the stakes of already high-stakes exams for students. Why a university would choose to do this -- rather than rapidly redesign assessments -- in the midst of the most demanding teaching year since 1939 says a lot about the relationship of the university to its students. It's also a great illustration that education isn't only what is said in the course.

How do you fix a problem like open-source security? Google has an idea, though constraints may not go down well

Comment on paper

It's interesting that this proposal is a one-way street.

If I buy a Google phone I cannot build my own copy of the complete source code, obtain the identical binary outputs, and so verify that Google's build systems have not been subverted.

The paper's suggestion that there should be assertions about the software process is excellent -- are all commits signed from a hardware key with a SAK keypress -- that sort of thing. But again, why is this limited to open source software? If I am giving someone money for software surely that's more reason to be provided with assertions about the integrity of the source code and build system. At the moment all we get from commercial vendors is unverifiable bullshit -- right until their security issue SolarWinds was claiming that their software processes were best practice.

There's also a substantial amount of cost-shifting in the proposal. Distributions, such as Red Hat Enterprise Linux or Google Android, have substantial income to fund housekeeping tasks such as backporting bug fixes. But the paper proposes to move this expensive task to free software authors, who often don't gain much income from the infrastructure library they authored. This is a task made more expensive by Google's reluctance to share with developers in a timely way its fixes to the open source packages Google uses.

The notion of federated identities for software developers could very easily degenerate to Google authorising software developers. It won't be too long before the intelligence-security apparatus removes entire nationalities from the 'critical infrastructure trusted' community: they're unlikely to accept a Russian national. But this in turn means that Russian nationals discovering security issues will be pushed towards engagement with the malware firms surrounding the FSB.

And again this is a one-way requirement. I cannot obtain the identities of each individual who has contributed to the code on my Google phone. Let alone attributes of those identities such as nationality, criminal record and prior employment. I am required to trust Google's hiring processes.

In short the paper has some good ideas -- unsurprisingly since they are common in the discussion around SolarWinds -- but has well underbaked the development of those ideas into policies.

Apologies for the wait, we're overwhelmed. Yes, this is the hospital. You need to what?! Do a software licence audit?

Hospitals would be attractive for software licensors as they are still open and, notoriously, working at capacity. An audit of software licenses of a shuttered business is more likely to find compliance -- the server and desktops might even be turned off.

It is the software licensee who does the grunt work of collecting the data for the audit. In a hospital context, the hospital's IT staff. An audit is not letting someone in the door and saying "hope your PPE is good", as delightful as that would be. The licensee's staff are safe, working from home, and writing e-mails with references to the contract clauses about software audit obligations.

The cost of an audit to the licensor is low. Basically an e-mail, some administration, and the customer relations staff giving a not-at-all-meant apology.

Whenever I have pressed a software vendor on their audit clauses the sales team have always responded that the clauses would be used "responsibly". That's clearly not the case.

Personally, a software licensor requiring a hospital to do a compliance audit in the midst of a pandemic would, in a better world, have the government solve that issue by issuing a statutory copyright license.

Crowdfunded Asahi project aims for 'polished' Linux experience on Apple Silicon

Re: I don't see why Apple would stand in the way of this

Apple sells around 18m laptops a year. Support for Linux would not increase sales by even a percentage point.

The attraction for Apple in allowing Linux (that is, allowing non-secure boot) would to be to avoid entanglement in accusations of monopolistic practices by US hardware and software manufacturers, practices the EU has been traditionally keen to prosecute and China may be increasingly keen on pursuing.

Microsoft is designing its own Arm-based data-center server, PC chips – report

Re: How many companies have to fail at server-side ARM64 ...

What has happened is the major buyers of sophisticated CPUs -- the cloud companies -- want performance per watt as well as performance per rack unit.

Compare the resulting pricing for AWS: Intel US$4.08ph, AMD $3.70ph, ARM $2.18ph. Graviton2 is about 20% slower than the equivalent Intel server, but about half the cost. Remember this is the second release of Amazon's ARM design up against the decades of tuning of Intel's design, and the difference is only 20%. Obviously that difference has further to shrink.

Other cloud providers will be facing similar pricing, but with the advantage that they use more of their compute cycles for their own services. That is, they can more readily re-target their internal services from AMD64 to ARM64 than Amazon's clients can.

I can't see that any company will take the risk of developing a server ARM chip. As you point out, plenty of startups have been burned. So the market will leave that development to the cloud providers themselves, who have abundant engineering resources to turn ARM IP into silicon.

The major difference between now and the past is Intel's years-long failure to deliver process improvements compared with its competitor TSMC. There is little reason to expect that to change. That failure alters the economics for cloud companies. In the past chips with better architecture would have their performance blitzed by Intel's process improvements. DEC's Alpha being an excellent historical example. So there was no incentive for cloud companies to explore CPU architecture. That blitzing-by-process-improvement is no longer in Intel's power to do. An architectural improvement over Intel's microarchitecture is now a long-run win. So CPU architecture is now worth cloud companies' efforts.

None of this is likely to be reflected in the "enterprise server" market. But that market is becoming increasingly odd and continually smaller. In many ways very much like the IBM mainframe business of the pre-PC 1980s. And just as likely to have a nasty surprise.

Deloitte's 'Test your Hacker IQ' site fails itself after exposing database user name, password in config file

Tweet removed

Twitter removed the tweet from Tillie Kottmann which uncovered this issue. Presumably because the tweet breached Twitter's controversial "Distribution of hacked materials policy".

Linux kernel's Kroah-Hartman: We're not struggling to get new coders, it's code review that's the bottleneck

"Linux has issues with code validation" isn't correct. It is clear where every line of code comes from.

"What would happen without Linus as ringmaster". Linux *has* a succession plan, at the moment that is GK-H. The risk is greater for other OSs: can you tell me who the successor to Microsoft COSINE's Jason Zander is as the engineering leadership for Windows? That's likely to be determined by business and poltiical issues at Microsoft at the time Zander steps down from that role. The same is true for Apple's engineering leadership. I don't know why you demand a different standard for Linux's engineering leadership.

As for resolving competing priorities, the lesson of Linux is that operating systems win by addressing everyone's needs. For example, it turns out that everyone wins if the kernel is capable of realtime scheduling, even if they aren't running a realtime application. Similarly, those small realtime systems win by using filesystems with features initially designed for large enterprises in mind.

"the likelihood of it being aggressively targeted by hackers (both state funded and criminal) is a certainty". Well yes. Because it is has already happened. But you are mistaken that the problem is "all those Application stack DevOps types". The DevOps technologies -- at their heart: easy safe continuous deployment -- makes preventing and responding to security issues much faster. The stronger isolation of Docker and similar technologies is also a win in limiting the fallout from security compromises. The security track record of real world deployment of this technology -- notably in the Google and Microsoft clouds -- is impressive.

Has Apple abandoned CUPS, the Linux's world's widely used open-source printing system? Seems so

Run your own RIP

As the owner of an ancient Samsung ML-1510 laser printer: attach a RaspberyPi to it's USB port. A model with 1GB of RAM or more. Now you can configure CUPS to drive that printer directly (for Samsung, via the gdi driver). But CUPS and Avahi can also represent that printer to the outside world as a IPP Everywhere printer (ie, which is sent PDF files, which is discoverable using mDNS). Which means driverless printing and easy printer discovery from laptops, tablets and phones.

Looking at that another way, it's basically a return to the start of the PostScript era, where the RIP (raster image processor) was a computer separate to the print drum. With the RPi RIP having 1GB of RAM it can print the most complex of PostScript jobs at full printer resolution (for the ML-1510 that hardware is 600 x 600 x 1bit gray but 1GB will also cover 1200 x 1200 x 4bit-gray rasterising and using a RPi to do that was cheaper than a RAM upgrade for my household's other printer, a Samsung SL-M4020ND -- not a recommended purchase).

Re: will drop PPD file support soon

CUPS uses PPD files as configuration files. This made sense when it looked like the printers of the world would mostly be PostScript. The configuration information for all other printers could then be munged to fit in a PostScript worldview, and PostScript used PPD files to describe printers.

But the world didn't end there. Today printers accept PDF and there's a network protocol to inquire about the printer's capabilities.

So it makes sense for a modern print spooler to have printers which don't work network-connected PDF spoolers like that to at least fit into that worldview. That leads to an API with a set of drivers. For older, simpler printers they can hardcode parameters rather than use IPP.

UK tech supply chain in dark over Brexit preparations months ahead of final heave-ho

Re: Latest from the PM

The UK won't "become like Australia". Because we *do* have a comprehensive low-friction trade agreement with our nearest neighbour -- the Closer Economic Relations treaty with New Zealand (and our Constitution has an invitation to New Zealand to join the Commonwealth of Australia). We also have a trade agreement with our next-nearest neighbours, the ASEAN-Australia-New Zealand Free Trade Agreement. As you'd expect we also have FTAs with major trading partners like USA, China and Japan. These treaties are the result of over twenty-five years' sustained effort. Ironically an effort initiated by the UK ending Commonwealth Preference to join the EU (which caused an economic crisis in Australia).

Australia doesn't yet have a trade agreement with the EU. The issues there are around agricultural goods, and especially the ever-increasing application by the EU of 'appellation' to limit competition. So trade with the EU occurs on WTO terms. This is no great drama for Australia as the EU is on the other side of the world -- and thus not tightly integrated into production chains. Whereas for UK firms European firms are a few hundred kilometres away and production processes have become tightly interwound.

Australia's situation is in no way comparable to a UK having no trade agreement with the EU and seeking to trade with close-by nations under WTO terms.

Cisco ordered to cough up $2bn – yes, two billion dollars – plus royalties after ripping off biz's cybersecurity patents

Read patent claims from the back if your trying to understand the invention

You read patent claims backwards. The later claims are the more specific and are the relevant claims. The earlier broader claims are a legal tactic. Once in a while litigation does result in one of the earlier broader claims being accepted, which is one of the many reasons why patent law is such a mess.