Posts by -tim

Ofcom fines 4chan £20K and counting for pretending UK's Online Safety Act doesn't exist

Wait for the short term SSL certs for real control

The number of organizations issuing TLS/SSL certs is decreasing and once the 47 day requirement hits, there isn't much of a business model left for most of that industry. That means the number of groups that can control who has a valid web site goes way down. Right now there are about 500 top level domains so it is trivial to hop from example.com to exmaple.somethingelse but there are less than 70 organizations that can issue a valid SSL certificate and about half of those are country specific.

Bring back your old Mac: 5 ways to refresh the OS on elderly Apples

Liam,

Wasn't it dosdude1 who made a claim like it would cost Apple 5 engineers, a large room, access to source code and access to old machines to keep millions of old machines out of landfill? Whoever made the claim said something like a million a year could make every machine that could run OS X usable for at least web browsing or something like that.

FreeBSD Project isn't ready to let AI commit code just yet

Re: A big mistake, this

The freebsd-update has all the tools to be an IDSFixer.

On some updates there are hundreds of files that need to be updated by hand. In most cases, the a vast majority of new file should be used without any edits with an the exception of /etc/passwd which the old one is the proper choice. If someone makes a mistake with that update, the system may not boot or can't be accessed as it was a way of removing the old encrypted passwords.

I should have said "append only file systems". Rotating files requires "write" permissions on the file systems for both the move and removing the old file once the compressed on is written. Modern file systems can allow logs to be written compressed. Write only, appended only, no read logs are a thing for forensic logging.

As far as removing compilers, it is just one step of locking down a machine with minimal software. It isn't too hard to get a list of all the programs that have been run on a systems and remove everything else. The idea of a security-purge-compilers to ensure the requirement is meet.

Re: A big mistake, this

Liam,

Yes, it had an intrusion detection system that can warn that system files have been tampered with.

FreeBSD has a "freebsd-update IDS" which checks the system against the list of files that should be on it and their checksums. The problem is that if it tells you /bin/hostname has the wrong checksum, you can't easily do something like freebsd-update reinstall [checksum] or freebsd-update reinstall /bin/hostname. Oddly the program has all the smarts to do both but the extra bit of code hasn't made its way in yet.

Re: A big mistake, this

The FreeBSD update program has a number of issues . For example its IDS can tell you what is wrong but no good way to fix any problem it finds. On a system upgraded since the 4.6 days, there are 8548 things in IDS ids report and most should have been fixed with the last update but weren't. When the 3diff breaks, it can break bad and the system should allow a "1) edit, 2) use old one, 3) use new one" type options. It is also a real pain to use on systems that don't have direct internet access or have highly locked down DNS. A "pkg install RELEASE-15.0p0" before running freebsd-update would be very helpful. Sometime between 14.0 and 14.3 it seemed to get much slower on major release updates. Every version update I think about writing a '-r +' and '-r ++' patch for it.

There are also issues of modern security that conflict with the BSD (and other FOSS os) way. Logs should be on a write only file system yet the base config wants to rotate and compress logs even if they are on a compressed write only file system so we have a local pkg that fixes that. Security guidelines require we remove the compilers. A pkg security-purge-compilers is easy to build.

Long ago Sun OS used to be made up of several packages so things like 'make' were in SUNWsprot which was optional and 'cat' was in SUNWcsu which was not and I would be happy with that sort of thing today. I would also be happy with redefining '-a' from 'all except pkg' to 'all non-system packages' and define '-s' for 'all system packages but no user packages' so pkg upgrade -s would bump the OS leaving userland, but uprade -sa would upgrade everything and upgrade '-a' would be useful for people with hardware with questionable support.

I use FreeBSD for most systems because I think it is the best OS for my needs.

The Unix Epochalypse might be sooner than you think

I have no idea how the system got the odd time and the guess was something like memory corruption. It was less than the lowest 32 bit time_t. It had been running fine then nothing dynamically linked would load. The 64 bit time_t will do +/- a few billion years but most apps on Solaris of the day were 32 bit with a 32 bit time_t. We couldn't run the date command to set it and I ended up making a small statically linked program to set the time to 0 to fix the problem.

I had a sparc station 20 or something like that which ended up with a system date in the 1800s. The link loader that most programs depended on didn't like it. We ended up getting the time set to 1970 and everything worked fine.

The problem with the system in the article looks like a C library that tried to force unix time conventions onto hardware that had its own time idea and the edge cases weren't tested.

These y2k articles remind me that I need to go find the old file of companies that asked us to send reports about our y2k compliance. They seem to be entertaining for the younger staff. Maybe we should ask AI to write return letters for us.

Everybody needs good neighbors – especially ones who sell you solar energy

Re: feed-in tariff is less than 5 cents per kilowatt hour, while the retail price is around 28 cents

I don't know when or where their got there numbers but I pay twice as much at 3:01pm and I only get $0.01 feed in and I'm on the high side of the feed in with some people getting 1/10 of that. I'm in Ausnet territory in Victoria.

DNS security is important but DNSSEC may be a failed experiment

It seems easy enough to turn on

I run my own dns servers and I tell bind to sign the domain. About a day later, the name reseller has picked up the signed data, I click a box and DNSSEC is on. Seems easy enough.

Tiling terminal multiplexers for the console connoisseur

Re: I use Screen

Every desk top I've used since about 1986 has had a decent window manager. Those window manager seem to work better than apps that try to roll their own like way too many tab implementations.

Apple goes glass whole as it pours new UI everywhere

3d mixed with 2d look?

Wouldn't it look better if they used the 3d look red, yellow and green window control buttons from Mac OS X 10?

New APNIC director general steps up to steer the internet for 4 billion users

Fees going up?

If he thinks the members will put up with fees going, I'm sure there is a spot in the unemployment line he can take.

His definition of "internet" could be insulting to the ones who made it happen. It was supposed to about being multi-homed and not telco lock in. Today there are only about 30,000 address ranges in the entire wold that meet that requirement and most of them are ISPs based on my BGP route paths which includes 972,000 v4 and 207,000 v6 advertised routes.

The fees are already way too high by a significant factor and once the v4 numbers run out, there is almost no need for them at all.

IPv6 assignments should be 3${country_code}:${company id in hex}::/56 with reverse dns at ::53. Then there is zero benefit for their existence and no need to pay some of the salaries APNIC pay. Plus a company could take its allocation to a different ISP or even use several providers at once.

New SSL/TLS certs to each live no longer than 47 days by 2029

Secure against mother nature?

So what happens when your entire country is off the net for 10 days? It has happened to Tonga and boats try to cut subsea cables frequently.

Has anyone ever seen an actual example of the shorter certs solving a security problem or is it just wisdom handed down by the church of BOFH for ulterior motives?

Malware in Lisp? Now you're just being cruel

Re: Lisp is in an amazing number of places

Both FORTH and Lisp are hiding in all sorts of places because they were easy to implement. Lisp is often in things that originated at MIT and there were many early highly portable open source implementations that could be stripped down.

Lisp is in an amazing number of places

Lisp and even cut down versions are often used for programing inside drivers and boot processes. This was used to boot Sun systems for decades and still is found in other unix boot systems. It is common in embedded control systems and even runs inside mice and keyboards. It is in some x86 systems hiding in the security processors. Smart network cards that can do hardware offloading sometimes use Lisp embedded in the chip. It is in telescope controllers from back yard scopes to things in orbit. Lisp like C can deal with low level hardware devices down to the register level and it is extremely efficient as an interpreted language.

My most annoying problem with Lisp is I had to fix some broken hardware and I found a perfect example of some Lisp code to fix it and it was on my web page from many years ago.

Panic averted: It was just a bug in Atop after all

Re: Signs of other problems.

For all the non-tech reporters that will be scanning this discussion... computer memory is like cubby holes. Data gets put in a box and later gets retrieved, added or copied. The "zero page" is the default cubby hole where stuff goes. In a kindergarten example, that is where the shoes go when the staff didn't see which kid took them off.

Re: Signs of other problems.

As far as unmapping the zero page which is special in so many ways. That isn't an error and the posix standard is in error because they apparently don't address that issue. Zero is a valid address for a mapped page. The table for the processing mapping should have a flag of "did I map page zero?" and that should be set with any modern OS because they are all written in C and if page address==zero then ignore is asking for trouble. Mapping the zero page is a very valid and useful thing. BSDs, MacOS, Solaris, AIX all of them do it. The best practice for the zero page is to map it to a page (4k, 8k, more?) of ram filled with zeros. Except not all zeros as long ago someone (bsteve?) put a text message high in the BSD zero page and MacOS copied with a rude message about stealing their software. That zero page is mapped but would get marked for copy on write in the early days and then mark as read only latter. It is useful for a program to unmap that page, then remap it with no-read, no-write, no-execute to prevent null pointer games. That program should make an unmap(0) call to clean up properly.

/jacket has a block of mostly zeros in the pocket

Signs of other problems.

unmapping 0 shouldn't be a problem for any modern OS. There are valid reasons to map memory starting at zero but if it hasn't been mapped, then the unmap should check that and return an error that it wasn't mapped. This looks like more of a library and/or syscall bug to me.

Mapping the zero page to allow writes is a technique to debug code with null pointers if more info is needed about what is being written to the wrong memory. Mapping it as no-read, no-write will trigger the program crashed system which are useful for debuggers or can be trapped to restart a program. Mapping to zero to code space can be useful for running code from other systems that expect to be running from that address.

Credible nerd says stop using atop, doesn't say why, everyone panics

Unmapping a null pointer shouldn’t cause a problem for any os made in the last 3 decades. Doing so is a symptom of a different problem with the code and anything playing memory mapping games as root might get access to anything on the system.

Sweden seizes cargo ship after another undersea cable hit in suspected sabotage

Re: You know, bad weather can sink bad ships

Several of the recently cut cables were buried a at least meter under the seabed. One of the power lines that was cut had concrete plates above it. At a few knots, the anchors will bounce along the seabed so snagging a cable isn't guaranteed if they are intentionally doing this.

After China's Salt Typhoon, the reconstruction starts now

Re: Verizon...

I looks like the KPN policy authors drank the cool aid too. They require everything to be connected to the security apparatus. That level of trust and security back end network is how these telecos are getting cracked wide open. Everyone in the company seems to trust the CISO's network.

How about core router controls being air gapped? Too bad most routers leak things between the traffic they are switching and the control plane. All the major vendors are now pushing a cloud based single point for configurations. Get in that and the network is yours. The same is true for the "best practice" of a single central logging server. We used to clip an ethernet pair to create talk only cables for logging. Now everyone seems to just trust the firewalls.

What I would like to see is a central system that provides simple instructions that can be followed by someone who can read one and type into a truly air gapped system. Sure it takes longer but it means someone is looking at real config changes.

Microsoft Flight Simulator 2024 struggles to take off

Fans?

There is nothing wrong with the fans going crazy in a flight simulator assuming they adjust based on the throttle setting. Can they get them to have a proper audio beat for the proper black helicopter experience?

I had a Sun T1000 that would be quite nice right behind me while flying a jet fighter simulator.

The hunt is on for the scum who stole Britain's largest inflatable planetarium

Too common to find

Generic white trailer? Good luck finding that.

This is why groups with serious budget constraints need to approach their local cop shop or magistrate and ask if they known any tagger that is looking to reform. The result is a kid gets to do their hobby of spray painting and the white trailer becomes easily recognizable.

Would banning ransomware insurance stop the scourge?

The ransom isn't that much of a burden

The amount of the ransom tends to match the CEOs compensation for a year most of the time. Many companies don't seem to have a problem with that level of expense so it will continue.

Sysadmins rage over Apple’s ‘nightmarish’ SSL/TLS cert lifespan cuts plot

Evidence?

Where is the evidence that these shorter cert lifetimes are more secure? We have seen that opening up DNS servers for ACME has resulted in abuse. We have seen many poor implementations of automatically refreshing certs adding security holes. Yet I have yet to see a single case where a shorter lifetime on a cert would have stopped a problem.

NIST's security flaw database still backlogged with 17K+ unprocessed bugs. Not great

It has been pining for the fjords for a while

Several years ago I submitted a few major bugs that were ignored by the vendor. They weren't even going to help.

That bug would take full control of a system by visiting a web page and I had a demo. Some of its was reported years later.

The database needs to be split into Major products and Minor products as well. The crying wolf over the recent cups printing system is an example of something that should not be in the same database as something where every system must be updated at once like a nasty Windows issue. We hear about bad Apache issues all the time but they don't involve the web httpd server which has a million times more installs than any of the Apache Foundation projects. It would make my daily security news scans much simpler if they would stop adopting stray dogs from the Java flea circus or change that name.

Bring the joy of train delays home with your very own departure board

Time to finish a beer?

Can you program them to factor in the walking time to the station? That would be a very useful feature particularly in some pubs.

X.org lone ranger rides to rescue multi-monitor refresh rates

Proper use of X?

I've had to explain to a number of people who should know better that they can run their X programs on a remote system and have it displayed on their workstation which was original intent of the X system.

How a cheap barcode scanner helped fix CrowdStrike'd Windows PCs in a flash

Type, type without the local keyboard

I would like to have a good phone application that pretends to be a bluetooth keyboard that lets the other end send tones over phone call or facetime call or zoom call to send keyboard characters over the line. That would save so much time doing remote admin work. Of course the scammers would make great use of it so perhaps the thing should be able to time the sound reflection to figure out how far away the other end is.

Australian billionaire wins right to sue Facebook in the US over scam ads

A follow up article?

Simon, you seem to be getting far more of those than I see. Can you perhaps capture a few dozen and show the results? Perhaps with quotes from the so called endorsers?

AMD's baby Epycs are nothing more than Ryzens in disguise

Far less power can be useful

There is market for something like the PC Engines APU series that has things like ECC ram and very low power yet can run this years OS. That is a very useful form factor for plenty of appliance loads that can't be virtualized. There are plenty of those that are used for routers and industrial control units where ECC is important. If you didn't notice an ECC correction from the solar storm 2 weeks ago, you weren't paying attention or your hardware is faulty. PC Engines stoped making the APU due to a combination of lack of long term low end AMD chips, lack of support from AMD and problems getting the ethernet chips. Now there are thousands of us wondering what to buy next.

iFixit hails replaceable LPCAMM2 laptop memory as a 'big deal'

Re: Is it the end of SO-DIMM? NO!

With the number of ECC errors a few of my systems log, I find ECC is essential. Note that most systems don't log ECC corrections, only full failures but there are CPU counters that can hint at increases in ECC corrections. When the reports come out "oh, no the sun is sending another massive solar flare!" , I will see an increase in ECC errors. It seems that modern systems are still taking shortcuts with ECC and I suspect that only the obsolete SPARC is the only things that had true RAM to register ECC. ECC is also about the only real memory protection on shared systems for things like RowHammer. I don't understand how so many people consider it optional on critical systems.

Atlassian loses half its CEOs, but customers stay solid after Server products exit support

So another CEO that doesn't talk to customers?

We aren't moving to their cloud solution at all. I know of several others who refuse to move as well.

We have too much sensitive data their track record says they can not properly protect.

It's that most wonderful time of the year when tech cannot handle the date

Thank you for all the birthday greetings

Long ago in the before times, I set up a facebook account. They insisted on a birthday but I didn't trust them so I used the 29th on an odd year.

/beer for all the facebook friends who forgot the important part

Dump C++ and in Rust you should trust, Five Eyes agencies urge

Re: Bull

That isn't showing that is is well maintained, it is showing that is full of critical flaws. Well designed code never needs that much continual hacking.

Atlassian cranks up the threat meter to max for Confluence authorization flaw

but, but, but it is all fine!

But they are so good!!!!

We have the option of using our in house or their cloud stuff. They don't know security.

Hell, I caused one of their top unicorn programmers to have a meltdown on a train after some hard questioning.

I lock their stuff back behind way too much such while I'm trying to get the boss (and stockholder of Atlasicrap) to get something else.

China requires any new domestic Wi-Fi kit to support IPv6 and run it by default

Re: The Cultural Evolution - little leap forward :)

The maximum and minimum "host" part of a ipv6 address using modern v6 stacks is a /64. A /56 lets you create 256 networks from your ISP. Some people find it helpful to think of a /64=class C, /56=class B and the /32 that the ISP was allocated as a class A.

Lost voices, ignored words: Apple's speech recognition needs urgent reform

Apple won't follow their own stnadards

When Apple introduced MacOS 13 Ventura, they added a feature for right click to cut an object out of a picture effectively removing the background of an image. The problem is this takes a while and then the right click menu gets another item added at the bottom. If the screen is set up for people with poor eyesight, the menu will jump up just as a menu item is selected. That feature is often used for "Open image in new window" followed by zooming to be able to see the image properly.

That new "Copy Subject" feature needs to have a way to disable it. It wastes power as it runs the GPUs full speed and some of us never want to use it. Adding the extra menu option after a few seconds goes against apples own design guidelines and the option should be grayed out until it decides if it will work or not. Apples own page on the feature says "it might take a few seconds for Copy Subject to appear." Meanwhile it is burning through battery power for a feature is mostly used for creating copyright violating memes.

Oracle's revised Java licensing terms 2-5x more expensive for most orgs

Other runtimes?

Will third-party Java runtimes get around this issue? I thought the Oracle license claimed full ownership of Java in all forms and you owed the license even if it wasn't their runtime being used. This ended up in court with Google's Android API but I don't think that settled the issue if the company signed the small print contract with Oracle.

Google toys with internet air-gap for some staff PCs

Air-gap?

That term has changed meaning over the last few years. It used to mean there would be absolutely no path to the net at all from an air-gapped system. Now it seems to mean somewhat locked down.

Uncle Sam sounds like it may actually do something about rampant visa H-1B fraud

Indentured class workers please?

I've been approached hundreds of times to go work in the US and many times with the recruiter pointing out they will help me get the H-1B visa. Their interest wanes when they find out I don't need a visa to work in the USA.

/Mines the coat with two passports

Microsoft tackles SaaSy URL sprawl, dumping its dotcom in favor of cloud.microsoft

Top level corp domains were always a bad idea

Already fixed here:

$ host www.cloud.microsoft

Host www.cloud.microsoft not found: 3(NXDOMAIN)

I add top level domains when I have a need because almost all the common ones are full of scammers.

Google Cloud slips over in Europe amid water leak, fire

So someone else forgot the first rule of data centers

Water will get into your data center. If there isn't a plan to get rid of it, it will do damage and Murphy's laws says the water will find the place to do the most damage.

New models of IBM Model F keyboard Mark II incoming

Re: I thought I was safe

In the war of vi vs emacs, one place were emacs win is the cat test.

Open a file in each editor, drop a cat on the keyboard.

Which editor does more damage and how long does it take to fix it and how much is unrecoverable?

Emacs wins the cat test. It also wins the Eliza test.

Apple patches all the iThings, including iOS 15 hole under attack right now

Re: I'll check.

> As it's 8 years old I think Apple can be forgiven for no longer providing updates

Why? It would take Apple a team of 5 engineers to provide critical security updates for everything they made since their G4 Mac days. Some times those patches would end up turning off features but they could keep the older equipment functional enough to not end up as landfill.

Most countries have laws that say a product must be supported for a number of years based on its cost. Apple products tend to be in the category where those laws require a decade or two of support for critical problems.

If we plan to live on the Moon, it's going to need a time zone

Wasn't this solved decades ago?

There have been hacks to the timezone files used by Unix/Linux/OSx to adjust for moon time and solar noon time.

One odd advantage of the leap second is that now some programmers understand that the concept of time in computers isn't quite as easy as it first appears.

It's been 230 years since British pirates robbed the US of the metric system

Re: The amount of times...

In 1700 it was much easier for a scientist to calibrate a home made thermometer using ammonium chloride cooling bath and a docile dog. The temperature of boiling water required a barometer at higher altitudes and calibration tables. The human armpit temperature of about 96 allows hand drawn hash marks in repeated halves. Many very early Fahrenheit thermometer are often marked every 3 degrees.

What goes up must come down: Logitech sales tumble amid PC slump

I have 3 M570 trackballs on my work bench that are disassembled as I tried to find out why they don't work properly anymore. The mechanical switches still work yet they behave oddly. One won't trigger the edge detection on the mac. Another has an odd issue with the right button. My next guess is to reflash the processor to see if that helps.

They dropped the wired versions so now they all need batteries and a wireless dongle. It isn't like a cable on a trackball is a problem.

Linus Torvalds's faulty memory (RAM, not wetware) slows kernel development

How about an error message?

Perhaps it is time that the boot process produce a warning for systems that don't support ECC.

I've noticed that old systems that properly report ECC errors tend to do so around the time of unusual solar activity.

Systemd supremo Lennart Poettering leaves Red Hat for Microsoft

Re: Motive found.

The name field in the sysV init tab is there for dependencies and it has been there at least 3 and a half decades.