Posts by -tim

New APNIC director general steps up to steer the internet for 4 billion users

Fees going up?

If he thinks the members will put up with fees going, I'm sure there is a spot in the unemployment line he can take.

His definition of "internet" could be insulting to the ones who made it happen. It was supposed to about being multi-homed and not telco lock in. Today there are only about 30,000 address ranges in the entire wold that meet that requirement and most of them are ISPs based on my BGP route paths which includes 972,000 v4 and 207,000 v6 advertised routes.

The fees are already way too high by a significant factor and once the v4 numbers run out, there is almost no need for them at all.

IPv6 assignments should be 3${country_code}:${company id in hex}::/56 with reverse dns at ::53. Then there is zero benefit for their existence and no need to pay some of the salaries APNIC pay. Plus a company could take its allocation to a different ISP or even use several providers at once.

New SSL/TLS certs to each live no longer than 47 days by 2029

Secure against mother nature?

So what happens when your entire country is off the net for 10 days? It has happened to Tonga and boats try to cut subsea cables frequently.

Has anyone ever seen an actual example of the shorter certs solving a security problem or is it just wisdom handed down by the church of BOFH for ulterior motives?

Malware in Lisp? Now you're just being cruel

Re: Lisp is in an amazing number of places

Both FORTH and Lisp are hiding in all sorts of places because they were easy to implement. Lisp is often in things that originated at MIT and there were many early highly portable open source implementations that could be stripped down.

Lisp is in an amazing number of places

Lisp and even cut down versions are often used for programing inside drivers and boot processes. This was used to boot Sun systems for decades and still is found in other unix boot systems. It is common in embedded control systems and even runs inside mice and keyboards. It is in some x86 systems hiding in the security processors. Smart network cards that can do hardware offloading sometimes use Lisp embedded in the chip. It is in telescope controllers from back yard scopes to things in orbit. Lisp like C can deal with low level hardware devices down to the register level and it is extremely efficient as an interpreted language.

My most annoying problem with Lisp is I had to fix some broken hardware and I found a perfect example of some Lisp code to fix it and it was on my web page from many years ago.

Panic averted: It was just a bug in Atop after all

Re: Signs of other problems.

For all the non-tech reporters that will be scanning this discussion... computer memory is like cubby holes. Data gets put in a box and later gets retrieved, added or copied. The "zero page" is the default cubby hole where stuff goes. In a kindergarten example, that is where the shoes go when the staff didn't see which kid took them off.

Re: Signs of other problems.

As far as unmapping the zero page which is special in so many ways. That isn't an error and the posix standard is in error because they apparently don't address that issue. Zero is a valid address for a mapped page. The table for the processing mapping should have a flag of "did I map page zero?" and that should be set with any modern OS because they are all written in C and if page address==zero then ignore is asking for trouble. Mapping the zero page is a very valid and useful thing. BSDs, MacOS, Solaris, AIX all of them do it. The best practice for the zero page is to map it to a page (4k, 8k, more?) of ram filled with zeros. Except not all zeros as long ago someone (bsteve?) put a text message high in the BSD zero page and MacOS copied with a rude message about stealing their software. That zero page is mapped but would get marked for copy on write in the early days and then mark as read only latter. It is useful for a program to unmap that page, then remap it with no-read, no-write, no-execute to prevent null pointer games. That program should make an unmap(0) call to clean up properly.

/jacket has a block of mostly zeros in the pocket

Signs of other problems.

unmapping 0 shouldn't be a problem for any modern OS. There are valid reasons to map memory starting at zero but if it hasn't been mapped, then the unmap should check that and return an error that it wasn't mapped. This looks like more of a library and/or syscall bug to me.

Mapping the zero page to allow writes is a technique to debug code with null pointers if more info is needed about what is being written to the wrong memory. Mapping it as no-read, no-write will trigger the program crashed system which are useful for debuggers or can be trapped to restart a program. Mapping to zero to code space can be useful for running code from other systems that expect to be running from that address.

Credible nerd says stop using atop, doesn't say why, everyone panics

Unmapping a null pointer shouldn’t cause a problem for any os made in the last 3 decades. Doing so is a symptom of a different problem with the code and anything playing memory mapping games as root might get access to anything on the system.

Sweden seizes cargo ship after another undersea cable hit in suspected sabotage

Re: You know, bad weather can sink bad ships

Several of the recently cut cables were buried a at least meter under the seabed. One of the power lines that was cut had concrete plates above it. At a few knots, the anchors will bounce along the seabed so snagging a cable isn't guaranteed if they are intentionally doing this.

After China's Salt Typhoon, the reconstruction starts now

Re: Verizon...

I looks like the KPN policy authors drank the cool aid too. They require everything to be connected to the security apparatus. That level of trust and security back end network is how these telecos are getting cracked wide open. Everyone in the company seems to trust the CISO's network.

How about core router controls being air gapped? Too bad most routers leak things between the traffic they are switching and the control plane. All the major vendors are now pushing a cloud based single point for configurations. Get in that and the network is yours. The same is true for the "best practice" of a single central logging server. We used to clip an ethernet pair to create talk only cables for logging. Now everyone seems to just trust the firewalls.

What I would like to see is a central system that provides simple instructions that can be followed by someone who can read one and type into a truly air gapped system. Sure it takes longer but it means someone is looking at real config changes.

Microsoft Flight Simulator 2024 struggles to take off

Fans?

There is nothing wrong with the fans going crazy in a flight simulator assuming they adjust based on the throttle setting. Can they get them to have a proper audio beat for the proper black helicopter experience?

I had a Sun T1000 that would be quite nice right behind me while flying a jet fighter simulator.

The hunt is on for the scum who stole Britain's largest inflatable planetarium

Too common to find

Generic white trailer? Good luck finding that.

This is why groups with serious budget constraints need to approach their local cop shop or magistrate and ask if they known any tagger that is looking to reform. The result is a kid gets to do their hobby of spray painting and the white trailer becomes easily recognizable.

Would banning ransomware insurance stop the scourge?

The ransom isn't that much of a burden

The amount of the ransom tends to match the CEOs compensation for a year most of the time. Many companies don't seem to have a problem with that level of expense so it will continue.

Sysadmins rage over Apple’s ‘nightmarish’ SSL/TLS cert lifespan cuts plot

Evidence?

Where is the evidence that these shorter cert lifetimes are more secure? We have seen that opening up DNS servers for ACME has resulted in abuse. We have seen many poor implementations of automatically refreshing certs adding security holes. Yet I have yet to see a single case where a shorter lifetime on a cert would have stopped a problem.

NIST's security flaw database still backlogged with 17K+ unprocessed bugs. Not great

It has been pining for the fjords for a while

Several years ago I submitted a few major bugs that were ignored by the vendor. They weren't even going to help.

That bug would take full control of a system by visiting a web page and I had a demo. Some of its was reported years later.

The database needs to be split into Major products and Minor products as well. The crying wolf over the recent cups printing system is an example of something that should not be in the same database as something where every system must be updated at once like a nasty Windows issue. We hear about bad Apache issues all the time but they don't involve the web httpd server which has a million times more installs than any of the Apache Foundation projects. It would make my daily security news scans much simpler if they would stop adopting stray dogs from the Java flea circus or change that name.

Bring the joy of train delays home with your very own departure board

Time to finish a beer?

Can you program them to factor in the walking time to the station? That would be a very useful feature particularly in some pubs.

X.org lone ranger rides to rescue multi-monitor refresh rates

Proper use of X?

I've had to explain to a number of people who should know better that they can run their X programs on a remote system and have it displayed on their workstation which was original intent of the X system.

How a cheap barcode scanner helped fix CrowdStrike'd Windows PCs in a flash

Type, type without the local keyboard

I would like to have a good phone application that pretends to be a bluetooth keyboard that lets the other end send tones over phone call or facetime call or zoom call to send keyboard characters over the line. That would save so much time doing remote admin work. Of course the scammers would make great use of it so perhaps the thing should be able to time the sound reflection to figure out how far away the other end is.

Australian billionaire wins right to sue Facebook in the US over scam ads

A follow up article?

Simon, you seem to be getting far more of those than I see. Can you perhaps capture a few dozen and show the results? Perhaps with quotes from the so called endorsers?

AMD's baby Epycs are nothing more than Ryzens in disguise

Far less power can be useful

There is market for something like the PC Engines APU series that has things like ECC ram and very low power yet can run this years OS. That is a very useful form factor for plenty of appliance loads that can't be virtualized. There are plenty of those that are used for routers and industrial control units where ECC is important. If you didn't notice an ECC correction from the solar storm 2 weeks ago, you weren't paying attention or your hardware is faulty. PC Engines stoped making the APU due to a combination of lack of long term low end AMD chips, lack of support from AMD and problems getting the ethernet chips. Now there are thousands of us wondering what to buy next.

iFixit hails replaceable LPCAMM2 laptop memory as a 'big deal'

Re: Is it the end of SO-DIMM? NO!

With the number of ECC errors a few of my systems log, I find ECC is essential. Note that most systems don't log ECC corrections, only full failures but there are CPU counters that can hint at increases in ECC corrections. When the reports come out "oh, no the sun is sending another massive solar flare!" , I will see an increase in ECC errors. It seems that modern systems are still taking shortcuts with ECC and I suspect that only the obsolete SPARC is the only things that had true RAM to register ECC. ECC is also about the only real memory protection on shared systems for things like RowHammer. I don't understand how so many people consider it optional on critical systems.

Atlassian loses half its CEOs, but customers stay solid after Server products exit support

So another CEO that doesn't talk to customers?

We aren't moving to their cloud solution at all. I know of several others who refuse to move as well.

We have too much sensitive data their track record says they can not properly protect.

It's that most wonderful time of the year when tech cannot handle the date

Thank you for all the birthday greetings

Long ago in the before times, I set up a facebook account. They insisted on a birthday but I didn't trust them so I used the 29th on an odd year.

/beer for all the facebook friends who forgot the important part

Dump C++ and in Rust you should trust, Five Eyes agencies urge

Re: Bull

That isn't showing that is is well maintained, it is showing that is full of critical flaws. Well designed code never needs that much continual hacking.

Atlassian cranks up the threat meter to max for Confluence authorization flaw

but, but, but it is all fine!

But they are so good!!!!

We have the option of using our in house or their cloud stuff. They don't know security.

Hell, I caused one of their top unicorn programmers to have a meltdown on a train after some hard questioning.

I lock their stuff back behind way too much such while I'm trying to get the boss (and stockholder of Atlasicrap) to get something else.

China requires any new domestic Wi-Fi kit to support IPv6 and run it by default

Re: The Cultural Evolution - little leap forward :)

The maximum and minimum "host" part of a ipv6 address using modern v6 stacks is a /64. A /56 lets you create 256 networks from your ISP. Some people find it helpful to think of a /64=class C, /56=class B and the /32 that the ISP was allocated as a class A.

Lost voices, ignored words: Apple's speech recognition needs urgent reform

Apple won't follow their own stnadards

When Apple introduced MacOS 13 Ventura, they added a feature for right click to cut an object out of a picture effectively removing the background of an image. The problem is this takes a while and then the right click menu gets another item added at the bottom. If the screen is set up for people with poor eyesight, the menu will jump up just as a menu item is selected. That feature is often used for "Open image in new window" followed by zooming to be able to see the image properly.

That new "Copy Subject" feature needs to have a way to disable it. It wastes power as it runs the GPUs full speed and some of us never want to use it. Adding the extra menu option after a few seconds goes against apples own design guidelines and the option should be grayed out until it decides if it will work or not. Apples own page on the feature says "it might take a few seconds for Copy Subject to appear." Meanwhile it is burning through battery power for a feature is mostly used for creating copyright violating memes.

Oracle's revised Java licensing terms 2-5x more expensive for most orgs

Other runtimes?

Will third-party Java runtimes get around this issue? I thought the Oracle license claimed full ownership of Java in all forms and you owed the license even if it wasn't their runtime being used. This ended up in court with Google's Android API but I don't think that settled the issue if the company signed the small print contract with Oracle.

Google toys with internet air-gap for some staff PCs

Air-gap?

That term has changed meaning over the last few years. It used to mean there would be absolutely no path to the net at all from an air-gapped system. Now it seems to mean somewhat locked down.

Uncle Sam sounds like it may actually do something about rampant visa H-1B fraud

Indentured class workers please?

I've been approached hundreds of times to go work in the US and many times with the recruiter pointing out they will help me get the H-1B visa. Their interest wanes when they find out I don't need a visa to work in the USA.

/Mines the coat with two passports

Microsoft tackles SaaSy URL sprawl, dumping its dotcom in favor of cloud.microsoft

Top level corp domains were always a bad idea

Already fixed here:

$ host www.cloud.microsoft

Host www.cloud.microsoft not found: 3(NXDOMAIN)

I add top level domains when I have a need because almost all the common ones are full of scammers.

Google Cloud slips over in Europe amid water leak, fire

So someone else forgot the first rule of data centers

Water will get into your data center. If there isn't a plan to get rid of it, it will do damage and Murphy's laws says the water will find the place to do the most damage.

New models of IBM Model F keyboard Mark II incoming

Re: I thought I was safe

In the war of vi vs emacs, one place were emacs win is the cat test.

Open a file in each editor, drop a cat on the keyboard.

Which editor does more damage and how long does it take to fix it and how much is unrecoverable?

Emacs wins the cat test. It also wins the Eliza test.

Apple patches all the iThings, including iOS 15 hole under attack right now

Re: I'll check.

> As it's 8 years old I think Apple can be forgiven for no longer providing updates

Why? It would take Apple a team of 5 engineers to provide critical security updates for everything they made since their G4 Mac days. Some times those patches would end up turning off features but they could keep the older equipment functional enough to not end up as landfill.

Most countries have laws that say a product must be supported for a number of years based on its cost. Apple products tend to be in the category where those laws require a decade or two of support for critical problems.

If we plan to live on the Moon, it's going to need a time zone

Wasn't this solved decades ago?

There have been hacks to the timezone files used by Unix/Linux/OSx to adjust for moon time and solar noon time.

One odd advantage of the leap second is that now some programmers understand that the concept of time in computers isn't quite as easy as it first appears.

It's been 230 years since British pirates robbed the US of the metric system

Re: The amount of times...

In 1700 it was much easier for a scientist to calibrate a home made thermometer using ammonium chloride cooling bath and a docile dog. The temperature of boiling water required a barometer at higher altitudes and calibration tables. The human armpit temperature of about 96 allows hand drawn hash marks in repeated halves. Many very early Fahrenheit thermometer are often marked every 3 degrees.

What goes up must come down: Logitech sales tumble amid PC slump

I have 3 M570 trackballs on my work bench that are disassembled as I tried to find out why they don't work properly anymore. The mechanical switches still work yet they behave oddly. One won't trigger the edge detection on the mac. Another has an odd issue with the right button. My next guess is to reflash the processor to see if that helps.

They dropped the wired versions so now they all need batteries and a wireless dongle. It isn't like a cable on a trackball is a problem.

Linus Torvalds's faulty memory (RAM, not wetware) slows kernel development

How about an error message?

Perhaps it is time that the boot process produce a warning for systems that don't support ECC.

I've noticed that old systems that properly report ECC errors tend to do so around the time of unusual solar activity.

Systemd supremo Lennart Poettering leaves Red Hat for Microsoft

Re: Motive found.

The name field in the sysV init tab is there for dependencies and it has been there at least 3 and a half decades.

UK Home Office signs order to extradite Julian Assange to US

Re: Appeal

They could appeal based on the US flat out not telling the truth in a UK court. The US has stated the charges and swore those were the only charges. That leaves out the John Doe warrants against the author of the hacking tool "strobe." I know this because I've seen some of the witness statements and I know there will be additional charges once he is in the US.

Record players make comeback with Ikea, others pitching tricked-out turntables

Re: That vinyl sound

While the DDD should be technically more correct, I'll take the AAD or ADD version most of the time. In my CD collection, the AAD is left of the ADD which is left of the DDD which is left of the "remastered" versions. The ones that get the most play are the ones on the left.

Perl Steering Council lays out a backwards compatible future for Perl 7

The real Perl problem: lack of new developers

Our problem with Perl is lack of new programmers. Our business runs a bit of Perl and it is the most profitable per line of code by a huge margin but new coders haven't even looked at Perl.

As far as backward compatibility goes, recent version of Perl 5 have broken more things that any other version change I can remember and I have scripts that started out with version 3.

FreeBSD 13.1 is out for everything from PowerPC to x86-64

Re: Question

openssl 3 is removing some of the older broken encryption by default. That means talking to ancient un-updated equipment won't work out of the box if ever. We keep a version of ssh 6.6 compiled with open ssl 1.0.1 called ssh1 for those rare cases but web things are getting harder. We have used haproxy 1.8 configured to talk to old ssl backends also linked to older openssl which lets us use modern browsers with old hardware and old hardware with new web sites. We use the odd mixes for devices that can't phone home for firmware updates because they can't do modern ssl/tls but we have to configure per host and play dns and cert games to get that to work.

openssl skipped version 2 because of the protocol 1 vs protocol 2 version issue.

Cisco warns of premature DIMM failures

Whos DIMMs?

Does Cisco even make DIMMs as they seem like a part that should be outsourced. If that is the case, who make them and what else are they in?

Reliable systems with large memory need to have ECC. There is no excuse not to have it in. While rare, on our systems that properly record ECC corrections, it is interesting they happen on different systems at about the same time.

Oracle offers migration path for Solaris 10 apps

11.4 on what hardware?

11.4 won't run on anything we owned so it was off to FreeBSD for us. 11.3 had finally fixed the security issues I didn't like from 10 and ZFS was a game changer. Oddly enough there were still patches to Solaris 9 hiding on the solaris 10 container stuff the last time I checked a bit over a year ago. That still runs on SPARCstation 20 from 1994. That means you could have a nearly 30 year old computer that meets security compliance regulations if you could keep your applications patched.

We deracked a V100 last week. The thing was older some of our staff. It was removed because one of its original disks was going bad and we were pulling out a bunch of far newer systems. We still have one X1 in our internal R&D DNS cluster and will remain there until it fails which might be a while since it has flash IDE disk emulator.

I've got a tadpole Sparckbook 2 from 1993 that still works except for some of the keys are a bit of a problem.

Day 7 of the great Atlassian outage: IT giant still struggling to restore access

Options?

It is amazing how much of Atlassian's stuff can be replaced in a single weekend by two coders with a private usenet server, git, some perl template toolkit web pages, markup to html scripts, and a html friendly newsreader.

Apple's Mac Studio exposed: A spare storage slot and built-in RAM

Why do people keep thinking the memory is soldered?

Because it is. It is soldered to the same substrate that the CPU is attached to and a few people have upgraded them, it just needs more specialized equipment than any low end repair shop happens to have as well as donor ram chips which can't be sourced new.

The real reason the M1 chip's memory is so fast is they use about 877 pins to transfer more data in parallel compared to the 288 pins of a DDR5 DIMM. That allows the chips to transfer the address and more data in parallel without wasting cycles.

Zero trust? Not yet a must for most IT departments

What exactly does Zero Trust mean?

The term is already being perverted in the industry. Places want to do Single Sign On and Zero Trust to be fully buzzword compliant.

Another meaningless term now is "Air Gapped." Apparently acceptable use somehow now means firewalled with all inbound connections disabled to the specific host rather than the "No network at all" like it used to mean. I've seen the term used to describe a host on a typical office LAN where other hosts have inbound traffic allowed.

Apple emits emergency fix for exploited-in-the-wild WebKit vulnerability

Only some are patched

More than 5% of the macs that hit my web sites are versions that are old enough that they will never be patched and they cluster around the last supported versions for hardware that appears to be fully functional except for their stock browser is full of holes. A team of 5 people in apple could keep these older machines running securely. Apple hardware seems to keep getting handed down to others when new machines are bought. We still see PPC based macs. Most countries have laws that require major appliances to be supported for at least a decade and it is time those laws were enforced with the vastly more expensive computers particularly with the total lack of hardship it would cause Apple.

Lost your mouse cursor? Microsoft's PowerToys 0.55 has you covered – with a massive crosshair

Re: I put it down just a second ago, where'd it get off to?!

I have two extra buttons on my trackball and I would love to have them move the cursor to a specific place. Then I wouldn't care where the cursor had been.

Now if Logitech would just allow space for a USB cable out their next model, I won't have to keep buying batteries since my trackball seems to stay where it should be.