Posts by Mike 137

Space. The final frontier. These are the voyages of 'Advanced Night Repair' skin cream helping NASA to commercialise space

"Advanced Night Repair Synchronized Multi-Recovery Complex" with "Power Signal Technology", and “deep- and fast-penetrating hydrating serum” .

Baloney supported by brilliant marketing. I'm surprised (although maybe not as surprised as that) at NASA falling for it. It wouldn't have in their Saturn days.

There's a delightful essay in The Wine of Life & Other Essays on Societies, Energy, & Living Things by Harold Morowitz (St. Martin's Press, 1979) in which he roundly debunks "protein enriched" shampoo. Well worth reading if you feel inclined to believe in "fast-penetrating hydrating serum", particularly as Morowitz had a long consulting association with NASA.

Coding unit tests is boring. Wouldn't it be cool if an AI could do it for you? That's where Diffblue comes in

Indeed...

"we can't tell if the current logic that you have in the code is correct or not, because we don't know what the intent is of the programmer, and there's no good way today of being able to express intent in a way that a machine could understand."

Primarily because the machine can't "understand" anything in the sense we can.

In the past, where it mattered one used formal specification languages such as VDM or Z to handle this problem. Although they can't demonstrate whether what the application designer specified is sensible, they do show whether the code meets that specification.

The other important issues are boundary conditions, such as bad data, for which there are several automated techniques (e.g. fuzzing), and race conditions in multi-threaded code, which can be hard to track down. Any competent AI system would need to be able to handle these.

Now, when I work as an application designer with a developer, we start from a specification of both what the code should do and what it should not do, and from that agree a test set that covers both for each unit developed individually and the application as a whole.

Anglian Water fishes for on-trend laundry list – including low-code work – in £24m trawl

£24m trawl

"wearables solutions", "hackathons" and "thought leadership", "human-centred design and design thinking, UX and UI design", "multi-experience solutions"...

I wonder where they got the buzz word dictionary and how much it cost, but £24 million would fix quite a lot of the supply pipework leaks which typically lose up to half of all the water processed and thereby contribute to the increasing shortage of usable water for all of us.

MP promises to grill UK.gov over revelations that Uber handed '2,000 pieces' of user data to London cops a year

Dirty business?

Sadly, no. Just normal business these days. The only offence is getting caught.

Das Keyboard 4C TKL: Plucky mechanical contender strikes happy medium between typing feel and clackety-clack joy

One unmentioned issue

One thing this review doesn't mention is how the key tops are labelled.

I bought a black Cherry MX3000 a while back and although the key action is superb, the key tops are not. They're printed with some kind of white resin ink that seems to be porous. It rapidly accumulated grime and turned grey and has proved uncleanable. Oh for the old IBM-type double shot moulded key tops!

Another Cherry in my possession has laser engraved key tops, which, although not as good as double shot, are at least immune to the MX3000 problem.

It seems that pretty much all keyboards are labelled after the key tops are fitted these days, so the way this is done is a very important factor.

Let's go space truckin': 1970s probe Voyager 1 is now 14 billion miles from home

Voyager don't 'arf go!

10.5 billion miles in 30 years - that's a whopping 40,000 mile an hour on average.

Elecrow CrowPi2: Neat way to get your boffins-to-be hooked on Linux from an early age and tinkering in no time

"The kiddiwonks won't even know they're learning"

Why is knowing you're learning such a bad idea?

Possibly because our culture has defined learning as a "boring" duty that has to be tarted up with "entertainment" to make it palatable? I've always found the activity of learning fascinating, but not the way it's conducted by our national education system. That's enough to put anyone off for life, and it seems to have succeeded for decades.

Alibaba wants to get you off the PC upgrade treadmill and into its cloud

A "cloud" computer"?

or a time sharing mainframe?

Right back to the 1960s, but without the reliability.

Video encoders using Huawei chips have backdoors and bad bugs – and Chinese giant says it's not to blame

Re: "The hardcoded password is a deliberate backdoor."

Not necessarily. I've seen numerous instances of devs "innocently" setting hard coded passwords as a result of Dunning Kruger. There have even been instances of IoT vulnerabilities of this kind being due to devs copying and pasting example code fragments from chip vendors' data sheets directly into the production code without changing the example defaults (including the example passwords).

Amazon Lex can now speak British English... or simply 'English' if you're British

"Oxford University Press, favours -ize over -ise"

For its house style maybe. However (at least until recently" the Oxford dictionary was specifically "descriptive, not prescriptive" of the language.

The niggle -ise v. -ize based on ancient Greek is somewhat reminiscent of the "sin of the split infinitive". This is based on argument from Latin, in which you can't split an infinitive because there's no particle (the equivalent of the "to" in English). So in reality it's not "mustn't" at all, but "can't" if you force English to follow rules derived from Latin. But of course you don't have to if you're speaking or writing English.

How do you solve 'disruption' at the UK border after Brexit? Let's call Peter Thiel! AI biz Palantir – you're hired

Re: GDPR?

" If any processing is done outside EU, it's probably illegal"

Not if protected by adequate safeguards (GDPR Chapter V).

.UK overlord Nominet tells everyone not to worry about 'distorted' vote allocations in its board elections

The regulator no longer exists except in name.

"The reality is that the top three registrars, armed with their board seats, have an effective veto over the organisation’s decisions."

What we're left with is essentially just a cartel masquerading as a regulator.

You have to be very on-trend as a cybercrook – hence why coronavirus-themed phishing is this year's must-have look

An eight point plan

In no particular order:

[1] don't open an attachment of, or follow a link in, an email you're not expecting;

[2] verify email validity by inspecting the transport headers (ideally using automation)

[3] in corporate systems, remove and quarantine attachments to emails from outside the enterprise;

[4] either strip link anchors from email bodies at the gateway or expose them to view in the body;

[5] employ a mail filtering service either locally at the gateway or in the cloud;

[6] ditto for web requests;

[7] never rely on workstation-based protection alone against malware;

[8] educate everyone including the Executive in safe email usage.

Cisco’s 'intuitive security' tool can’t handle MAC address randomization out-of-the-box

Yet another elastoplast with unexpected consequences?

The whole purpose of MAC addresses (and indeed IP addresses) is reliable identification of devices - primarily for directing traffic of course, but with the beneficial spin-offs of providing a measure of confidence in the remote end of the connection being what you think it is and of a certain level of access control. This inevitably implies traceability, which is s good thing, unless abused. So it's the abuse, not the mechanism we should be trying to eliminate.

Randomising MAC addresses is a clumsy kludge solution to the abuse that has detrimental side effects. The fact that this kit is not good at handling the kludge is not ideal, but the abuse is the primary problem.

Not content with distorting actual reality, Facebook now wants to build a digital layer for the world

must be personally identifiable

Re photos in public places, it is still not clearly established under precisely what conditions the GDPR rights apply, so the grey areas will continue to be exploited until clear precedent emerges. This could of course be an opportunity to apply for that precedent (provided you have the dosh).

However, quite apart from the privacy question, this is yet one more departure from direct contact with the real world, which can only further degrade human engagement with life, the universe and everything . One day our entire lives will be mediated by some flat screen or other, and nobody will realise until too late how much interesting (and indeed important) detail has been filtered out.

If properly cultivated, the sensitivity of direct human sensory perception beats anything mediated by our technologies hands down - typically by several orders of magnitude. Lose that advantage and life could well seem, to quote Hamlet, "weary, stale and unprofitable"

What the hell is going on with .uk? Dozens of domain names sold in error, then reversed, but we'll say no more about it, says oversight org

Business as usual these day?

Seems like dirty business all round - "love of money is the root of all evil". However the parties to this debacle are not alone - it's increasingly obvious that conflict of interest is the foundation on which profitable business is now built.

Need to track IT kit? Business continuity? Legal? ServiceNow has a package of satellite apps for you... now

With one proviso

"ServiceNow promises its latest software can track the financial, contractual, and inventory records of company hardware to improve purchase and disposal decisions."

Great idea, provided that the kit is entered into the tracking system in the first place. Over a couple of decades, I don't think I've ever seen a complete asset inventory in any organisation. Equifax is a good example.

From the U.S. House of Representatives Committee on Oversight and Government Reform report on the 2017 Equifax data breach:

"[Chief Security Officer Susan] Mauldin testified:

Q. Did Equifax have an inventory of this type of software? Would it have been part of Equifax’s software inventory?

A. [I] think that there were various inventory lists around, and I know that in Security, we had our own list . . . . we had a list that we worked on. I’m not sure what IT had.

Q. Did you have different lists?

A. I think that there were multiple lists around that people worked from"

No tracking system can take control under such conditions.

Microsoft submits Linux kernel patches for a 'complete virtualization stack' with Linux and Hyper-V

The way forward?

If you can't beat them, join them to you at the hip.

Taking this with the recent Ubuntu Community Council and kernel maintainer recruitment problems, it sadly looks like Linux may have passed its peak as an independent alternative operating system.

Mozilla says India's planned data harvest law is 'blunt' and should be caste aside

Re: What is "non personal data"?

What constitutes "personal data" in law depends entirely on the jurisdiction. In the US for example, such legislation as exists typically specifies a list of data categories that constitute "PII" and any information not on the list is not covered by the legislation.

The GDPR on the other hand makes any category of data "personal" as soon as it can be used to identify an individual, and that doesn't necessarily mean "attach a name". So just as a hypothetical example, suppose I live on a UK street with a common post code for say 20 houses. That's not personal data as far as the GDPR is concerned. Neither is the stand alone fact that I restore steam engines. But if I'm the only person in the street that does this and both pieces of information are combined, the combined information becomes personal data, even if my name is not known, because I'm identifiable as the only guy at that post code that restores steam engines.

I get the impression that the Indian approach is also "PII", which offers much less protection to the data subject.

Another month, another cryptocurrency exchange hacked and 'millions of dollars' stolen by miscreants

A number of small companies wouldn't be able to swallow a loss of $5.4 million

Re Eterbase, it wasn't their "money". insofar as it was money at all (which is questionable) it belonged to their clients, so (depending on local legislation) the loss may only indirectly be theirs.

Re Eterbase, Palo Alto and Zoom, one day maybe someone will make sufficient effort to write robust software for mission critical applications.

Personal data from Experian on 40% of South Africa's population has been bundled onto a file-sharing website

The $64,000 question

One has to ask whether it's reasonable and proportionate for any one company to collect all this information without any choice on the part of the data subject. Just for example, in what way are "employment information which includes place of work, title, start date and work contact details" relevant to current credit rating, reporting on which which is the only even notionally legitimate function of a credit reference agency?

IBM calls for US export bans on facial recognition tech including cameras and big iron

Playing the good guy?

"This new call for a ban on exports therefore won’t hurt its software business"

Playing the good guy in public while ruthlessly sacking its experienced staffers in private. And at no loss to the bottom line in either case.

Vinyl sales top CDs for the first time in decades in America, streaming rules

Isn't it odd...

"Streaming was top of the pops, accounting for 85 per cent of revenue"

Strange how we've been brainwashed into never owning anything any more. Pay per view, pay per listen, suddenly find it's been withdrawn. Not so long ago IKEA mooted leasing flat pack furniture. The word "legacy", which used to mean something you looked forward to, now means something you want to scrap.

Soon there'll be nothing to bequeath to our descendents. Everything will have become ephemeral, so in a couple of centuries this one will appear as another dark age.

UK and Japan agree to free trade deal that excludes data localisation requirements

Re: Meh, jam tomorrow

"so there were never any barriers to data sharing with Japanese hosted systems"

Correct, but in the case of personal data there could be as soon as the UK becomes a Third Country without an adequacy decision. Japan waited a couple of years for one, and there were no serious barriers, unlike in the UK where, just for example, national security legislation and some clauses of the DPA 2018 may prove significantly problematic.

However this report appears to deal with more than personal data. For non-personal data there are pretty much no general regulatory requirements to consider other than those embodied in treaties and contracts, so you're quite right.

Something to look forward to: Being told your child or parent was radicalized by an AI bot into believing a bonkers antisemitic conspiracy theory

convincing?

The examples shown are not at all credible to anyone using their brain. They're obviously generated by some kind of automaton (note the verbatim repetition of an entire answer and the frequency of clichés). Those not using their brains can be fooled by anything at all - you don't need AI for that.

Don't be BlindSided: Watch speculative memory probing bypass kernel defenses, give malware root control

Re: Betcha a beer

'"stack-inversion" vulnerabilities where the CPU is somehow tricked into using the parameter stack for addresses and/or the address stack for data'

That of course depends on the quality of the stack management code. The best option would be stack segregation at silicon level.

However the problem can't happen in a traditional (true) Harvard architecture (even with a common stack) as code and data are separate physical memories and the "wiring" of the buses doesn't allow it. For example, there's no "write" capability in a true Harvard code space, and a data word can't be interpreted as an instruction because it's accessed separately from data memory when an instruction is fetched from code memory. It's therefore impossible for a data word to be interpreted as an instruction word.

Sadly there are now several "modified Harvard" architectures that break these rules, devised to accommodate recent desires for "self modifying code" - a concept that's intrinsically antithetical to security. These have invaded even the supposedly high reliability microcontroller space, much to its detriment.

Stack cookies, DEP, ASLR etc., etc. are all merely elastoplast first aid for the symptoms of a fundamental flaw - a common stack for return addresses and parameters.

Given the flawed von Neumann architecture we seem to be stuck with, that interprets words as code or data sequentially, dependent on the immediately preceding word (i.e. a chain of interpretation that breaks down irrecoverably at the first misinterpretation), the only practical protection would be dual stacks - one for return addresses and the other for parameters. It's not a perfect fix as we can't completely segregate code and data, but at least we could isolate them at the key decision point where the targets of jumps into code are determined.

Ultimately, if we really want to solve this problem we should migrate to a Harvard architecture.

I won't be ignored: Google to banish caller roulette with Verified Calls

Re: "if a user sees the business's name then they are more likely to actually take the call"

"I don't know what Google are hoping to achieve here"

Yet another opportunity to act as a middle man with a vested interest between the two ends of a communication they should be respecting as private.

Q: How does hydrogen turn into a metal? A: Hang on a second, I need to train my AI supercomputer first

Another possible niggle

High pressure and high temperature are typically mutually antagonistic to maintaining the solid state of matter. Is this really a "metal" state as normally interpreted, or is "metal" being used more loosely on the basis of the conductivity phenomenon?

Northrop Grumman wins $13.3bn contract with US Air Force to kick off Minuteman III ICBM replacement

Why is this categorised as "Science"?

Nothrop get a contract to design a missile. Technology maybe, but where's the "science"?

Microsoft reveals slow, staccato, disruptive auto-patching service for some Windows VMs on Azure

The reality?

The MS automated borking service that you can't avoid or control. Oh the joys of cloud!

Angry 123-Reg customers in the UK wake up to another day where hosted mail doesn't get through to users on Microsoft email accounts

Cowboys

Originally applied to builders and other construction tradesmen who operated without training and skill, thereby delivering shoddy results. There's no apparent record of the origin of the term, except by rather tenuous analogy with the supposed wild and irresponsible behaviour ascribed to real cowboys when they hit town at the end of a cattle drive.

Hey, want to make a few bucks? Let Google sell your store's Wi-Fi network capacity

Compliance?

"...to allow businesses to sell spare wireless network capacity to cellular service providers"

That's going to play havoc with PCI DSS and quite a few other security compliance standards. I wonder how many organisations will consider this before signing up.

Zero. Zilch. Nada. That's how many signs of intelligent life astroboffins found in probe of TEN MILLION stars

Surprise, surprise...

Why assume that extraterrestrial life emits electromagnetic radiation? We've only done this to any extent since around 1900, which is a mere blink in human history. Next they'll be trying to decode tweets in any signals they find, because obviously all life everywhere evolved to replicate the rise of the urban USA.

Most life in most places probably just mosies around eating, sleeping, fighting and reproducing (and always did). The rest is pure froth, and may not even last much longer here on Earth.

Tech ambitions said to lie at heart of Britain’s bonkers crash-and-burn Brexit plan

To quote Yoda...

'“Cummings - and we have to assume his boss Johnson too - are obsessed about not being bossed around by the TWO superpowers that already have trillion dollar tech companies, namely the US and China,” the post said.'

Paduan Johnson "I won't be bossed around by the two superpowers"

Yoda "You will be ... you will be"

There's no way on Earth that any UK business can now compete with the US and Far Eastern giants - we just don't have the capital even where we have the expertise. For decades now British innovators have seen their inventions sold off to (or bought up by) businesses in other more well heeled nations, and that trend its not even slowing, let alone reversing. The largest US tech enterprises are valued at more than the GDP of some nations.

To justify such a momentous change as leaving the EU without a trade deal on an aspiration of this sort is pure fantasy. It'll never come to fruition.

Enjoyed the US Labor Day weekend? Because it's September 2020 and Exchange Server can be pwned via email

That depends...

""That doesn’t quite make it wormable, but it’s about the worst-case scenario for Exchange servers," Childs explained."

That rather depends on what the malicious code does once it runs, doesn't it? Apparently there's nothing to stop it downloading a worm with network privilege escalation.

Google Chrome calculates your autoplay settings so you don't have to - others disagree

Repeat after me...

and images disabled except for selected web sites (thanks to dumb web devs increasingly including full resolution 20MB images on pages, downsampled by the browser to 640x480 or even less). That also fixes the "GIF videos".

Don’t lump us in with Facebook, internet infrastructure companies warn European Union

"My Internet..."

"many ordinary internet users often confusing Facebook or Google with the internet itself" thanks to major content and application providers, (notably MS) seeming to do the same. But it is rather worrying that regulators apparently have to be reminded of the difference.

The infrastructure approach has caused problems in the past when self-appointed anti-spam agencies have blocked huge ranges of IP addresses because of a few miscreant IPs. For example, on several occasions and for quite some time in each case Tsohost has been entirely blacklisted by Plusnet because of this.

Australia starts second fight with Google, this time over whether app stores leak data, gouge devs, steal ideas and warp markets

"whether app stores leak data, gouge devs, steal ideas and warp markets"

Yes, yes, yes and yes.

AI in the enterprise: AI may as well stand for automatic idiot – but that doesn't mean all machine learning is bad

Re: AI = Advertising Insertion

"At best it can eliminate the human bias to find patterns where none exist"

In theory, maybe. But in reality, because nothing can "make sense" to the machine it can, and does frequently, misinterpret patterns. There's masses of research on this from road signs to turtles.

The human capacity for recognising the incongruous has not so far been understood well enough for any real attempt to implement it on machines. However I think it may be based to a great extent on the truly vast amount of experience a human has gained by the time they're an adult. The "training set" is probably many orders greater than any we have for "AI", as the human has been gathering and sifting information with context for a couple of decades 24/365 by the time they're compared to the machine.

In any case, every implementation of "AI" so far has been a "one trick horse", but humans are at best versatile.

However, for basic repetitive jobs, "AI" can be cheaper and faster than humans. On the radio today it was reported that a machine learning based cherry sorter on a fruit farm can sort 30 cherries a second and replace 40 people.

No, Kubernetes doesn’t make applications portable, say analysts. Good luck avoiding lock-in, too

Not just Kubernetes

Once you're committed to any cloud technology or provider it's remarkably difficult to extricate yourself. It's not just a matter of contractual tie-ins - it's about actually recovering your data and ensuring your processes continue to operate. Some time back I investigated two mainstream cloud based SaaS "office services" and found that their internal data formats were sufficiently different that you couldn't transfer files between them without utterly corrupting the presentation of documents.

"When you've got them by the balls their hearts and minds will follow" Charles Wendell Colson

Equally, their wallets.

There can be only one: Visual Studio Codespaces 'consolidating' into GitHub Codespaces

Oh the joys of "cloud"

'Developers have until 17 February 2021 to shift off the Azure incarnation and into the loving embrace of GitHub Codespaces. At that point the Visual Studio Codespaces portal will be retired and "all plans and codespaces remaining in the service will be deleted," according to Microsoft.'

All our code back to the mid-80s is archived locally in our workshops. No third party can suddenly decide to delete it or force us to "migrate" it. There's much to be said for DIY.

AI in the enterprise: Prepare to be disappointed – oversold but under appreciated, it can help... just not too much

Whose intelligence?

The key question that nobody seems to be considering is what criterion we use when comparing machine and human intelligence. Having watched AI developments for some 35 years I still note that pretty much every implementation is and has always been a "one trick horse".

The key aptitudes that distinguish smart humans are versatility, adaptability and the ability (which we still don't understand) to exercise intuition, and in over three decades I've seen no evidence that "AI" can do any of these autonomously. Consequently the greatest danger is that we may be aiming to replace humans with simulacra of rather dumb humans. The inevitable outcome of this will be ever reducing societal expectations of human mentation, which as a result will be less and less cultivated. This ultimately cannot avoid adversely affecting the developers of AI as they are drawn from the same population, so there's a good chance the quality of the technologies will spiral downward.

It might be more effective in the long run to improve our education systems so we can unlock the vast pool of increasingly wasted human potential.

SMEs to UK.gov: We need vouchers for tech and training ahead of final Brexit curtain falling

More than vouchers needed here

Some detailed reliable guidance would also be a good idea. But of course that would depend on having a clearly defined a stable regime to base the guidance on. It seems from the news today (e.g. proposed legislation to override parts of the withdrawal agreement) that the ground rules are still changing (or more realistically, there are still no ground rules and HM Govt. is merely winging it), so I'm not at all sure how vouchers will help until this muddle is eliminated.

'We're not claiming to replace humans,' says Google, but we want to be 'close enough' that you can't tell it's a bot talking

A rather limited criterion

"to be 'close enough' that you can't tell it's a bot talking"

More to the point should be "that you can't tell it's a bot answering"

The real trick is to demonstrate intelligence so the responses make sense, regardless of the question.

Astronomers get more than they bargained for, as Mars probe InSight's instruments detects solar eclipses

Provided this is repeatable...

It must be a pretty amazing sensor. More power to the engineers. Way back when I designed experiment equipment we always built in more capabilities than were strictly asked for, but this one takes the biscuit. 10^-8 is about two orders better than is typically considered the maximum for electronics in the field - it's a normal limit for calibrators in ultra quiet environments..

Why cloud costs get out of control: Too much lift and shift, and pricing that is 'screwy and broken'

Surprise, surprise...

"When you've got them by the balls their hearts and minds will follow" Charles Wendell Colson

Equally, their wallets.

Once you're committed to a "cloud provider" it's remarkably difficult to extricate yourself, or even to change provider. it's not just a matter of contractual tie-ins - it's about actually recovering your data and ensuring your processes continue to operate.

What the world needs now is socially-distant robots, says Japan

An alternative explanation?

"Japan has an ageing population and has therefore made significant investments in robots as assistants for the elderly ..."

Maybe they're primarily needed because the traditional extended family support has ceased to operate, as it mostly has in the "west".

The two key things a robot can't offer are compassion and companionship. It can only provide shallow simulacra of both. But both are required by humans for maintenance of emotional health. This has almost universally been forgotten by the "caring" professions, which tend to consider their clients as machines needing servicing - what I refer to generically as "Quick fit Euro medicine" - walk in, have your faults diagnosed and repaired and walk out again without any real human interaction.

A long time ago in a galaxy far, far away... a pair of black holes coalesced resulting in largest gravitational wave we've seen

Talk about second class post!

A 100 millisecond message delivered after seven billion years? Even my local postal service does better.

But seriously, this just goes to show how difficult it is to make scientific sense of the universe. There could even be mechanisms we've not yet seen for the first time that could entirely change our views of physics. More power then to the astronomers. I'd love to have a job like that.