Posts by heyrick

iOS phone phlaw can UNMASK anonymous users on social media

Re: Nothing new

...but if you don't have multiple dialers, it'll just go right ahead and place the call. Indeed there was a "pl

problem" not so long ago with specially crafted numbers.

Virgin Media blocks 'wankers' from permissible passwords

Ummm...

If it is the client side scripting doing this, doesn't that imply that those with friendlier browsers can easily rewrite some of the rules and use whatever damn password that they want without this dumb nannying? Passwords should be known to the one using them and nobody else.

Pay to play: The hidden cost of software defined everything

They used to do this with hardware

Video recorders - when they stopped being boards piled full of analogue circuitry and became a single board with a handful of ICs, you could sometimes "upgrade" it by altering links on the board. After looking at the number of heads on my drum, and finding a service manual, I was able to upgrade a cheap VHS deck to Nicam stereo and SP/LP. Seems it was cheaper to build "a video deck" and make the model differences by wire links on the board, than the expense of designing and building several completely different models.

Banking apps: Handy, can grab all your money... and RIDDLED with coding flaws

Re: Just don't do it

"Which bank is that ?"

Crédit Mutuel de Bretagne (bet you weren't expecting that!). I would imagine it is likely the same for any of the regional versions of the Crédit Mutuel family.

Re: Just don't do it

My bank is okay. The code might be utter crap, but the app permits me to check my balance, review a screenful of account activity, order a chequebook, transfer money from one of my accounts to the other. Err... Err... Maybe I can auto-phone my branch too. Or something.

But, then, this is the same bank that requires me to generate a virtual credit card for online use as the real card is blocked from use in any situation where I am not physically present. Can't even use it to pay the electricity bill!

Certainly, I get that this is ultimately about reducing the bank's exposure to risks, but I'm okay with that if it means my account is that much less likely to get screwed over as a result of this. The hassle that would cause doesn't bear thinking about.

Re: Not surprising

"1. The C language and its derivatives. Biggest mistake in the history of computers. Every time you hear about a buffer overflow error in software, realize that it's due to a fundamental design flaw in the C language that leads to the same error repeated over and over."

I would certainly advocate a compiler option to include bounds checking, however...

Screwing up buffers and pointers is not uniquely a C problem. You could make the same mistake on the BBC Micro with code like pointer%!0=blahblah% which might go badly wrong if pointer% wasn't actually pointing at the bit of memory you wanted to write to.

That said, aren't apps written in a bastardised Java (Android) or some sort of distantly-C-like (iOS) both of which are capable of trapping buffer overruns?

"If civil engineers had used building techniques as flawed as the C language, our civilization would lie in ruins today." - we don't (usually) make buildings with faults because even by a process of trial and error we'd learn pretty quickly how to correct these issues. On the other hand, we seem quite content to build entire societies with hokey specifications that make the C standard look a paragon of perfection. Turn on the TV news and count how many seconds elapse before there is a story regarding a bunch of people dying or killed as a result of theologies with holes big enough to fly an Airbus through.

"2. The preferred modern software development method of "code and test incrementally until it doesn't crash any more"."

Yup. Life was much nicer in the era of software supplied on ROM. If it came on EPROM, you knew to expect some quirks. But if it came on a ROM, well, a faulty ROM set could sink a company so there was none of this "push out what we have and fix whatever develops in the field later" idea.

Now we can have software that checks for updates daily. Sure, it can give you an improving user experience and more and more features, but this is only because the product was a rush-job pile of loosely interacting bugs to begin with. When you start with manure, most things are an improvement...

Get ready: The top-bracket young coders of the 2020s will be mostly girls

Your point is?

Wow, this is almost too easy.

Quote from yearofcode.org : It is really simple to learn and anyone can do it It's right there on the front page.

She, the woman heading up the project, cannot code. What does that say about something apparently so simple anybody can do it?

RealVNC distances itself from factories, power plants, PCs hooked up to password-less VNC

Re: Legality ?

" It is therefore available to the general public in exactly the same way that a public website is. "

Just because you CAN access something doesn't imply you have the right TO access it.

Hello, police, El Reg here. Are we a bunch of terrorists now?

Re: Ask a policeman

"They 'execute' orders and instructions from the Home Office and courts etc"

And once in a while take the "execute" part a little too literally.

Re: Manufactured story

"However, a pattern that see you viewing several such video nasties,"

Depends upon the exact definition of "video nasty". A while back I looked up earthquake videos. Watched a few of those (and decided being in an earthquake would freak the hell out of me). This led on to TV bloopers, with somehow led on to an apartment block (Philippines?) falling over, which lead on to other building fails, and then a few spectacularly dumb crashes, the epitome of which must have been a B52 doing what looked to be a barrel roll without understanding that the wings were quite a bit longer than the space between the cockpit and the ground. To cap it off, I watched the Russian Tsar bomb. <big><big><big><big>Boom.</big></big></big></big>

Wasting time on mindless stuff is what happened. Sick sad curiosity, mostly. But I reckon a disgruntled cop with an issue could make a lot out of: collapsing buildings, crashes, plane crashes, nuclear-frikkin-weapons. You see I'm going with this?

I'm not convinced most people would know what sedition even is.

That green gooey gunk you get at the bottom of a fish tank?

UK fuzz want PINCODES on ALL mobile phones

Re: we need the public to become educated in the tools they are using and what can be installed

" So that issue still needs to be addressed, which means those 'normal's need to start giving at least half-a-fuck and making the effort to understand some of the tech. "

This is the main thing, to explain why phones are passworded and why they shouldn't make their first request "turn this off".

e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt

Must be nice to fail to deliver and then sue to get paid.

Maybe Govt could counter sue for failure to deliver, for beeeeelions for leaving the country in an insecure state, blah blah?

Rupert Murdoch says Google is worse than the NSA

If you don't trust the NSA to collect data, why would you ever trust Google?

Who says we trust Google? Or the NSA? Or News Corp? Or Murdoch himself?

Oh, the old coot is just pissed...

...'cos we're giving attention to Assange today.

Or something.

Like I care. I cannot value anything to do with integrity and the like spoken by that guy.

Assange™: Hey world, I'M STILL HERE, ignore that Snowden guy

Uhhh...

What kind of nut job actually brags about how much "evidence" has been gathered against him?

And how does he know how much anyway, unless the Feds get a kick out of reporting to his lawyer ever increasing numbers because they know he'll fall for it . . . 40,000 pages is no big deal but if we hit 45,000 then we're screwed! Julian, it's not an oil change!

Giving your old Tesco Hudl to Auntie June? READ THIS FIRST

Started off a logical enough article...

...after all, a factory reset that doesn't is pretty poor, especially if there is no obvious (non-geek) way to wipe important data from the machine.

Then Mr. Munro makes the illogical leap from a badly wiped tablet sold on eBay to providing information for weirdos to stalk your children (the obvious question is that this only means a damn if the purchaser is a kiddie stalker, has the knowledge of how to get into the device, and most importantly of all, lives nearby). As if this wasn't bad enough, somehow having end user information on a cheap supermarket tablet will automagically help a stalker avoid a police sting? How is this? Will it start playing the theme tune from The Bill whenever a cop car drives by?

Mr. Munro, you might have had a good and convincing argument if you warned adults about their login details, credit card information, etc being potentially accessible by the person the tablet is sold on to. But this half-assed "think of the children"? That's an even more desperate attempt than one would expect to see in The Daily Mail. So go away. Very far away. Preferably in a coffin. Thank you.

Murder accused DIDN'T ask Siri 'how to hide my roommate'

Re: No detracting from the evidence but.............

If the phone hadn't been switched off (and maybe if it has?), there seems to be something akin to dmsg that records all sorts of events and their status. I would imagine "flashlight app started" followed by something about "hardware led active" would be among the entries.

Password manager LastPass goes titsup: Users locked out

Hang on...

Am I missing something here?

How are your passwords safe hosted on a third party server?

Why does a password manager need to have any information leave your system?

Hollywood star Robin Williams dies of 'suspected suicide' at 63

Re: Why are so many celebrities depressed and/or suicidal??

I think it is the expectations, the way everybody is always expecting you to be a certain way, a certain type of person... I guess in this respect Robin Williams was lucky in that he established a body of serious work alongside his Mork-style rapid delivery comedy, and showed he could do both.

Then, then when you make it huge, everybody expects your next role to be greater, better, more impressive. And if you aren't, if the movie isn't good, if you didn't capture the essence of the character in some arbitrary way a critic interprets the character as, you are panned, you are useless, you totally ruined everything, blah blah.

Bugger that for a game of soldiers. The celebrity world isn't even remotely real and there's no amount of money you could pay me to get involved in that.

An earlier poster said he was single, in a bedsit, and pretty much a useless <bleep>. Well, I'm not depressed (I don't think?) but otherwise the story is similar. But you know what? I'm okay with it. Nobody has expectations of me, I don't have expectations of anybody else. I just pass through life quietly in the shadows and enjoy things at my own pace.

The tragedy, I suppose, is that today we are reminiscing about a great talent. Yet, for every famous person in this situation, how many others that we never know?

US 911 service needs emergency upgrade and some basic security against scumbags

What hasn't been mentioned...

Wouldn't the local police probably know the addresses of local celebrities? Before dispatching SWAT to those locations (especially Kutcher, who pranked punkd a lot of people), they might want to get a confirmation?

HTTP-Yes! Google boosts SSL-encrypted sites in search results

Field day for MITM attacks on open wifi

Several French hospitals, and KFC (France). Hook up to their WiFi and try to go to an https site, Safari pops up a request for an SSL certificate that is completely different to the one you expected to see. So while Google is pushing us towards greater security, some hotspot providers (no doubt in the guise of "protecting" us/children/profits) are intentionally smashing down said security.

http://i.imgur.com/nDt8id4.jpg

[kudos to McDonalds (France) and Buffalo Grill, who not only leave https alone, but also permit a VPN to be used so you can fetch mail and stuff without other people snooping....which is supposed to be why ssl on an open AP is a good thing, right?]

CIA infosec guru: US govt must buy all zero-days and set them free

Re: This will begin computing as IT should be? Or as the Few can Phorm IT? :-)

"or anyone who hasn't done a minefield of crash testing, heyrick"

amanfromMars 1 name dropped me! Whoo-hoo!

Re: this will end computing as we know it

" proprietary and properly tested "

You must be talking about Microsoft.

No? Maybe you are talking about Flash?

Adobe Reader?

Or...? Ubuntu? Android? iOS? Everything has patches and updates to correct errors (and sometimes, to introduce new ones!).

If the big companies have to provide regular patches for the same sorts of flaws (buffer overrun and failing to sanitise inputs), isn't it a bit rich to expect a non-pro part time coder to turn out something better? If in doubt, refer to OpenSSL for an example of the supposed specialists getting it wrong, and to WPS for an example of a protocol broken from the outset. Software is a very complex thing with zero tolerance for mistakes, created by creatures who are imperfect and make mistakes. I disagree that we the populace should serve as an army of beta testers, but likewise I think expecting absolute perfection is a dream...

this will end computing as we know it

Somebody should tell this guy that there is something between big commerce and open source.

How about the army of bedroom coders who release their software for free, but don't want to make it open source? There's quite a few of them around, and applying the same legal liabilities for something given away for free would most likely make them think "sod it", especially if they don't feel (for whatever reason) that they want to make the source available.

Simian selfie stupidity: Macaque snap sparks Wikipedia copyright row

Re: Good article.

" if a human doesn't take the picture that it's not theirs to hold copyright "

On the other hand, if a monkey cannot hold copyright, then surely it should be taken down as nobody rightfully holds copyright? The rules are that something is not public domain unless the creator says otherwise.... Well? Who said otherwise, Jimmy?

Surfing the web from Android? We KNEW it – sorry, iOS fanbois

Re: Yeah but...

"As far as I can see, not one Android owner has a mobile data plan with the word "GB" in the name of the plan. It's all ZERO MB here and 100MB there."

Mine's 500MB. I could pay a little more and get 3GB, but given that I finish the month with over 100MB remaining (unless I'm in a belligerent look-at-kittens-on-YouTube-to-use-up-my-allocation mood), there doesn't really seem much point in going for more. http://open.orange.fr/forfaits/forfaits-internet-plus-mobile.aspx

Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network

e and e

Downloading a movie? Economic terrorism. Funding terrorism by dodgy adverts on dodgy sites. And, um, unspecified we'll-think-of-something-later terrorism.

IP = complicated internet stuff. Using the internet? Well, surely that's some sort of terrorism as well, and if not, we'll just redefine what "terrorism" is.

Therefore, guilty as hell, burn forever you horrid little terrorist you!

Mine's the one with the Daily Mail folded and tucked into a large pocket.

Re: Not wanting to defend plod, but

"However I am guessing they get the same internet facing IP. Can't test it just at the moment tho."

Orange France has a public WiFi network running on the back of home internet connections, using APs called "orange" instead of the usual "Livebox-XXXX" (last four digits of Mac). You need to log in using your credentials - orange email name and password IIRC. It is done in the manner that if you offer a public access point, you have the right to use other public access points, but if you turn off the public AP, you lose the right. As I live in the back of beyond and you can barely get access through the stone walls, it doesn't bother me to leave it switched on.

Aaaanyway, I did some tests and the public AP gives you a completely different public IP address from the private one. I didn't bother testing QoS as my downstream is only 2mbit so it doesn't take much to knock that on the head. I might try it sometime and see how the Livebox allocates bandwidth if only the public AP is running, and if the private one then starts a download...

Edward Snowden's not a one-off: US.gov hunts new secret doc leaker

"it is impossible to tell a good guy from a bad guy; that person can take their time to siphon off large amounts of data without being detected."

To be fair, one could say exactly the same thing about entire governments.

What's the point of the Internet of Things?

Disagree

To answer the last point first, I try to see people as people regardless of any perceived disability or the usual other differentiators. Frankly, I don't see how a smarter house is going to make a damned bit of difference there. Indeed, since you mention those with mental afflictions, autism for example, don't you think that these people are the ones most likely to end up being abused by their IoT equipment? Ultimately, the businesses behind IoT don't care about whether or not our fridge can suggest meals for us. It is more interested in the brands of milk we buy, the way we shop, the sort of things we eat. All information for profiling for selling to advertisers. I also fear that any sort of display device will default to "advertising" when not specifically in use. While I don't have any antipathy regarding a microwave touchscreen informing me how great <product> is, I am wondering how much electricity (that I would be paying for) would be consumed in the process, for all of the IoT devices over the course of a year.

Next, this site itself is rife with stories of the abysmal levels of security in many embedded devices, which seem to be put together with the idea that "it's safe, nobody is looking". In the process of trying to figure out how to extract some information from my Livebox (damn hard!), I noticed that the login process in the new crap firmware was an HTTP POST with this URI: http://192.168.1.1/authenticate?username=admin&password=xxxxxxxxxx I actually spat my drink on the floor when I realised that the box was passing the information around "in the clear". Good God, if a big service provider makes basic mistakes like this, what hope do we have of believing that the majority of IoT devices will be in any way "secure"? I also worry that when IPv6 rolls around, everything will have its own public facing address and at least hiding stuff behind a NAT will get that much more complicated.

I remember the home computer boom in the eighties, following by the office computer boom in the nineties. Are we still chasing the dream of the paperless office, or have we put that to rest?

Finally, you present the interesting idea that so much sleep entitles us to so many decisions, roughly we have a finite amount of thinking ours brains can do at any given time. Well, once upon a time coming home from shopping used to involve the boring bit where you'd take the stuff out of the various bags and boxes and put it into a location that sort of resembles a logical pattern - for instance you wouldn't put sugar under the sink with cleaning fluids and cat kibble into the fridge. You might also dedicate certain parts of the fridge to specific things, so you don't have raw meat and lettuce squashed in beside each other. Now what? The thing that people seem to forget is that if a fridge needs to know what is in it, it needs to be told. How? Barcode scanner? Are you expected to scan in every single thing? What about fresh goods that are given a scan-code that is unique to the shop? What about your shelves? Are you going to be obligated to scan everything? It might be logical to assume that the shop could inform your house, but this is making the assumption that you are always buying things for your own use, you will always take everything home (instead of, say, something to eat on the way or a ready meal to eat at work), you will always shop in the same shop, and also that you want your house (and/or it's occupants) to be aware of every single thing you purchase. Let's just say you are badly constipated and your doctor makes a prescription for this little bottle of stuff you squirt into your backside to get things moving again, and since you have never done it before you buy a bag of adult sized nappies "just in case". Bingo! Your house knows. Your family knows. Your service provider knows. And the advertisers that this information is shared with knows. You might never actually need the nappies, but by damn, everybody knows, just like that Leonard Cohen song. So much for anything even remotely resembling privacy.

On the scale of things, I think actually I would prefer to have my life a little less smart. Sure, it is sometimes difficult to think of meals that I can make given the assortment of stuff in the fridge, and to say I'm any good as a cook is a dangerous exaggeration, however what is the alternative? To become a drooling zombie dependent upon the technology around me? I guess you'd better pass me those nappies lest I forget how to pee if a cute little animation on the toilet doesn't remind me how...

Apple wins patent on charging iThings THROUGH THIN AIR

will be charged using magnetic resonance from up to a meter away from the source

Whoo, imagine the Ts&Cs on that product, to wiggle around health issues and the huge amounts of interference that it is likely to cause.

I used to have a magnetic resonator that had a range of about a metre. It was a "wand" for degaussing cathode ray tubes...

Google on Gmail child abuse trawl: We're NOT looking for other crimes

Re: slippery slope or lawsuit magnet?

"Google is legally required to report suspected child abuse" - from my understanding, based upon a hash and the original file then deleted.

While the person in question did turn out to have other material in his possession, surely it should be unlawful to have done any of this if the original content that kicked it all off could not be produced? Otherwise isn't it a bit like "we think you're guilty of something so we'll come up with a reason to shake you down"?

Windows Registry-infecting malware has no files, survives reboots

Re: "a tool Microsoft uses to hide its source code from being copied"

"It appears that you are asserting that the registry is a good option because file systems are shit at handling small files..."

Nope, that's your assertion. I'm just trying to imagine what would happen to the file system of a regular Windows PC if it had to deal with its configuration as a billion tiny files instead of the big hulking mess that the registry is. Neither option seems satisfactory, but since Windows is extremely limited in what it understands as a file system, the registry is probably the better option there, for now at least. This doesn't mean it is a good option, and great file systems on other platforms are not particularly relevant if they're on other platforms and not where they're needed...

Re: "a tool Microsoft uses to hide its source code from being copied"

"How is the registry (which looks a lot like a directory tree) more "scalable" than a filesystem ?"

LFAU? I wouldn't appreciate losing gigabytes of storage to handle a few tens of megabytes, maybe a hundred megabytes, of configuration data.

Re: "a tool Microsoft uses to hide its source code from being copied"

"It doesn't get cleaned up properly unless you use 3rd party tools so it bloats." - my experience is to just let it bloat. Registry tidying tools seem to break a lot more than they fix.

Ad biz now has one less excuse to sponsor freetards and filth

Re: I DON'T like filth

Dull is good. Dull is how it was before Web 2.0, and it was perfectly fine that way.

and returns 96 data points every time an ad is served,

Yet more scripting to block? Yet another entity tracing our activities across the web?

Crumbs! Holiday phish based on genuine hotel booking surfaces

just go to your bank and send a wire transfer to our account below

...and it doesn't seem strange to buy a holiday in Spain and pay to Poland?

It's official: You can now legally carrier-unlock your mobile in the US

Bizarre...

Over here in France, it is possible to unlock a subsidised phone after about three months. Used to be complicated, but now (Orange & Bouygues, assume SFR is similar) it is just a web form and the code is sent by mail or SMS.

I unlock my phones the moment the period expires so if my mother needs a phone and her one is acting up (it is ancient), I can swap SIMs. As far as Orange is concerned, it is no loss to them. All of my calls are included within my contact, and I'm still tied to my XX month contract, with a pretty hefty penalty payment is I want to quit early.

What's that? A PHP SPECIFICATION? Surely you're joking, Facebook

Wow.

With an actual spec to pretend to follow, we'll no longer have new improved versions that break things written for older versions in annoyingly subtle ways.

Oh, wait... Since this spec wasn't written by the PHP developers themselves, what relevance (if any) would it really have?

Russia to SAP, Apple: Hand over source code to prove you're not spies

What hath Snowden wrought?

Given some of the interesting ... "diagnostics" ... aids that have recently been found in iOS, I think the only involvement of Snowden was to lower our level of trust enough that we'd start to see that which was hidden all along. This, they brought upon themselves.

'Things' on the Internet-of-things have 25 vulnerabilities apiece

StumbleUpon is ruining your site

There is some sort of problem on their end, so they notify us about this by opening a frame the width of the page, obliterating huge swathes of the content I came here to read. This is obnoxious behaviour.

http://i.imgur.com/MdR1WhA.jpg

Scotland's BIG question: Will independence cost me my broadband?

Re: Realism

The thing that a lot of Europe doesn't quite get is that Scotland is not an annoying rebellious region wanting independence. It is a separate country, and it wants to be a separate autonomous country. British history is messy.

Israel's Iron Dome missile tech stolen by Chinese hackers

Re: Oh Goody, Chinese Knock-offs On Their Way

"is by Hamas deliberately taking their rockets to launch from areas that are known to be occupied by Palestinians."

And, yet, strangely enough it seems that Israel (and the world) knows that there are civilians there...and it still feels the need to "defend itself" by lobbing over bigger and more effective bombs instead of something more subtle and targetted.

With the technical intelligence that Israel thinks it has, and the backing of America, the only reason I can think of for why Israel hasn't taken out Hamas sooner and more discretely is that they don't really want any Palestinians left there at all.

How long is too long to wait for a security fix?

Re: Home router patching? You're having a laugh...

@ Trevor: Does it offer SIP VoIP with a socket for regular phones? I have a backup spare WAG200 router with open firmware, but when I use that, no phone...

Home router patching? You're having a laugh...

"Patching your NAS is important, just as it is for your home router, switches, firewalls, servers and endpoints. Sadly, as has been made quite obvious, a great many people simply refuse to do so."

Last week, Orange (France) updated the firmware in (some? all?) of the domestic Liveboxes, after - when was the last update? 2012? Anyway.. This adds a nifty looking user interface that is horribly broken, gives you advanced configuration options that just don't work right (good luck associating a device with a 'fixed' IP address on the (W)LAN via DHCP), gives you an 80:20 chance that the box won't recognise a USB key plugged into it, and means the previously working DNLA server struggles with 720P and even some 480P content. The Livebox 2 (Sagem) is locked up tight. I really wish I could revert to the previous firmware, and disable auto-upgrades. Instead, we are all beta testers in software that is very clearly not up to expected release quality. I suspect this is tied in to IPv6 that Orange might be rolling out around 2017, maybe...

I am not against the idea of automatic upgrades, especially in domestic devices, however when said upgrade is clearly rushed out the door, unfinished, and mucks up stuff (people of Orange forums have reported drops in connection speeds and alsorts, but since my pipe is only 2mbit, I wouldn't notice!), it is hard to be in support of such automatic upgrades.

Point being - whether or not the home router firmware is updated is out of our hands, and it is especially galling when such upgrades are forced and offer a worse experience then before.

Apple smacked with privacy sueball over Location Services

Re: Who reads that cruft anyway?

Update iOS? Update AppStore? Update...

You get a square box on the screen, maybe 2/3rds the size of it, with text. A helpful indicator shows that there are over 40 pages of it to read. There's no indication of what is no or different to before, and best yet, there is no "I disagree". The new software has been installed, there is no (simple) way to revert to what there was before, just an "accept this rubbish and you can carry on using your iThingy" button.

PayPal post-checkout cash slurp a FEATURE not a BUG

Re: So buried in an email you ignore...

To follow up - it would be an interesting case for eBay seems to think that clicking the "buy" button is completely binding and commits you to purchase (I'm talking about a buy it now, not an auction). You are now in a situation where you are committed to buying something that the vendor could pile on some additional charges not mentioned in the price shown by the buy it now button...

Re: So buried in an email you ignore...

" There is also some onus on you to check emails. "

And what is your recourse if somebody whacks some extras on to an amount already agreed, PayPal seems to think this is okay, and the email is notifying you that the extra has already been paid...