Posts by Spearchucker Jones

'Hey, Tories, who knows what a nontrepreneur is?’

WTF?

Can't really work out the point. I don't know any programmers that can't program*. That part with Richard Attenborough makes zero sense to me. And I'm left feeling that knowing what a nontrepreneur is must make you part of some weird club.

All I can get out of it is that there are loads of smaller tech companies that aren't making money (their fault), and some big ones that are. I knew that! I'm not sure what the Tories and Labour have to do with it.

The article seems to try to be edgy and with it and assumes readers know what it's about, yet completely passes me by (maybe I'm the only idiot in the cheap set, and everyone else DOES get it).

Copyright theft is a prblem, yes. Waiting for government to do something about it is like blaming McDonalds for being fat. It's like the guy who writes an Android app that costs £0.099, and a day after release sees a hacked free version in the app store. If he'd done his homework he'd have known that if the app is good, hackers will make it available for free. Cool. That's the environment Android apps are in. Find another revenue stream, like making the app free and charging for access to a service the app uses.

Take responsibility for your decisions, and stop thinking world + dog owes you handouts. From the government or anyone else.

* I know many who program well, and just as many who program badly.

Microsoft's Roslyn invites VB to Windows 8 party

@boltar

Dude, are you serious?

Creating an OS kernel is not quite the same as recording a customer interaction in a database. Using Word has different requirements (low memory footprint, 'specially when a document can be 100's of Mb large) to a CRUD app.

Why d'you think that SharePoint, Dynamics, etc. are written (by Microsoft) in C# rather than C++ (not even managed C++)?

@Mage

That's the argument I hear every time this subject comes up. And it's bullshit.

The only thing VB.NET missed that C# had was unsigned ints. And that was included ages ago.

The reality is the other way 'round, actually. The My namespace doesn't even exist in C# (up to and including v4.0). As an (one) example, testing whether a network connection exists in C# requires pinging a server. In VB all you do is check My.Computer.Network.IsAvailable().

How is it easier to go to C#? VB.NET shares an identical syntax with VB6.0. Moving to C# requires learning the framework as well as a new syntax.

VB devs move to C# because they're given stupid arguments like you just made, without doing any homework themselves.

Make a real case.

No. It isn't.

It's like saying that Test Driven Development is the only way to unit test.

I've been coding in C++ with MFC since the early 90's, and in C# since the beta was released in 2001. C++ is fast and lean, but that's about it for most modern-day programming tasks. It introduces more security holes than any other popular language these days, and takes twice as long.

That old gem.

I spent four months in Building 25 on the Redmond campus in 2004, and at the time there was much anticipation and debate around the 64-bit support promised by Visual Studio 2005. Many were saying that VB was dead, and that VB wouldn't support 64-bit dev.

VB is still popular enough that Microsoft added support for it in the Windows Phone SDK. My professional coding is done in C# because that's what the company uses, but I still prefer VB. It is more intuitive and requires less code than the equivalent C# code*, and compiles to almost identical MSIL (both languages share most optimisations, but have some optimisations the other doesn't).

I keep thinking that the point of .NET's multi-language support was missed. Use the language you're most comfortable with, and thereby get productive quickly. And yet all ex-VB6 devs I know decided to learn a completely new syntax by going with C#. Weird, that.

Anyways, F# has an even smaller user base. And that's sad in a way, because there are things that functional languages like F# and SCALA just do a whole lot more elegantly than OO-based languages like VB, C# and Java. The best bit is that a single VS solution can contain projects written in any of the supported .NET languages.

* Before the inevitable flaming starts, have a look at the observer pattern in both languages (specifically RaiseEvent, VB, and the mess that is the C# equivalent).

MS names Nokia WinPho models in compo blunder

True.

Thank god for Linix.com and the Linux Foundation.

Pandemonium as Microsoft AV nukes Chrome browser

But it's true!

Chrome IS a virus!

Microsoft’s Mango update falls from tech tree

@OrsonX

Yes, it does. Under Settings > Ringtones+Sounds you can customise the following:

Ringtone

New text or IM

New voicemail

New email

That may be...

...but you're free to uninstall any pre-loaded app (in fact, any app) you like on WP7 and WP7.5.

Cloud startup's business model defies laws of physics

Erm...

Dude, without prejudice, I iamgine you're probably not familiar with assymetric and symmetric encryption. If you're interested, check out how PGP managed session keys. Similar concept, different application.

If I upload a file it is encrypted using a symmetric key I own. If I then share that file at a later stage all I have to do is to share the symmetric key using my friend's public key. This would be done at the point where I instruct Bitcasa to "Share file.ptt with UserX".

The system knows two files (or file parts) are identical because their hash values are identical. Yes. This means the hashing password must come from the server.

I did not specifiy where keys are generated - I don't know that. Either client or server are a good choice, depending on your objective.

There are some very sensitive documents that use a similar protocol to make encrypted content searchable. Your risk analysis will highlight the impact and probability of any weakness. It is then a business decision to mitigate (manage), transfer or accept those risks.

Many problems I've worked on choose to both mitigate and accept - i.e. in the search implementation I did, the search index was also encrypted. AES was fast enough for that. The threat model showed that accepting the remainder of the risk (shared symmetric key for the index) had business legs.

YMMV.

Technology is easy. People and process are not.

Easy enough...

...when your hashes are computed from the unencrypted source. You could split the file into block-sized chuncks and hash those. Or you could treat file contents (e.g. individual PowerPoint slides) separately. If fact you could templatize file chunking based on a new policy downloaded from the server for each and every session. If you wanted.

How the hash values (if that's what they're using) are computed will determine the granularity of deduplication. From there the problem is one of indexing and content management.

The real security issue such a system faces is key management. There will be a public/private keypair (async) for every user, and another for every user's device. There will be a syncronous key for every file. That's a lot of key management.

I guess the final point is that using a well-thunk-through combination of async, sync and one-way encryption, it's entirely possible to compare segments of files you don't know the contents of.

Quite possible, actually.

All the posts I've read so far seem to talk about asymmetric encryption, or symmetric encryption. It is entirely possible to do what Bitcasa are claiming. Although I wonder if they got it right. Anyways, the classic Needham-Shcroeder protocol (assuming you replace nonces with timestamps) provides a good basis for it.

It works like this:

Alice is a subject that submits a file

Bob is a subject that has shared access to Alice's file

Sam is the Bitcasa server

Alice calls Sam and says she'd like to share a file with Bob.

Sam makes up a session key message consisting of Alice's name, Bob's name, a key for them to use, and a timestamp.

Sam encrypts all this under the key he shares with Alice, and he encrypts another copy of it under the key he shares with Bob.

He gives both ciphertexts to Alice.

Alice retrieves the key from the ciphertext that was encrypted for her, and passes on to Bob the ciphertext that was encrypted for him.

Next, Alice creates a hash of the unencrypted file, and sends that to Sam for indexing.

Alice now uploads her file to Sam, encrypted using the key from the ciphertext that was encrypted for her.

Bob has access anytime he likes, using the key from the ciphertext that was encrypted for him.

Simples. If, as I said, they got a). the protocol right and b). the implementation actually reflects the protocol.

Windows 8: First contact with Microsoft Touch

Enterprise tools...

...implies business use. That's where both Android and iOS fail.

Totally dude!

And aside from the penguin, Linux is no different to Xenix. When I grow up I want to be just like you.

Because...

...the default XAML environment for Windows is WPF. Silverlight is too much of a lightweight for tablets. It's the reverse of when everyone said Windows Phone should run on tablets. And only because iOS runs on tablets and phones.

The underlying architecture in Silverlight was never designed for rich client applications. When originally conceived, it was designed for rich Internet applications.

Windows 8 Tablets will pwn Android.

"...it will not be easy for Microsoft to establish it, given the dominance of iPad and the strength of Android in the tablet market"

Windows tablets will own, not because Windows on tablets better than Androind (I doubt it is), but because Microsoft will include enterprise tools and support that Google is unable to include in Android.

MS, Samsung to show Windows 8 tablet at Build

It might just.

Windows 8 will come with the usual MIcrosoft enterprise tools and technologies, and that means tablets get the same - pushing, I'll bet, non-iOS tablets into the business mainstream.

Google missed their chance. Instead of me-too tablets they could've worked on a group policy implementation for Android, or even just put more effort into the Android app store so that organisations can deploy private enterprise apps.

Like the Ballmer or not, these are things Microsoft is good at.

Ice Cream Sandwich Android out 'by November'

You may have to wait.

If Q4 devices shown at IFA are running 3.2, and v4 is also out in Q4, then I imagine that there won't be too more than a single v4 device* until Q2 next year.

Clearly, fragmentation is not something Google is too concerned about.

* 10 gets you 1 it's a Motorola.

HTC outs 'Mango' WinPho 7 smartphones

@AC (08:20) and @Advocate

Fillipo, you're describing version 7.0 and 7.1. The devices in this review run Mango (7.5).

That said, Windows Phone has always had proper (pre-emptive) multi-tasking. It just wasn't avaialble to developers. It is in 7.5.

I've never had copy/paste issues. How doesn't it work? And how is the OS bloated and sluggish? It is more responsive than many Android devices (i.e. as buttery smooth as iOS). Battery claims for my Omnia 7 are lower than the performance I get, and I use GPS heavily on my bicycle, as well as what I'd consider average data and voice. Can't comment on HTC devices because I've never used one.

Location tracking is no different to iOS and Andriod.

What movie are you in dude?

Advocate, contacts appear split because you have entries for one person from many places (LinkedIn, Twitter, Facebook, Windows Live and Exchange). You can link them to make them appear as a single entry. This is by design, and IMO an awesome feature.

The browser in Mango is full-blown IE9 and fixes all the issues of old.

There are herds of count-down timers (even free ones) in the app store.

Google+ is an identity service, Schmidt says

Even more worrying...

...is that in 20 years he's apparently not come across the 7 laws of identity -

1. User Control and Consent

2. Minimal Disclosure for a Constrained Use

3. Justifiable Parties

4. Directed Identity

5. Pluralism of Operators and Technologies

6. Human Integration

7. Consistent Experience Across Contexts

http://www.identityblog.com/stories/2004/12/09/thelaws.html

If he followed those I might actually consider signing up to a (any) Google service.

Lenovo ThinkPad Tablet goes on sale

Err... not quite.

Many business users will use thick client apps that store (local data) and forward (remote data). There's no point to a mobile device otherwise (see endless criticism against Chromebooks). Granted, given that most data hacks are done when data is at rest, app devs need to think through their security implementations.

The other thing businesses need is enterprise group policy on the tablet, and associated management tools. Google's cloud-only approach, and it's comptetitive relationship with Microsoft means Android isn't going to get anything like such enterprise support.

It's why I believe that non-iOS tablets won't hit the business mainstream until Windows 8 is released.

Windows Phone may be cheaper than Android - Inq boss

Huh?!?

The title says Windows Phone. The quote from Meehan says Windows Mobile. Windows Phone and Windows Mobile are not the same thing. Which is it?

iPHONE 5 SHOCK! US Apple store 4G kit-fit snapped

LTE is not 4G.

That is all.

Apple changed shape of Galaxy Tab in court filing

Identity crisis.

I avoid all things even remotely related to Google. Seriously. Like the bubonics.

And yet I find myself wanting to bat for Samsung.

Google erects master API for linking web apps

Was about to say...

...UDDI all over again. We're doomed, it seems, to repeat failures :-)

Wondering how they're going to twist services into displaying ads.

MPs slam 'unworkable' one-size-fits-all NHS care records' system

Yeah, I get that.

Part that's missing is where non-delivery (even in part) means a free exit. When these contracts are signed everyone's an optimist. When it fails the contrator is rich and the tax payer is poor.

But |I get your point.

Crazy.

Will .gov ever learn to link reward (payment) to *successful*, on time and within-budget delivery?!?

WinPho 7.5 captured in action

Funny indeed.

AES256 is great, but how, pray tell, do you securely store keys on your Asus Transformer?!? You might also want to look into the choice of hashing algorithm on your toy.

Seems it does get better than that.

Same old FUD/ignorance from Fandroid central.

@Steve Knox: Troll much?

Search MSDN for System.Security.Cryptography.AesManaged, then scroll to the bottom and have a look at supported OS's.

Windows Phone 7 has better security than Android, and arguably the same as Blackberry. IOS provides security similar to WP7, although a lot of the OOB stuff around messaging you get with WP7 and Blackberries is through third parties.

Nice.

I've been developing on Mango since early June, and have had Mango on my phone since the end of June. While the "OMG where's my update" madness surrounding Nodo was surprising since no one really uses copy/paste more than a handful of times a year, Mango really is good. In an underwhelming way. I've had no need for multitasking yet other than music, which multi-tasked from day one anyway. Turn-by-turn directions are nice but I've never used it to get somewhere. The GPS app I wrote now supports it to record breadcrumbs whilst in the background, but that's been the extent of it. The part that impressed me the most is the eye candy - the improved jump lists are one of the best UI gimmicks I've seen in almost 20 years of working in IT.

Major overhaul makes OS X Lion king of security

Actually...

...you'll find that many of Vista's problems (primarily pre-Vista apps and drivers, and ignoring the UX issues, which were serious) were because Micosoft did not offer backward compatibility, for the sake of security.

Blighty's top cop quits over phone-hacking scandal

Lol :-)

That deserves an upvote :-)

Pity...

...that Stephenson thinks he should resign. His knowledge, expertise and experience will be lost to the Met. It's a sad signature of UK politics - someone always has to be seen to take a fall. After much hand-wringing, self-flagellation and bitching... the story just goes story away. But...

Behold ye, Joe public, the symptom has been treated!

And nothing is done about the root cause

In the end we (the public) have lost yet another capable civil servant, whilst retaining the trash that caused it in the first place. Mostly because we, the public, value the perception of action over tangible results.

Samsung Chromebook: The $499 Google thought experiment

No privacy

Not with any of the apps you mention. You're better off rolling your own, using maybe Microsoft's Synchronisation Framework, Amazon's S3 and judicious amounts of HMACSHA521, AES and RSA asymetric encryption. That's what I'm doing, because there's no way I'm trusting any internet-based service with data I haven't encrypted twice.

"And its security model makes an awful lot of sense"

Sure it does. As long as you remember that this company's business model is predicated on its customers' information disclosure.

Files Connect

£5.49 *isn't*, in fact, pricey

It's less than the cost of a packet of cigarettes.

Saying that it should be in the OS is as stupid as saying that a packet of potatoes should include a potato pealer*. If it's that important then choose a tablet that does include it. If there's no OS the does, then... shell out buddy.

Of course I unserstand that gracefully accepting things you can't change is much less fun than whining about it.

* The guy who writes the OS decides what to include in the OS. Or product. Or service. Or whatever. If a requirement the consumer needs isn't included, then the consumer shops somewhere else. Simples.

Pricey? At 5.49? Seriously?!?

Blows me away. Every time.

The developer(s) must've spent months on the app (probably at a rate of £2/3000 a month). You spent £hundreds on your ithingy. And five and a half pounds is expensive?

You have a need for an application. It costs y. You're only prepared to spend x. Answer? Don't buy it.

NHS told: freeze all Microsoft spend

It is sensible.

"Thinking different" is laudable, but not necessarily prudent. And I'm not even sure that "cheaper*" (a worthy driver for an organisation that spends my tax money) is a luxury they can afford.

A more important driver will be the legacy IT estate, which is predominantly Microsoft -based. There are a lot of records management systems (a council I did some work for a while ago springs to mind) that are from IBM or other vendors, even though many government organisations have (had) Enterprise Agreements with Microsoft.

The current scenario is crazy. I worked on a project a while ago where a full Oracle database was installed on laptops because the Systems Integrator was told that it had a higher chance of winning the bid if it chose Oracle. So £ thousands of my tax money was paid to Oracle when SQL Server under the EA was free.

The insanity is insane, and irrespective of motive or religious affiliations, I think any step to rationalise is a good one.

* Can you qualify what you mean by cheaper? If you consider the cost of migrating existing Office documents on hard drives and in records management systems to a different format, I suspect your idea of cheaper is, in fact, extortionately expensive.

Behind Microsoft's $15 Samsung Android royalty claim

I wonder if...

...Google's keeping a low profile because the patents are legit and hold water. Note that I don't know. Just wondering.

Oracle to overhaul reseller rebates

It's in the name. Or should have been.

When Oracle bought Peoplesoft they could have changed their name to Orasoft. Then they bought Siebel, and should have changed their name to Orable.

MeeGo and the Great Betrayal Myths of tech history

WTF?

WP7 does sync with Outlook. Using either Exchange or Windows Live.

Nokia unveils Contractual Obligation Meego Phone

I've played with one.

It's well impressive. It has the best maps app I've ever seen on a smartphone.

Patrick Byrne: 'See, I told you America's economy was busted'

All these deck-chair economists!

The ECB banned shorting during the crisis because everyone thought it was a major cause of it. They found no conclusive evidence and lifted the ban because shorting increases market liquidity.

Windows 8: Microsoft’s high-stakes .NET tablet gamble

As usual...

...the real answer lies somewhere in the middle.

A lot of what you say about HTML5 is true. But there are scenarios in which server-based apps won't work. Apps where you need greater security than TLS, for instance.

Sure, HTML5 apps can work in a disconnected state, but you're still constrained by the security of the browser (or lack thereof). Phones lack crypto stuff like DPAPI so there's little option than to use public/private key-pairs - which isn't going to work in HTML5 for a long time.

If you're going to preach a single approach you need a more compelling justification than calling Silverlight devs code monkeys.

All of that said, the panic is hilarious. I have no doubt that Windows 8 on ARM will run .NET in some way, shape or form.

El Reg pays by phone – mmmm, free cookies!

Identity Cards

I think they missed a trick. If the app was crafted similarly to an identity selector (like the Higgins Project or CardSpace), and provided SAML or WS-Identity hooks it would make life a lot easier. You could attach any identity provider, be it the bank itself, the FCO or Experian. You could then use that identity. The bank could step in as an attribute provider (bank account and/or credit card number), and it would be easier, whilst remaining secure (inasmuch as anything can be these days).

Of Windows patch management

Beg to differ.

Patches are the first defence against exploits. In a world where headlining exploits are reported on an almost daily basis I deploy patches immediately and test retrospectively.

The exposure (and subsequent cost) of a security vulnerability is disproportionately high when compared with the often unlikely case of a patch disrupting user productivity. There are herds of studies that show this - I'm still blown away by IT outfits that have to justify their egos and income by holding back patches.

Google Chrome OS: Too secure to need security?

Defence in depth is not new.

Nor is it a Google invention. It's also not the first OS that uses it. Microsoft's Security Development Lifecycle waxes lyrical about it (Microsoft didn't invent it either), and it's in all the newer generation software from Microsoft. Products like the Unified Access Gateway take it even further in that you can use it to safely provide Internet-based access to something inherently not secure like Peoplesoft (which was never designed for Internet access to begin with).

US admiral reveals safety plan for Zombie Apocalypse

I like to use a Dustbuster.

I hoover their eyes out, and then dispatch them at a more leisurely pace using the usual methods.

Microsoft replaces Xbox 360s after disc-format switch

Like Sony much?

I guess there's no accounting for fanboi'ism.

When is a database not so relational?

New tech, new following.

"The second issue is that relational databases are a poor fit for most software development. "

Agree with Steven and Charlie. I find these days that most advocates of NOSQL are also fans of the latest crazes like MVVM - and more often than not come from a world in which Hibernate was shoe-horned into solving all problems (badly). Java and .NET are both great at providing gimicks that try to make programming as simple as, say, Ruby. This is not without it's merits - it gets inexperienced devs productive quickly - but it's a roblem when you have more than two or three models in a view. In which case Hibernate is no longer your friend, much less a NOSQL DB. And that's not even mentioning ACID.