Posts by Roo

Oracle Database 12c's data redaction security smashed live on stage

Shocking...

but also not entirely surprising...

10/10

"Microsoft should school Ellison on safeguarding privates, says infosec bod"

That is a delightful sub-heading. 10/10.

Have a beer, you earned it. :)

Tiny steps: HTTP 2.0 WG looks for consensus

Re: Encryption with SSL is problematic

"I think that's dubious."

I can live with that. :)

"It would only help where you have many requests over persistent connections; where the size of the HTTP header is significant compared to the size of the message-body;"

In my experience that is not as rare as you may think with in-house REST services. 'Real-time' sensor data can generate a lot of header and not much data, and it's something we'll get more of with toasters acquiring internet connections.

"and where transmission time is significant in relation both to total turn-around time and to encoding and parsing time."

There are benefits to be had in terms of less traffic on slow main memory & I/O busses, as well as reduced cache pressure. Not that many people seem to care about that icky hardware stuff anymore... Can't entirely blame them if they're running code on a JVM that is running under a VM...

Re: Encryption with SSL is problematic @ CB

"You just push in your data and it'll come out with the latency of the line."

Encoding and Decoding the message is > 0 cost, I was careful to specify "local" as well. A reduction in codec cost would yield benefits in power consumption AND latency, so there would be more cases where you can provide a ubiquitous web API instead of something more specialised and prone to misunderstanding + failure. That's all speculation and dreams until it hits the metal though. :)

Re: Encryption with SSL is problematic

Compressed headers may reduce the round-trip latency for local REST services which could be a big win over the long haul.

Hacker crew nicks '1.2 billion passwords' – but WHERE did they all come from?

Re: Can someone please explain

"I suspect rushed deadlines are the problem."

SQL injection is easy to fix using parameterized queries, they are widely supported and have been around for a long time. It really doesn't take much effort to write the code correctly in the first place in this instance, the most likely reason for SQL injection vulns are ignorance and lack of care.

"That and vulnerabilities seem to be found at a rate quicker than sys admins can patch."

That is a fact of life that is unlikely to change. :)

Windows Registry-infecting malware has no files, survives reboots

Re: "a tool Microsoft uses to hide its source code from being copied"

"This doesn't mean it is a good option, and great file systems on other platforms are not particularly relevant if they're on other platforms and not where they're needed..."

Interestingly Wikipedia reckons that NTFS currently supports tail-packing like FFS. If MS have done the job properly you won't have to worry about small files munching all your "LFAU"s while you sleep. That's one less excuse for the Registry's existence.

Re: Treacle OS

"Yep, transpose 90% of Windows users over to Linux or OSX overnight and watch the carnage continue as though nothing had happened."

I suspect that you will find that about 10% of that 90% have already migrated to OSX/iOS, of those maybe half would be folks who were beaten into retreat by Windows, the other half would be techies would like stuff that works well and looks nice.

The thing is, even if there is massive carnage happening in OSX/iOS land I can ignore it because the potholes are being dug in departed Steve's FruitLoop Lawn.

For that matter in Linux land it's always carnage, same with OpenBSD land too, however for the Open source projects a much higher proportion of the carnage (aka R&D) makes it's way to the outside world (for better or worse).

Retrospectively I am glad that Microsoft have been around, but I would have preferred it if they chose to compete via innovation rather than domination. For example, they were talking about delivering WinFS (a FrankenFileSystem consisting of a database engine with a file system API bolted to it's neck) in 1996 with Cairo... They failed and failed again with Longhorn. Clearly this feature has been eagerly awaited because some developers have been using the Registry as a WinFS instance all these years anyway... :)

Re: "a tool Microsoft uses to hide its source code from being copied"

"LFAU? I wouldn't appreciate losing gigabytes of storage to handle a few tens of megabytes, maybe a hundred megabytes, of configuration data."

It appears that you are asserting that the registry is a good option because file systems are shit at handling small files... There are file systems that pack (multiple) small files into larger allocation units (eg: FFS), so it's technically possible to be space efficient with lots of small files...

Small files have always existed, and they will continue to exist, it's up to you whether you wish to suffer the cost imposed by a vendor's inadequate file system design.

Re: "a tool Microsoft uses to hide its source code from being copied"

"The would be because the Registry (basically a Btrieve database) can locate and update data many times faster than you can via parsing a flat file - regardless of what file system the text file is stored on."

There is nothing stopping people from storing raw binary into a flat file if they wish to.

Some software uses both human readable and binary formats, using tools to convert from the human readable to machine readable format, so the human readable config only has to be parsed once. The parsing can also be done offline so there is no runtime penalty as well...

The *only* time I've found config parsing to be a serious bottleneck/problem is when XML is involved, and again people are free to choose something other than XML (and in my opinion they *should* choose anything but XML :P).

Re: "a tool Microsoft uses to hide its source code from being copied"

"Quite - databases are a far more scalable and sensible way of storing configuration informatino than flat text files."

How is the registry (which looks a lot like a directory tree) more "scalable" than a filesystem ? File systems have been capable of storing petabytes and running at Gigabytes/sec for over 15 years now, surely that should be enough for a bit of config...

FWIW one justification for the registry was that it could provide transactional consistency for the configuration data - which is nice in principle, but in practice I have not noticed a measurable improvement over the file model, YMMV.

"It doesnt run code from the registry. The registry entries are passed to Javascript as a process start up command."

Those two sentences are mutually exclusive.

Leaked docs reveal power of malware-for-government product 'FinFisher'

Re: So quite a lot of AV not very good?

"rely upon the volume of legitimate traffic to shroud it"

How quaint.

Evidence during FOI disputes can be provided in SECRET

Nothing to hide, nothing to fear...

It does beg the question as to what they are doing that could lead to harm as a result of publication. Surely they have nothing to hide because UK gov have issued them with a license...

NASA tests crazytech flying saucer thruster, could reach Mars in days

Just a quick double check, it's not April 1st...

Holy Cow !

That is awesome, as will be the necessary power source (at current thrust levels). :)

Bring back error correction, say Danish 'net boffins

Re: Bah.

Splitter !

Secure microkernel that uses maths to be 'bug free' goes open source

Re: Technically speaking...

"Was it really necessary for MS to change the architecture of the NT kernel just so a server OS could have all-singing all-dancing display drivers?"

Yes it was, because they couldn't bring themselves to copy the UNIX way of achieving the same end efficiently and (more) securely. ;)

Need a US visa, passport? Prepare for misery: Database crash strands thousands

Re: Nah

In fairness the Buffer Overflow is quite valid - I found one by compiling their sample code. :)

Banning handheld phone use by drivers had NO effect on accident rate - study

Re: Typing texts at the wheel is incredibly dangerous

"But I do get somewhat annoyed when I see trumped up traffic officers on TV lambasting the odd driver who just picks up his phone to see the status of the screen. There's no danger in that, in my opinion, any more than there is picking up a sandwich and taking a bite (which I gather is now also a punishable offence in the UK)."

I get the irritation, but those traffic officers attend accident scenes so they have a very different perspective on it because they see the grizzly aftermath of a driver not paying attention or making an error of judgement while they were distracted. At the end of the day a driver *can* cause a massive amount of damage to themselves and innocent bystanders, even at a low speed, therefore a driver *should* be giving driving the maximum amount of attention that they can at all times.

In my view by trying to do driving + something else the driver has decided that saving a few seconds time is more important that driving as safely as they can.

Will the next US-EU trade pact prevent Brussels acting against US tech giants?

Class Action...

Strikes me that this is a class action suite waiting to happen where the little guys take governments to the cleaners as well for giving multinationals an unfair advantage. It appears that Turkeys do indeed vote for Xmas.

NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'

Re: Why am I not surprised by this?

"Actually, yes. The NSA is part of the US DoD and hence, has anyone viewing, trading or collecting child porn arrested and charged for the crime."

That's only useful if folks get caught and prosecuted, Snowdon is claiming that the NSA's internal oversight is very lax - so there is a strong possibility "anyone" won't get caught so prosecution won't happen.

Child diagnosed as allergic to iPad

Re: @Roo

"The internet is full of vacillating drain bramaged novelty seekers. Can't we just have ONE place in tech reporting that encourages skepticism?"

I am quite happy with the Reg as far as skepticism goes, although I think that it has gone a bit soft in comparison to say 10 years ago - or perhaps I have become too jaded by the endless press releases.

Change is inevitable, and I think that El Reg has handled change over the years better than most. :)

Re: @Roo

"Get off my goddamned lawn."

No worries, you can keep your lawn Trevor. For the record I think there is room for both kinds of lawn at El Reg, I just wish that El Reg could find a bit more space for the other kind... :)

"The Register has been focussing increasingly on an old fashioned IT administrator crowd."

You have taken quite a few downvotes, but I think the point you made above is a fair one, I have been lamenting that particular trend for many years now. Have an upvote for that point at least. :)

NSA dragnet mostly slurped innocents' traffic

Re: AC BoringGreen Boring Roominant (the proven liar) @Matt Bryant

"".....I wonder how you can claim to know that those caught or admitting to it were the only ones that abused the system....." Gee, is that another sheeple attempt to get me to try proving a negative?"

No Matt, that is actually a person pointing out the massive hole in your argument. Instead of addressing that hole you have decided to insult them instead, presumably because you think that makes you look better at their expense. Here's a clue for you: the fact you attacked the person rather than the argument draws attention to the fact that you have no valid point to make.

Service as usual from Mendacious Matt Bryant the identity thief.

Re: BoringGreen Boring Roominant (the proven liar) @Matt Bryant

"Roo or anyone else, would you please report this as abuse to bring it to the attention of the mods. Matt, if you wish to do the same, that would be great."

I have some sympathy for your point of view BG having shared a similar train of thought on more than one occasion. There are factors that stay my hand though, in no particular order:

+ Matt behaves like a narcissistic contrarian. If that is his true nature then he really can't help himself. Expecting decent behaviour from Matt would be akin to expecting a Hippo to put on a hat and tails and nip over to Covent Garden to take in an opera.

+ Sometimes an opposing view is actually useful and even valid (OK, Matt doesn't score particularly well on this front - but it's *technically* possible even if it's very unlikely).

+ Matt clearly invests quite a lot of time and anger into his posts, it would be churlish to deny the poor chap an audience.

+ Matt is doing a fantastic job of embarrassing himself, why stop him when the record is there for anyone who cares enough about Matt Bryant to take a look ?

The downside of all that is that real Matt Bryants (Matt asserts that he is using a pseudonym), will look like a bunch of arses as well, but if it really does hurt their interview chances they may be able to find redress within the courts. It's not as if Matt hasn't had it explained to him that he might be shafting real Matt Bryants with his abusive rubbish so I wouldn't be too upset if that chicken came home to roost.

Re: Boring Roominant (the proven liar) @Matt Bryant

Matt I had a look at post to see if I could find any sentence that had any evidence supporting it and didn't contain an insult. I couldn't find any, the closest was this.

"And thirdly, as I have stated many, many times before, your trivial attempts at constructing any form of argument are so easy to debunk it simply doesn't get much above mildly amusing."

I let you get away with the "easy to debunk" and "mild amusing" because they are purely subjective in their nature. At present, in the context of this thread, there is no evidence that you are able to construct a statement of fact backed by evidence.

Re: Boring Roominant (the proven liar) @Matt Bryant

"".....Please lay out your assumptions regarding NSA interception and whether those who have access to said interceptions (ie. a very few) will always be immune to the lure of using such power for personal or political gain (ie. abusing it)......"

You claimed it was not an assumption, you stated it was happening, was affecting 'us all', and that you could prove it."

Err, Matt you've just indulged in a deceitful evasion, please provide the requested evidence to support your position.

Re: Boring Roominant (the proven liar) @Matt Bryant

""Perhaps if you take on board the faint possibility that posts here come from real people that simply hold different views often for good reason...." No, I accept there are people with different views, what I object to is when those morons (like you) insist on trying to force them on the rest of us."

That's funny Matt because we feel exactly the same way when you make a post telling us what to think (ie: most of your posts).

Re: Roominant (the proven liar)

Matt is a liar that desperately wants to baaaah-lieve in paranoid delusions and conspiracy theories, as evidenced by his repeated ravings about Sheeple and Unicorns. He also behaves like an infantile dullard spoilt brat in public forums, as evidenced by his habit of attacking people before attacking arguments.

Anyone can insult and lie, not everyone can back it up with the fact this entire sub-thread came about because Matt told a big fat lie when he claimed the NSA had caused no harm.

Like I said earlier, Matt lost his point long ago, all that is left is mud-slinging and bullshit.

"".....The NSA asked the DEA hide their source when presenting their evidence in court, this is why I stated that the DEA and NSA *conspired* to fabricate evidence." LOL, if you backpedal any faster you'll go back in time!"

Matt, according to The Register I wrote the following two days ago:

"I (and others) have already made references to relevant evidence (DEA conspiring with the NSA to secure convictions using falsified evidence), yet you have consistently avoided acknowledging, accepting or engaging in a rational discussion about the evidence."

You actually quoted that post as well Matt. In this instance Matt it is in fact you that is lying and back-pedalling.

That same post contained the following snippet that you yourself quoted:

"I think that the most likely outcome will be that you will continue to ignore all evidence of harm and that the moderators will continue to indulge you in behaving like a 4 year old spoilt brat in a public forum."

And you are still cutting and pasting:

"You are a liar that desperately wants to baaaah-lieve in paranoid delusions and conspiracy theories, I have proven that with your own statements. Now quit the lying and evasions and show me the 'harm'."

You are still behaving like an infantile dullard as well, so my prediction has panned out.

Re: lucki rtard @Matt Bryant

Matt: Note the Joke Alert icon.

""Matt what do you do for a living?...." What, you seriously think I'd post that info with the number of bleating skiddies that frequent this site?!?!? Let's just say I currently work for one of those global corporations that the sheeple love to hate so much and leave it at that."

Don't despair lucki, he goes on (and on):

"I get headhunted to be in a position to advise on hiring."

And he drops another claim:

"Some of are old enough to have done real study, not toy exams like GCSEs, and a lot more than basic secondary education."

Surely that narrows it down a bit, but you should keep in mind that Matt has expressed the opinion that fabrication of evidence and perjury are harmless, and he has made unprovable claims in recent history.

Re: Roominant Anon Cluetard Roominant

""My recommendation...." What, you think I should put weight in the opinion of someone that baaaah-lieves in unicorns????""

With all due respect accusing people of believing in unicorns is pathetic. It's the kind of thing a deranged pre-teen wannabe troll resorts to.

"I get headhunted to be in a position to advise on hiring."

Crikey, the Brony Mafia are taking over.

Re: Roominant Anon Cluetard Roominant

"....the Anon understood my argument about proof correctly....." So you're saying the Anon also baaaah-lieves unicorns exist because no-one has proved the negative that they don't exist? Is this a simple way of detecting sheeple? Thanks, it could save a lot of time weeding out the mentally deficient at interviews"

My recommendation is that you should start by weeding yourself out of the interview process given that you are the one with the unicorn fixation who believes that stuff is true because there is no evidence to the contrary. It must be tough being interviewed by someone so long on opinion and so very short on understanding.

Re: Roominant Anon Cluetard Roominant

Ah, more personal insults, and bullshit about unicorns...

"Some of are old enough to have done real study, not toy exams like GCSEs, and a lot more than basic secondary education."

In actual fact I sat both forms of exam, I took some O-Levels a year early - but the ones I sat didn't cover logic, and nor did yours by the looks of it - because you are still assuming lack of evidence is proof of the inverse.

As it happens, where I could compare directly, I found the O-Level papers easier because they were narrower in scope and I could simply regurgitate answers from previous papers with different numbers/keywords. By contrast the GCSE papers tended to have much broader scope and you didn't have the luxury of being able to memorize past papers. YMMV.

"Come back when you're old enough to have grown some pubes and gotten some actual experience."

Ah, Matt has failed at rational debate, insults and lying so he is now giving orders. Quite happy to ignore that order thanks Matt, besides I already have plenty of pubes and quite frankly I think I'd like a bit less experience of people like yourself who can't think their way out of a simple logic problem.

Re: Roominant BleatingGreen AC Marsbarbrain OMGeeez!!! What a DISASTER!!! ......

"".....As for whether harm has (or will) happen as result of the NSA's inept data collection+retention+security practices, Matt *believes* none will, but Matt can't prove it....." So, to sum up and apply your 'argument' and it's flawed logic, unicorns and fairies must exist because no-one has conclusively proved they don't? LOL!"

You are fabricating evidence again Matt, that is in fact your logic, as illustrated by the following quote in which you assert that a lack of evidence to the contrary supports your argument:

"For a start, if there was any evidence of such 'harm' the same journos would be all over it! Once again, the lack of evidence of any 'harm' simply reinforces my argument and undermines yours."

Given that you make up new names, strawman arguments and systematically misrepresent people you may have a bright future working in the DEA's evidence fabrication operation.

Re: Anon Cluetard Roominant

Anon:

"No he's asking you to prove an assertion and in fact IIRC the only negative that cannot be proved is that there is no God."

...

Matt:

"I see the new sheeple debating tactic is to fall back on that tried and tested child routine of "Yes you did", "No you didn't", "Yes you did", etc., etc"

Matt the Anon understood my argument about proof correctly, but I am surprised that you appear not to have understood the point because it is one of the first things I learnt about proofs when I studied my GCSEs. Unfortunately it didn't occur to me that you might be ignorant of how formal proofs work until you posted that response complaining about Sheeple. Sorry about that.

Re: Roominant BleatingGreen AC Marsbarbrain OMGeeez!!! What a DISASTER!!! ......

"LOL, you are such a stranger to logic!"

In the real world, I am not a stranger to logic, far from it in fact. However I understand that in Matt Bryant's world (Rant On Dudes !) things are different from the real world.

"You're no different to the types that, when asked for proof of their god's existence, try and turn the question round by saying 'prove he does not exist'""

I haven't seen any proof either way yet, so I don't have a horse in that particular race.

As for whether harm has (or will) happen as result of the NSA's inept data collection+retention+security practices, Matt *believes* none will, but Matt can't prove it. The replies and down votes Matt's posts have attracted suggest that most people think that most of Matt's arguments are bollocks.

So in conclusion:

1) Logic indicates that Matt can't prove his claims, therefore his claims of "no harm" are bollocks.

2) Most of the posts by commentards indicate that Matt's claims of "no harm" are bollocks.

3) Historic precedent and the balance of probability indicates that Matt's claims of "no harm" are bollocks.

4) The majority of Matt's writing consists of personal attacks and straw men arguments, he rarely addresses the point at hand, choosing instead to ignore stuff that doesn't fit his churlish world view.

5) I think that Matt looks stupid because he is repeating the same claim of "no harm" over and over again with no evidence to back it up.

Ball is as ever in your court Matt, but that's because you play alone.

"I can very easily prove there is no proof of the alleged 'harm' simply because neither you nor I nor the journos involved can find such proof."

Being unable to find proof is not the same as proving there is no proof. The FAIL is for you, because you just failed elementary logic.

Re: Roominant BleatingGreen AC Marsbarbrain OMGeeez!!! What a DISASTER!!! ......

""...... I am curious to see how you are going to go about proving that journalists miss nothing." I am curious as to how you manage to baaaah-lieve that journos not scared to leak Snowjob's docs would then pass up the opportunity to follow up on the story! "

My curiosity is sated, it turns out that you will not prove that journalists miss nothing, maybe you should quit claiming no harm seeing as it's just a belief.

Re: Roominant BleatingGreen AC Marsbarbrain OMGeeez!!! What a DISASTER!!! ......

"".....You claimed that no harm occurred, so you would be required to prove a negative....." Simple - I can find no evidence to support your claim of 'harm'. Job done!"

No doubt you still close your eyes and believe that you are invisible.

"Now, for you to prove your opposite claim, you need to provide proof of the 'harm', which you have not done."

Actually I don't, because you haven't proven your claim, and besides you can't actually prove your claim. The credibility of evidence presented by the FBI & DEA has been irrevocably harmed. Defendants can quite reasonably claim the evidence presented against them has been fabricated, with all the extra expense and hassle that entails. That must make you very happy.

Re: Roominant BleatingGreen AC Marsbarbrain OMGeeez!!! What a DISASTER!!! ......

"What a desperate attempt at denial!"

I'm not trying to deny anything, I am trying to understand your arguments and if necessary point out where I differ in opinion and why.

""By the same token Matt you should show the evidence backing up your claim that no harm has occurred..." Proof of a negative?

You claimed that no harm occurred, so you would be required to prove a negative.

In essence you are basing your arguments on a factoid that you yourself can not prove. Then you have gone on to accuse other people of doing the same thing when they have asked you for actual evidence to back up your belief.

"For a start, if there was any evidence of such 'harm' the same journos would be all over it!"

That is just a statement of belief, it's not a fact or even a factoid. I am curious to see how you are going to go about proving that journalists miss nothing.

Re: @Matt Bryant

"Lightning fast typist? Really good voice recognition system? Fake ID for a group? Trollbot?"

Well whatever Matt really is, he comes across as a Crusading Contrarian.

Re: BleatingGreen AC Marsbarbrain OMGeeez!!! What a DISASTER!!! ......

" Oh, and, BTW - SHOW ME THE 'HARM'."

By the same token Matt you should show the evidence backing up your claim that no harm has occurred, at present you have failed to show that, so your claim of "no harm" (which you made first) amounts to a baseless assertion. Also folks have shown harm occurring, but you have chosen to ignore it because it doesn't fit your whacky world view.

Re: Chairo OMGeeez!!! What a DISASTER!!! We're all DOOOOMED!!! Etc.

"I don't call people that can explain their differing opinion sheeple,"

Actually, you do call people that explain their differing opinion sheeple, so you are telling a big fat lie there. If you genuinely crave evidence to support that statement of fact, this comment section has plenty.

"just those that don't have an opinion of their own. You can spot them pretty quickly because they substitute passion for reasoning and facts."

That description fits yourself perfectly - in fact many of your posts start with personal insults before any attempt at conveying a point.

Re: Roominant OMGeeez!!! What a DISASTER!!! We're all DOOOOMED!!! Etc.

"I think the previous poster was making the point that Snowden shouldn't have been able to access all

that data in the first place."

Exactly, perhaps I could have made it clearer, but it wouldn't have made much difference because Matt doesn't like facts and logic getting in the way of an argument.

Re: Roominant OMGeeez!!! What a DISASTER!!! We're all DOOOOMED!!! Etc.

"Even Snowjob has had to admit he scarpered to China because the NSA did detect his unauthorised

access and was closing in on him."

The information was taken and published - the horse had already bolted... Which is precisely why I characterised the NSA's best efforts at information security as being 'inept'. Seems like we're in violent agreement on that point.

Re: OMGeeez!!! What a DISASTER!!! We're all DOOOOMED!!! Etc.

"Snowjob took data from a carefully safeguarded and regulated environment"

If the data was sufficiently safeguarded "Snowjob" (Matt Bryant's spelling) would never have been in a position to access the data, let alone leak it. The fact of the matter is that the NSA failed to safeguard the data.

Hopefully the NSA are working on reducing the chances of collateral damage by narrowing their data capture & retention rather than doing fuck all and banking on Matt Bryant to deflect attention away from their inept information security practices.

Forget the mobile patent wars – these web giants have patented your DATA CENTER

"Great. Wouldn't it be cheaper to give engineers money than tie up the world in monopolies and lawsuits? Or would that set a bad precedent?"

It would put lots of people who went to the right schools out of work, so I think that counts as a "bad precedent". Besides, here in the West the majority of production has been shipped off elsewhere and the carcasses left behind have been asset stripped, so all that's left is IP and the paperwork associated with it. This may explain why the authorities are working so hard to implement mass surveillance, aggressive IP law enforcement and mandatory filtering, because without all that stuff in place its practically impossible to maintain a monopoly on an idea.

LibreSSL crypto library leaps from OpenBSD to Linux, OS X, more

"Do we really need OpenSSL (or LibreSSL) supported on platforms that make it harder to support the platforms of today in a secure and software auditable way?"

For the cases where the answer is "yes", the tidying up effort should make forking & porting easier for the folks who need to support an oddball, so all in all I think it's a win.

What is ex-NSA spyboss selling for $1m a month, asks US congressman

Re: Roominant Apdsmith AC Military Industrial Congressional Complex

"Oh, and you also did not provide any evidence of how the US diplomatic mission in Iraq was forcing conclusions on the democratic process or controlling the sale of oil licences".

My post concerned past tense, yet you persist with working the present tense. It looks like you struggle with differentiating between past, current and future events. This would go some way to explain why you consistently fail to comprehend basic posts and repeat the same mistakes, put-downs, tired old lines, catch-phrases and expletives over and over again.