* Posts by dajames

1666 publicly visible posts • joined 20 Mar 2011

Exposed: Lazy Android mobe makers couldn't care less about security

dajames

Re: No money in it

the user has paid for the 'phone ... the ROI on security updates is zero.

Not really ... I bought a Moto phone in part because the word on the street was that Moto were good at releasing timely patches. Unfortunately the joke seems to be on me, because in 18 months it hasn't been updated to Nougat or Oreo, and hasn't seen a security patch since January last year. There is allegedly a release of Nougat for at least some versions of this handset, but I haven't seen an OTA update for mine.

My point is: I would definitely pay more for a phone that was guaranteed to receive OS updates a reasonable time -- say version upgrades for three years and security updates for a couple more beyond that.

For me, it would have to have an SD card slot and a user-replaceable battery ... so the Pixel and the iPhone are both ruled out.

It's Pi day: Care to stuff a brand new Raspberry one in your wallet?

dajames

Re: All Pi's need USB3!

AFAIK there is no SBC with USB3.0 and gigabit ethernet, much less one for $35.

No ... but you can get the Gigabyte GA-E3800N for around £40, and that has USB3.1 and gigabit ethernet (and a couple of SATA ports, RS-232 and Parallel, etc). That has an AMD APU and isn't fanless ... and you'd need to add a RAM DIMM or two ...

It's not quite Pi-small, or Pi-cheap, or Pi-quiet ... but it's not a world away.

dajames

Re: Fan ???? Oh no !

"Sadly, the module will need a tiny fan to keep things cool."

Oh no, not worth it vs. the previous completely passive model.

Relax. As I understand it, the fan is needed on the optional POE board, not on the Pi 3B+ itself.

dajames
Headmaster

Re: Dates

Then again a full circle is 2*Pi so if that represents a full year or orbit around the sun then Pi would be June 30th no matter how you write it.

No, because 30th June is only 181/365 (or 182/366 in a leap year) days into the year. The actual mid-point is around 2nd July.

dajames

Re: Dates

Outside of a technical context then you might as well write out the month name or three letter abbreviation. MAR-14 or 14/MAR or whetever.

In the English-speaking world that works, yes.

What you and I call "January" is "gennaio" in Italy, and "enero" in Spain (note that month names are not capitalized in either language), so it's not a general solution.

dajames
Headmaster

Re: Dates

So weight of flour in a recipe is 8oz, not 228g - or even 225 or 250g ...

No, indeed ... it's nearer 227g. (226.796, it says here.)

Suspicious cert-sellers give badware a good name for just a few thousand bucks

dajames

Re: Certificates are an illusion of trust and security

Why should anyone trust any CA?

They are set up to make money selling certs.

Yes, that's the reason.

A CA depends on the money it makes from selling certificates. No CA with any business sense will deliberately issue certificates that cannot be trusted, because that would damage the CA's own reputation, and lead to users not trusting the certificates it issues ... which will lead to customers going elsewhere for their certificates, and the CA losing money.

That said, it's important to understand what a certificate means. All a certificate tells you is that the CA has reason to believe that the private key associated with the public key in the certificate belongs to the purported owner (the "subject") of that certificate. For a cheap/free EMail certificate the CA may do no more than check that the address to which the certificate is to be sent is the same as the address in the subject ID while for an expensive ECommerce certificate the CA will carry out offline checks on the identity of the certificate requester, and will insure against any fraud arising from misuse of that certificate (which is why such certificates are expensive).

All a certificate really tells you is the identity of the owner of the certificate (and the associated key); you are left to make your own decisions about trust.

Sony Xperia XZ2: High-res audio but no headphone jack

dajames

Not either/or

I'm thankful they got rid of the headphone jack, let me buy a superior DAC that makes music from mobile sound awesome

You can use USB headphones with their own DAC even on a phone that has a headphone, jack, you know. Removing the jack just removes user choice.

Just can't catch a break, can ya, Capita? Shares tumble 40% amid yet another profit warning

dajames

I'm not sure that this is correct. If they issue £700m of new shares, then their cash position increases by £700m. The balance sheet just shows a movement between assets and capital. It shouldn't in itself, have a significant affect on the valuation of the company.

That's right ... but the price per share on the markets will fall, which is what gets reported in the news.

Thar she blows: Strava heat map shows folk on shipwreck packed with 1,500 tonnes of bombs

dajames

Re: Aircraft Carrier

Of course, if Crapita get the contract to paint, it'll work out more expensive than buying real aircraft, and they'll paint the wrong type of aircraft as well.

They'll paint F35s, you mean?

NASA finds satellite, realises it has lost the software and kit that talk to it

dajames

"a case of luckly to be looking in the right place at the right time."

In the field of observation, chance favors the prepared mind. Pasteur.

Nice one. So ... he was lucky to be looking in the right place at the right time, but at least he has the nous to understand what he was seeing.

Seems fair.

dajames

Re: Need help, NASA?

It says it was presumed dead in 2005. It doesn't say when it was sent up.

Quite right, it doesn't.

25th March 2000, according to Wikipedia.

Ever wondered why tech products fail so frequently? No, me neither

dajames

User Manuals

No, it's because no one expects to need to read them anymore. If a device isn't pick-up-and-play intuitive without directions, it's considered too complicated.

Nevertheless, I know people who complain that they can't use modern software because they haven't got a manual to read. The idea of FWITIW (Eff With I Till It Works) doesn't seem to appeal to them.

Some modern software just is user-hostile crap (and a manual would make that failing more obvious) but some users do seem to need a manual even to use the best-designed programs.

dajames

Re: Test is part of engineering!

Your goal has to be to break the software

No, the software is broken already. Your goal is to find out where.

OK, Google: Why does Chromecast clobber Wi-Fi connections?

dajames

Re: Router code is just as crap

If(packetBuffer.IsFull() == true)

Or even just:

If( packetBuffer.IsFull() )

... because, you know ... Boolean logic.

The compiler will probably emit the same thing in each case, but the shorter way is easier to read/maintain.

Devs see red after not seeing Big Red on Stack Overflow database poll

dajames

Forget Oracle

The survey also omits SQLite.

Last year (according to the pic in the article) Oracle was used by 16%, SQLite by 26%. Methinks omitting SQLite this year was the greater oversight.

You GNOME it: Windows and Apple devs get a compelling reason to turn to Linux

dajames

Re: "there are much more suitable options for that"

... "real programmers don't use an IDE" ...

Yes, that may have been true when IDEs were all toys. Things have changed.

It used to be that real programmers used commandline tools because it was easier to get real work done with those tools than with the rudimentary IDEs of the day. Now IDEs have become more sophisticated; you can do everything you need with a good IDE ... and it hooks into the version control system, the bugs database, the build server, and loads more besides.

Unfortunately this has made IDEs and their accompanying baggage so complicated to configure, maintain, and use that I find myself nostalgic for the old days when I had some time free to write code as well!

dajames

Re: Example in today's news: Unimpressed by Gnome

Then *WHY* *HAVE* *A* *DESKTOP* if you can't put icons on it? What ARE you going to put on it, *ADS*???

Why put icons on the desktop when, most of the time, there are going to be application windows obscuring them? Surely it's better to put the functionality that might be accessed through desktop icons onto toolbars or menus or something that won't be covered up by application windows and so are always accessible?

Not that I have any objection to a few icons on the desktop -- it's important that users should have the choice -- but I really don't think they're all that useful.

Wannabe W1 DOW-er faked car crash to track down reg plate's owner

dajames

Re: Best plate I ever saw...

The most laughable I ever saw was "CLA55Y" ... on a dung-coloured Ford Granada, of all things!

Take notebooks: About those new Thinkpads...

dajames

Re: Next time, Dell

Oh, and Lenovo has the Fn key in the left corner of the keyboard, where the Ctrl key *should* be. The position of the Fn key is, no kidding, one of the main thing is take into account while looking for laptops.

You can -- at least on my 18-month-old T460p -- swap those around in the "BIOS" (aka UEFI firmware) setup.

What's really stupid, though, is that the Ctrl and Fn keys are different sizes so you can't swap the keytops around to remind yourself that you've done so.

Sigh.

Nest's slick IoT burglar alarm catches crooks... while it eyes your wallet

dajames

Re: I had alarm keys twenty-five years ago...

I had electronic "keys", not yet "tags" to enable/disable the alarm system twenty-five years ago already. They don't need power - like a phone app - and don't depend on your phone age, make or OS. Far more comfortable to keep in pocket.

The trouble with 'tags' is the way people use them -- they invariably put them on the same key-ring as their house keys. This means that if you lose your keys and they are found near your house the finder can walk down the street trying your keys in all the front doors, and when they find one that opens they know they have the tag for the alarm.

Two-factor authentication it ain't. A passcode is much more secure.

Tags do have their uses -- people who can't remember a passcode will nevertheless be able to use a tag, and on systems that are operated by a large and rapidly-changing group (an office with a lot of short-term staff, for instance) management of passcodes can be a challenge -- but for most domestic situations a passcode wins hands-down.

Guilty: NSA bloke who took home exploits at the heart of Kaspersky antivirus slurp row

dajames

Pay attention at the back!

Has everybody missed the fact that even though the villain in this piece (Pho) had Kaspersky's product on his computer, it was still riddled with malware?

The article says that the NSA code that Pho had illegally taken from work and copied onto his home PC was detected as malware and reported to Kaspersky. There's nothing to suggest that any of this code or any other malware was active on his PC.

The End of Abandondroid? Treble might rescue Google from OTA Hell

dajames

Seems to hold some promise

... unless the reason you are looking to upgrade is to fix a bug in the vendor-supplied layer, in which case this leaves you worse off than before.

It should help most people get a newer version of Android on their old phones, though, and that's something.

Linux kernel hardeners Grsecurity sue open source's Bruce Perens

dajames

Not quite how it works ...

- The judge* decided on the law in interpreting a contract

- The interpretation became a fact in the case

- It then became impossible to challenge the judge's interpretation on appeal because it was now a fact and the appeal couldn't redetermine facts.

I am not a lawyer, but this is not quite how it works, as I understand things (in the UK).

Once a judge makes a ruling on a point of law (such as the correct interpretation of a contract term) that sets a precedent in law. Other judges judging cases in the same court (that is: at the same level) will defer to that judgement.

However, a judge in a higher court (an appeal court) CAN overturn the original judgement -- that's the point of the appeal court. Judges with more seniority and experience get to reexamine the decisions made by more junior judges in lower courts and either uphold or overturn them. It's a legal "second opinion".

OnePlus 5T is like the little sister you always feared was the favourite

dajames

Re: So Close!

When phones only had 4 or 8GB of storage, an SD card would be a 'must have' feature. However, in these days of phones with 128GB storage, it isn't as crucial ...

Large internal storage capacity is nice to have ... but the great thing about an SD card (formatted as portable storage) is that if/when the phone dies or gets broken you can just pop the SD card and all your most recent downloads and photos (the ones you haven't backed up yet -- you do DO backups, don't you?) are not lost.

Remember CompuServe forums? They're still around! Also they're about to die

dajames

Re: CIS software

Does anybody remember a dial in software for CIS called Orzak or similar.

There was a reader called OzCIS, that came, I think, from some people called Ozarks West Software. I never used it, though, because I had already found WigWam when I first heard of it.

dajames

Re: First Quantum Link... then Usenet... now...

Personally, I never used Compuserve, but I do recall seeing the per-hour access cost at some point and thinking.... yeah, nice if you can afford it.

The only per-hour costs were for the phone call that connected you, and as I recall that was a local-rate number in most parts of the UK.

Compuserve itself charged £6-7 a month (I think that was US$9.95, but fluctuated with the exchange rate) ... which seems a lot when you compare it with usenet (free) but is really only beer-money.

Munich council: To hell with Linux, we're going full Windows in 2020

dajames

Re: Just get the best tool for the job...

If you need to retrain all your staff to work with Open / Libre -Office while they're already fully familiar with MS Office then going open source might not be the best of ideas for that specific part.

How did they become familiar with MS Office -- was there training for that? If not (and there hardly ever is, which is why most users use office software so ineptly) why would you think you might need to offer retraining for different software?

If you think MS Office 2003 users would have needed retraining to use LibreOffice I hope you also accept that they should have been retrained to use MS Office 2007 with it's radically different UI.

Android at 10: How Google won the smartphone wars

dajames

Re: Horsecrap - MyffyW

Bought from Google - 1st party

Bought direct from Phone manufacturer or Carphone Warehouse etc unlocked - 2nd party

Bought subsidised from phone company - 3rd party

No, I think you're missing the point.

Google-branded phone with unmodified Google Android - 1st party.

OEM-branded phone with the OEM's own customization and skinning - 2nd party.

OEM-branded phone bought subsidized from airtime provider with customization by OEM and by airco - 3rd party.

What's relevant is the number of customizations that would have to be re-applied to an Android update in order to upgrade the device. The closer to Google your device was sourced the more likely it is to see an upgrade.

It's 2017 and you can still pwn Android gear with Wi-Fi packets – so get patching now

dajames

Re: shouldn't we be past the buffer overrun exploits?

Thank fuck for Android's super updates system!

Ah, Irony! We don't use that here.

'Lambda and serverless is one of the worst forms of proprietary lock-in we've ever seen in the history of humanity'

dajames

Re: I'm wondering on how efficient this all is

... I have trouble with the sentence : "the open-source community has to provide alternatives". With all the faith I have in the coding abilities of Open Source volunteers, they are working from home.

Not all of them work from home. An awful lot of them work for big companies like IBM, Microsoft, Google, Facebook, Oracle, and Amazon ... not to mention the likes of Red Hat, Canonical, and SuSe ... and not forgetting the Linux Foundation!

I think that it is mostly to companies like these that the article refers when it speaks of an Open Source community.

Updating Things: IETF bods suggest standard

dajames

Re: Seems sensible

The trouble is that business won't like this as it would mean they would have to factor n-years of support into the price of their product rather than sell cheap and hope the product outlasts the consumer guaranee/warranty period.

Good.

Eliminate the cheap shit from the market and you push up the entry-level price to the point at which manufacturers can afford to build a properly thought-out, easy to maintain, product that is worth supporting for ten years. Most of the sillier IoT devices will just not be made because nobody would buy them at those prices -- but that's no loss to consumers, only to companies trying to make a fast buck out of cheap IoT Shit.

Google's phone woes: The Pixel and the damage done

dajames

Re: 3.5mm jack

How many people were more worried about a phone being waterproof than they were about being able to use it to listen to music? Fucking no one.

I was ... or rather would have been if the Pixel had been cheap enough for me to do anything but laugh at.

I use my phone out of doors quite a lot -- both as a phone and as a map/GPS -- and sometimes it rains so I want a waterproof phone. I do also use my phone to listen to music, but not so often, and not so much when out and about, and I do still have an MP3 player (and Bluetooth speakers, for that matter).

I do agree that dropping the 3.5mm jack was a daft thing to do, and not likely to win any friends. The idea, presumably was that you can use USB headphones (and not charge the phone) ... but having a 3.5mm jack for compatibility with all the millions of pairs of wired headphones that already exist would not stop the phone supporting USB headphones, it would just give the user a choice.

Choice is a good thing ...

Forget One Windows, Microsoft says it's time to modernize your apps

dajames
Headmaster

Re: Modernise apps?

... "modernize" (US spelling, interestingly) ...

That is NOT "US spelling". British English allows the use of either 's' or 'z' in words which have been verbed by adding an "-ize" ending, and the OED prefers the 'z' spelling.

Verbing in this way follows Classical Greek, in which the suffix is spelt with the letter Zeta, which is conventionally transliterated to 'Z' in English.

Some words in English whose "-ise" ending is not formed in this way are properly spelt with an 's' (e.g. "revise", where the 's' is already present in the word "(re)vision"), Many writers prefer to use 's' spellings throughout, to save having to remember when 'z' is more appropriate; but that does NOT mean that the 'z' spelling is wrong for those words verbed, as "modernize" is, by adding "-ize" to a noun.

However, the word "modernize" comes, in this article, from Microsoft's Kevin Gallo, who seems to be an American. In that context the use of "US spelling" is far from interesting.

New phishing campaign uses 30-year-old Microsoft mess as bait

dajames

Re: Outlook/Lookout

At one place I worked, Outlook was referred to as "Lookout" by some in IT.

It's known as "Outhouse", around here.

Google slides text message 2FA a little closer to the door

dajames

Re: Slight problem?

... SMS where the thief can move the sim card to another phone to receive the 2FA code.

Unless, of course, the SIM card is PIN-locked ... which is probably a good idea in any case.

Dev writes Ethereum code for insecure SHA-1 crypto hash function

dajames

There's a difference ...

... between enabling verification of SHA-1 hashes and supporting generation of new ones.

The argument, I guess, is that SHA-1 is so insecure, now, that even old SHA-1 hashes, computed back when SHA-1 was considered safe, can not be relied upon; that allowing people to check the validity of a SHA-1 hash might tempt them to assume that the hash still means something.

That's a good argument for encouraging people to treat anything signed using SHA-1 with a pinch of salt, but it's not an argument for preventing them from checking the hash at all. SHA-1 collisions can now be engineered, but they still can't be engineered easily -- a hash has to be protecting something of appreciable value before it becomes worth anyone's effort to look for a collision.

However, blockchain applications such as those used by Etherium -- in which the entire value of the chain depends on its validity back to the first transaction being verifiable -- are among the applications most at risk. If you can fake a signature early in the chain that used a weak hash then you can cast doubt on the entire history of the chain and everything it is supposed to secure. I can see why people are concerned.

Your data will get hacked anyway so you might as well give up protecting it

dajames

Re: Strontium Dog

Proly because the Judge Dredd ones weren't massive hits....

The more recent one -- with Karl Urban and Olivia Thirlby -- deserved to be ... apart from being scarily reminiscent of a shopping trip the local Arndale centre on an Saturday afternoon ...

dajames
Boffin

Re: Strontium Dog

Someone explain why there isn't a blockbuster movie?

Maybe because the government is still trying to pretend that Milton Keynes isn't a mutant ghetto?

Hmm ... The Johnny Alpha icon doesn't look quite right to me ...

So the 'Year of Linux' never happened. When is it Chrome OS's turn?

dajames

Re: Widespread Linux on the desktop remains elusive.

Don't say LibreOffice. It looks like a 1998 shareware application.

You say that like it's a bad thing!

Microsoft used to publish some guidelines on application GUI development that encouraged the use of common GUI designs and metaphors in an attempt to achieve consistency across all applications on their platform in the interests of ease of use. Because of this the better shareware applications back in 1998 had very similar look and feel to Microsoft's own applications.

Along with that came helpful features like, for example, the F1 key bringing up context-sensitive help from any part of any application. I miss that.

I really don't hold with this strange notion that an application's GUI should look "modern". What's important is that it should work well and enable the user to be productive. The appearance is secondary. An awful lot of time is wasted in our industry changing UIs for cosmetic reasons that bring absolutely no benefit other than making this year's version of the software immediately distinguishable from last year's. If only that effort could be spent on making the applications more useful, less buggy, and more secure!

Xperia XZ1: Sony spies with its MotionEye something beginning...

dajames

Re: Built-in obsolescence

I have the same phone, none of the same problems with battery.

I'd be rather weary to extrapolate a sample size of 1 of a particular model to the whole manufacturer's portfolio.

I did find some discussion online between other users who were experiencing the same problem with the Z1 Compact, so the sample size was at least a little more than 1. There was some disagreement as to whether simply replacing the battery would fix the problem, but it worked for me.

However, my intention was not so much to grumble about this problem with this particular phone, as to point out that it is a real pain in the proverbials not to be able to change the battery when it needs to be done.

I do understand that waterproofing an IP68 phone isn't trivial, but other manufacturers have managed it so it's not exactly rocket science. (See the Samsung Xcover for example (link to gsmarena).)

dajames

Built-in obsolescence

I have a Sony Xperia Z1 Compact. Nice phone.

It runs Android 5 (Lollipop). I'd had it a little over a year (the phone had been out for nearly two years by then) when Android 6 (Marshmallow) was released, but the Z1 series didn't get the upgrade. The latest kernel is dated November 2015.

OK, I understand that a manufacturer can't support old hardware for ever, but a less-than-two-years-old phone is not "old" hardware. I had expected I'd get to at least Android 6 and hoped to get to 7 before updates stopped. Bad Sony.

When the phone was a little over two years old it developed the nasty habit of suddenly claiming that the battery had reached 0% charge, when a moment or two before it had been at around 50%. The battery is sealed in, so hard to replace -- it also turned out to be quite hard to source.

I managed to get a battery which was said to be new (with "zero charge cycles") but may not have been. I had to heat the back of the phone to soften the glue and prise it open to put the new battery in. This, of course, wrecked the waterproofing, which had been one of my reasons for buying the Sony in the first place (I walk a lot, and sometimes it rains). Nonetheless I carried on using the phone with its old OS until the replacement battery started to display the same sudden discharge behaviour*.

I'd love to buy another Xperia phone, but I won't do so until they make the battery officially user-replaceable, and give some commitment to supporting Android updates for at least (say) three years from the release of the phone. Oh, I'd like it to be dual-SIM, too ... is that too much to ask?

* I suspect that the battery isn't really dropping from 50% to 0% in a couple of seconds, but that the battery monitoring circuit in the phone is uselessly optimistic until the voltage drops a little under load (because the user has, say, turned the screen on) and then it panics and turns the phone off. Maybe later Xperias have fixed this?

WPA2 security in trouble as KRACK Belgian boffins tease key reinstallation bug

dajames

Re: ...the attacker would have to be on the same base station as the victim...

If that's the case then it is somewhat analogous to a locksmith demonstrating the ability to come round to your house and pick the front door lock.

A better analogy might be a locksmith demonstrating that he can open all the internal doors in your house when what's important is that he can't open the front door from the outside.

Of course, if you let him in he has the run of the place.

dajames

Re: Uncorrectable Horse Staple Battery

If you just work on the assumption that all media are vulnerable, then encrypt with known-good encryption (not RC5 or TKIP, and yes you MUST keep up to date with what's safe!), it really doesn't matter what happens or who can send you packets.

Up to a point, Lord Copper.

The new study seems to be attacking the key set-up using some sort of man-in-the-middle approach reusing nonces, so it looks very much as though it does depend precisely on the problem of knowing (or not knowing) who is sending you packets.

We shall have to wait and see ...

Dumb bug of the week: Outlook staples your encrypted emails to, er, plaintext copies when sending messages

dajames

Re: Unlikely

Microsoft claimed the exploitation of this bug was "unlikely" in the wild.

Mostly because S/MIME is an essentially dead protocol, that only a handful of people have ever bothered with....

S/MIME isn't dead. It's the standard protocol to use when encrypting internet mail within a PKI. The other common mail encryption protocol is PGP, but that isn't used within a PKI. If S/MIME is not much used it's because most people don't actually bother to encrypt their mail.

I would think that Microsoft regard exploitation of this bug as "unlikely" because they don't think anyone sends mail in plain text, nowadays.

'All-screen display'? But surely every display is all-screen... or is a screen not a display?

dajames

Re: Why do we need bezels ?

I do not understand why it is not possible to remove bezels completely ?

I can see some attraction in the idea of a screen with no bezel ...

... but when it is a touch screen on a mobile device, I find myself wondering how the hell one picks the damn thing up without causing input.

Surely the bezel is there to give you somewhere safe to hold it?

'Don't Google Google, Googling Google is wrong', says Google

dajames

Re: OC

I can't think of an intransitive use of the verb "display".

Methinks I have heard it said that some species of wildlife are known to display (intransitive) in order to attract a mate.

dajames

Google are wanting people to say 'Search on Google' rather than to google or googling because if to google becomes a verb in common use they can loose the ability to trademark the name as it become generic.

Right, ... let's all Alphabet it then!

(I don't know what that means, but if it costs them a trademark the joke's on them.)

dajames

"I dedicate this book to my parents, Ayn Rand and God."

So Ayn Rand and God are your parents, and you dedicate the book to them.

Methinks I'd have used a colon, rather than a comma, in that particular case.

Google to kill its Drive file locker in two confusing ways

dajames
Headmaster

Re: English? Simon Sharwood has heard of it

Actually this one is fine. It's a contraction of "Data is" ...

Fine unless, of course, you believe that "data" is a plural.