Posts by Brewster's Angle Grinder

Apple grudgingly opens up its check book, pays VirnetX $454m in patent royalties after a decade of wrangling

Re: Here's the detail

If Apple had any sense they'd use some of their money to lobby for patent reform. But one suspects that, under the current system, they gain more than they lose.

IBM veep partly blamed Sopra Steria for collapse of £155m Co-Op Insurance Agile project

Now I want to see a graph of rejected defects and a graph of accepted defects. If IBM are blameless then the latter should look like a typical S shaped curve. But if that defect list 'grew at a "linear" rate over time' then IBM are just blowing smoke.

ICON FOR BLOWING SMOKE ---->

Mercury, the closest planet to the Sun, surely has no frozen water, right? Guess again: Solar winds form ice

A loud place

"...convection currents..."

SORRY, WHAT DID YOU SAY? YOU'LL HAVE TO SPEAK UP. I COULDN'T HEAR YOU OVER THE SOUND OF THE HURRICANE-FORCE WINDS.

Microsoft frees Windows Subsystem for Linux 2 from the shackles of, er, Windows?

Use a cat. They're nice and soft - if you avoid the clawry bits. Pick a tortoiseshell one and no-one will notice. You don't have to put them in the wash, either, as they self clean. Very environmentally friendly.

My coat? Yes, it's that sloth.

If you're looking for a textbook example of an IT hype cycle, let spin be your guide

Re: 2012 is the corpus of words

>Try "chocolate" and you'll similarly see the decay down to 2012.

Or try "google". (I did worry it might break the internet - but it seems okay.) Apparently Google peaked in 2005 and dropped off so that by 2012 we weren't talking about then at all. I wonder who they got bought out by?

Microsoft throws a bone to those unable to leave the past behind: .NET 5 support on the way for Visual Basic

Re: VB.net, not Visual Basic for Applications (VBA)

OPTION BASE 1

Although anybody with any sense ran OPTION BASE 0 The statement dates to GwBasic. (Which is why I know it exists.)

The Reg produces exhibit A1: A UK court IT system running Windows XP

Re: in fairness

"The real question would be how well the media had survived."

My experience is that 5¼" are probably still readable but good luck with a 3½".

Partly it's because 3½" were mass produced commodities whereas 5¼" date from a time when the price of a disk meant it could be made to a decent standard. They're also well spaced out - so there's no interference. (And the older stuff is single sided.) And because the tech was rudimentary it was written using a fridge magnet (in terms of strength of signal and signal area) in order to accommodate the varied tolerances of drives.

I imagine all that applies even more to 8". If its been well looked after, there's probably recoverable data.

Resellers facing 'months' of delays for orders to be fulfilled. IT gathers dust on docks as coronavirus-stricken China goes back to work

Re: Just an FYI

With respect to More or Less, they'll conduct studies looking for Covid-19 antibodies and use that to estimate how many people have been exposed. (Apparently such programmes are already under way in China.) Once the infection has damped down, you can use that to get a good estimate of the death rate. That covers (b) and (b) is probably the predominant source of error. And (a) is neutered by looking at the infection as a whole.

The UK's death rate is certainly inflated because the NHS have only been testing people who have come back from an affected region or have come into contact with an infected person. (At one point they weren't even testing people admitted to hospital with pneumonia.) Although, without some limit, everybody with a cough would want a test.

Good luck pitching a tent on exoplanet WASP-76b, the bloody raindrops here are made out of molten iron

Re: Puzzled!

"Since none of you specified the reference frame, you are both right and wrong."

In low energy situations, you can separate an inertial frame from a non-inertial one - e.g. Foucault's pendulum will reveal you are in a rotating frame embedded in a large volume of flat space.

Stuck at home? Need something to keep busy with? Microsoft has 115 ideas – including an awful SMBv3 security hole to worry about

Re: Imagine a user...

It's not deliberate, though. Programmers, being humans, make mistakes and these mistakes are exploited by other, malicious human beings. And most users would agree that "preview" is a useful, time saving feature.

How does Monzo keep 1,600 microservices spinning? Go, clean code, and a strong team

Re: It's certainly bold, but is it naive?

"...going this way closes the door on people without the new hipster skills..."

How's the recruitment for COBOL programmers going?

I've not programmed Go. But it looks a fairly straightforward language to pick up. Programming is programming. I agree with the rest of your point, though.

'Unfixable' boot ROM security flaw in millions of Intel chips could spell 'utter chaos' for DRM, file encryption, etc

According to the article it had dedicated RAM. And yet, still, some devices could DMA into it.

FYI: When Virgin Media said it leaked 'limited contact info', it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more

Re: Which is why...

How many "small" web sites have dedicated IP addresses? They're going to be shared hosting.

HMRC claims victory in another IR35 dispute to sting Nationwide contractor for nearly £75k in back taxes

Re: Final paragraph.

I haven't got time to look it up. But if the rules were opaque or missing, then the Tribunal may have had to "clarify" the law to the cover the case. In that situation, I would expect them to be let off as a matter of natural justice, provided they weren't taking the piss; there would be no way they could know they were in the wrong till a court adjudicated. And I would expect anybody who'd behaved in a similar manner to be let off prior to the precedent.

_{DISCLAIMER: IANAL, but I have beaten HMRC at a Tribunal. :)}

If you're writing code in Python, JavaScript, Java and PHP, relax. The hot trendy languages are still miles behind, this survey says

Everybody is dissing stackoverflow. But that's an example of a page with a couple of really good answers.

It's Terpin time: Bloke who was SIM jacked twice by Bitcoin thieves gets green light to sue telco for millions

The security services may have wised up to this after that Michael Scofield incident.

Tattoo remove is a thing. Besides, the area in question is big enough to take a good few passwords.

As to silencing the tattoo artist: steganography. Or just make the password "I love mum".

The first thing you do when arresting Bruce Schneier is shave off his beard...

And the consensus in the comments was it was inconceivable anyone would conceal their password alongside their fishing tackle.

But this case shows exactly why downloading it onto unhackable media is not such a dumb idea. Although, personally, I would tattoo it onto a part of my body that is never normally visible in public - ideally a part that is covered in thick, curly, dark hair so even a strip search wouldn't reveal it.

Re: File Encryption?

In that situation, I wouldn't even commit my password to digital media. I'd write it on a piece of A4 and hide it with my fishing rod.

Departing MI5 chief: Break chat app crypto for us, kthxbai

Bring your own psychic paper

The Queen, Prime Minister etc... are guarded by police officers. And I bet a single piece of id issued by "the authorities " will allow you past those guards - they'll even unlock the doors for you.

Galileo got it wrong – official: Jupiter actually wet, not super-dry: 'No one would have guessed that water might be so variable across the planet'

They're looking within a 4° band at the equator. I think they're talking about variations of water by depth.

One man is standing up to Donald Trump's ban on US chip tech going to Huawei. That man... is Donald Trump

Re: Imagine what it's like to work for this guy

Have you seen the @PresVillain Twitter feed?

Chrome 81 beta hooks browser up to Web NFC, augmented-reality features

Re: The web is way too safe! We need more danger!

And then, if you're a C++ programmer, you'll find you can't get work programming anything other than JS. (Although I'm hoping WASM will let me get back in the saddle.)

Ofcom: Rule change to force UK comms providers to tell you when your contract expires

I haven't read the legislation. But a quick google suggests the lawyers are right:

The fees ban applies to all new tenancies entered into on or after 1 June [2019].

If you signed a tenancy before this which included agreements to pay further fees – for example, check-out fees or tenancy renewal fees – you will still have to pay these up until 31 May 2020.

But from 1 June 2020, any term in a tenancy which requires you to pay fees will no longer be binding, so you won't need to pay them regardless of what your agreement says or when you signed it.

Astroboffins agog after spotting the first repeating fast radio burst that pings every 16 days from another galaxy

Re: Mr Olber takes a trip outside.

Expansion? What expansion? An infinite universe is already infinite and therefore, by definition, cannot expand. So your argument is clearly invalid!

_{Yes, if you apply modern astrophysics to an idea that was already old when Herr Olber penned it in 1823, then you will find a lot wrong with it. For example, three quarters of all stars are M-dwarfs, which aren't as bright as the sun, so even in an infinite, non-expanding universe, it's unlikely the sky would be as brighter as the sun. And the instellar medium famously reddens light, even without expansion.}

Mr Olber takes a trip outside.

4a) Sunlight

In an infinite universe, every point in the sky connects to a star so the darkest patch in the sky would be the area where the sun is occluding the background rays.

Dual screens, fast updates, no registry cruft and security in mind: Microsoft gives devs the lowdown on Windows 10X

Re: Windows 3.1 / 95 architecture

There's still a helluva lot of legacy code that is 32 bit.

It sounds a lot like what happened with Win95: all the old 16 bit apps ran in one address-space and continued to cooperatively mulitask, whereas the new 32 bit gaps got their own address space, pre-emptive multitasking and sensible APIs.

Aw, look. The UK is still trying really hard to be the 'safest place to be online in the world'

Then we don't let the incumbents get the regulations they want. The German regulations show one way this might be dealt with.

The solution to bad regulations isn't to abolish regulation. It's to make the regulations work.

Forgotten motherboard driver turns out to be perfect for slipping Windows ransomware past antivirus checks

Re: And this is why drivers should only be in user space

I don't think anybody wants to revisit the horrors of 286 protected mode. But the four privilege levels are still present, even in 64 bit chips, and could be used.

In reality, however, it's hard to grade security that way. (Being "a little bit kernel" is like being "a little bit pregnant".) A capability based model is a far better bet - a driver runs in user space but with the permissions it needs to do special things. Hardware support for that comes in the form of the io port bitmap which allows userspace processes to be granted access to specific ports. (See iopem(2).) But ports are only part of the story, and giving a process access to ports may grant it more power than it needs.

Re: And this is why drivers should only be in user space

"Plus it wouldn't stop flaws in the kernel itself being used to escalate privileges."

It does reduce the attack surface, though.

"Plus how do you deal with latency-sensitive stuff without context thrashing?"

It depends how latency sensitive it is. VMs seem to manage. But maybe some drivers will have to be partially or wholly in the kernel. That's still a gain if most drivers are user space.

Re: And this is why drivers should only be in user space

Human nature being what it is, that will further reduce the quality of drivers...

Google Chrome to block file downloads – from .exe to .txt – over HTTP by default this year. And we're OK with this

Re: Question

If a https download page links to a http mp3, it will be blocked. Other than that, everything is fine.

So a https download page must link to a https mp3. But a http download page can link to whatever it likes. All that's required is the encryption scheme of the download is at least as secure as that of the page it's being downloaded from.

Astroboffins may have raged at Elon's emissions staining the sky, but all those satellites will be more boon than bother

Re: Missing the point

But even by his own figures, you'll be seeing one every three minutes. You don't have to have been a pro to have done deep field exposures for longer than that. And the ones that aren't shining can be as damaging as the ones that are - if they occult the star you're measuring.

But the numbers are astonishing. 50,000 satellites would mean 25,000 in your hemisphere. Imagine a patch of sky 2 moons x 2 moons. Every patch would permanently have one satellite (as one leaves another enters). That assumes they're evenly distributed - which they won't be.

Git takes baby steps towards swapping out vulnerable SHA-1 hashing algo for SHA-256

Re: Over exaggerated issue

"The chances of generating 2 identical hashes whilst manipulating the contents of a file - which would have to be the same length anyway(?) - are so unlikely that I'm unsure why this is being treated as something that needs fixing."

Why would the length, the commit message, or any of the other factors have to be identical? Who's going to notice that a five year old commit is slightly longer or has a slightly different message? The biggest problem is not making it disrupt any of the commits that are sitting on top of it.

If it's so simple for you, I suggest you go offer your services.

Twitter says a certain someone tried to discover the phone numbers used by potentially millions of twits

Re: Anything based on phone is not

Variety of devices and channels are more important than the brute factor count. Username+Password, SMS, biometrics and auth app can all be run through one device and, if that device is compromised, then it's game over - even if you use every last factor. But if I'm logging in from a laptop or a desktop, and the 2FA comes in via my phone, then you have to compromise my mobile phone as well as my computer. That's squared the difficulty.

Likewise, it's not enough for a hacker to man-in-the-middles the bank; they've got to intercept the SMS as well.

Re: Anything based on phone is not

"A 2FA app installed on a phone is secure."

Possibly. If it's well written. More likely it's just vulnerable to a different set of vectors. It's closed source so we have no clue about the internals or the protocol. Worst case, we could attempt to read the code via spectre, rowhammer or some other side channel.

I reckon the independent token generators are probably the best. My bank even issued one and I was using it to log in. But they kept nagging me to set up a phone; and doing 2FA authentication via SMS means I can do mobile banking in an emergency - which wouldn't be the case if I was without my card and my token-generating card reader.(And, okay, I admit, some laziness came into play: insert card into reader, enter pin, select function, enter challenge and type response into website. All to protect my negative money.)

Artful prankster creates Google Maps traffic jams by walking a cartful of old phones around Berlin

What's the error?

How accurate are the position reports? If they're using wifi it might be pretty granular. Even GPS can end up being rather inaccurate. So the phones in the cart could appear spread out to Google. And it might not be unusual for a street full of cars to have several reporting they're in the same spot.

So maybe next time we'll need two or three separate carts to fool Google.

BTW did anybody else notice the map showing he was next to the office of "Google Berlin"? That's real class.

Petition asking Microsoft to open-source Windows 7 sails past 7,777-signature goal

Re: Uh!

But OpenBSD has a robust code base, an experienced team of developers, and the infrastructure for testing fixes and distributing them to users. And it's funded by a Foundation which these days seems to be reasonably good at securing donations.

None of that would be in place for a Win 7 source dump. It would suddenly exist and be ripe for exploitation.

Electron devs bond at Covalence conference: We speak to those mastering the cross-platform tech behind Slack, Visual Studio Code, etc

Re: Isn't WASM going to kill Electron?

No. Presuming Electron will run Wasm, then it's effectively a Wasm runtime.

The Curse of macOS Catalina strikes again as AccountEdge stays 32-bit

Re: Confusing.

"Still, that's a language compatibility issue rather than API so it doesn't invalidate my point."

Is being forced to rewrite your app in a new language not enough?

You can actually do it from C++. But those square brackets are indicative of message passing using named parameters. So every API call has now become objc_messageSend() after first finding the object, then looking up the method and preregistering some atoms. And have fun constructing objects that will the OS will use to interface with you. (And the OS does expect to be able to make method calls into your app as a matter of course.)

I've not looked at this in detail so I have no idea how compatible individual APIs are or which ones have gone missing. But that's the point - every C API call has not got to be reevaluated to see if it has an equivalent Objective-C one with identical semantics. If they're not - it's rewrite time. The UI APis were very different, partly because the C interface came from the old Macs whereas Objective-C ones came from NeXT and partly because different languages naturally have different idioms with different conventions.

Meanwhile, 25 year old, 32-bit code that ran on Win95 continues to chug along fine on the latest iteration of Win10.

Re: Confusing.

Cocoa is Objective-C. So instead of FILE* file = fopen(path, "r"); you do

NSFileHandle* fileHandle = [NSFileHandle fileHandleForReadingAtPath:path];

and reading data from the file has to be done [fileHandle readDataOfLength:bytes] rather than fread() So the entire IO section needs to be rewritten. (And given the age of the app they presumably have a bespoke file format that users would like to maintain backwards compatibility with.) With a bit of care something can be done. But it's a helluva lot of work.

And it doesn't end there. It's every single fucking API call everywhere. Even basic strings are manipulated with that square bracket notation. And that's before you get to the GUI - which is a large chunk of any modern app.

Presumably the tax logic itself could be factored into a shared library. Other than that, its starting again writing a new app in a new language.

Re: Confusing.

"Now I must say that I would really love to know what APIs _accounting_ software is using that are hard to update."

I may be wrong, but haven't they've ditched Carbon? Previously, any app using the Carbon API would probably run. But now they've got to be rewritten to Cocoa. As I say, I may be wrong. I'm not doing any Mac work, these days.

Re: Mixed messages

The code might have been pretty good when it was new. It's just it was new 25 years ago. And machines were rather more limited back then - getting things to work at all, could be an achievement. (And unit tests were for pussies. ;-)

I was looking at some of my old code the other day and wondering "Why did I write it like that? Or like that?" And then it dawned on me: the APIs I'd use now didn't exist back then. In retrospect, what it did was pretty impressive. But the limits of technology were stretched and trying to disentangle it is a pain. And newer code using newer APIs has been added along side it, without anybody updating the old code so there are now multiple systems.

TL;DR it's probably bloody awful and needs a scratch rewrite.

Tabletop battle-toys purveyor Games Workshop again warns of risks in Microsoft Dynamics 365 ERP project

You know you're old when you own copies of White Dwarf in double digits - y'know, back when it was good.

H0LiCOW: Cosmoboffins still have no idea why universe seems to be expanding more rapidly than expected

Re: Riddle me this:

"Or think of objects glued to a balloon. Inflate the balloon, and the objects move further apart."

I tried this once. What happened was, as the balloon expanded, the contact patch between the glue and the object also expanded, until, eventually, there wasn't enough adhesive in contact with the object to hold it in place, at which point it fell off. The object in question was a steak knife. I now have a 15mm hole in my foot.

Therefore I deduce that if the universe keeps expanding, we will all fall off and land in either heaven or hell, depending on which side of the universe we are on.

_{I saw the answer to this in a paper the other day and I realised my understanding of it wasn't as secure as I thought. Unfortunately I can't quite remember what the paper said or which paper it was. But it boils down to the "force" of metric expansion being much smaller than the forces holding you together - or even the "force" holding objects in orbit. So the expansion pressure on say, an orbital electron, is dwarfed by the attractive force of the nucleus and it doesn't even enter the calculations. Space "pushes" the electron out; the "Coloumb force" "pulls" it back.}

Sometimes shining a light on a nuclear problem just makes things worse

Re: An unexpected turn

Back in the old days, the bits were so chunky a supernova couldn't flip one.

Pack your bags! NASA's latest exoplanet hunter satellite finds its first Earth-sized world in a habitable zone – and it's only 100 light years away

Re: Atmo

"The tidal-locking also suggests that the planet may not still have a spinning core."

The opposite's the case. If you're phase locked, then your core gets tidally heated. So there should be enough energy to keep the dynamo ticking over. That's why Mercury (3:2 resonance) has a magnetic field. It's likely TOI 7000 d does as well.

It's the atmospheric effects that will be the killer.

Having trouble finding a job in your 40s? Study shows some bosses like job applicants... up until they see dates of birth

Forget "new sportsmen". How many sportsmen are there at (or close to) 40? Raikkonen is 40, but he's losing his edge. Federer and Serena Williams are 38. Jimmy Anderson is 37. I think we might see it a bit more now we understand the human body better, but it's still going to be rare.

'Tis the season to be wobbly: HSBC online and mobile banking services suffer not one but two major outages in 12 hours

Re: Amazon wobbling as well

I was in the queue at lunchtime behind someone trying to buy an Amazon gift card, and the cashier said exactly what you've said. I looked on El Reg, expecting to see a story and have a laugh - but not a dicky bird.

(Are they using HSBC?)