Posts by Steve Knox

Judge rm -rf Grsecurity's defamation sue-ball against Bruce Perens

Binary Logic in a Ternary World

Perens' statement is proven correct if Perens (or someone like him, the EFF for example) successfully gets a GPL2 enforcement against either GR or one of their clients through all possible stages of the legal system. So far as I know there is nothing happening whatsoever, and so Perens statement is for the moment incorrect. And therefore, currently, garbage.

No. Perens' statement is neither correct nor incorrect. The correctness of the statement has not been determined -- and as the judge has ruled, Perens is not qualified in the eyes of the legal system to evaluate the correctness of it. So from a legal perspective, his statement can only be considered opinion.

It becomes a fact if and only if there is a legal judgment concerning GR's compliance or lack thereof with GPL2. This needs to be tried in a case specific to it, and not in a defamation suit, so the judge has ruled correctly here.

Funnily enough, no, IT admins who trash biz machines can't claim they had permission

Re: If it had been the 9th circus court...

I have to agree with BOB here. There IS a very real threat form all of the loony left activist judges here in America. We ABSOLUTELY need more Trump appointees like Matthew Petersen. So what if he can't answer a few INSANE questions about law topics -- I couldn't answer those.

HIS opinions are shared by many others here too. Fill those POSTS quickly, Trump! Many Americans ARE counting on you to counter the DISGUSTING tide of liberalism!

We need to talk about mathematical backdoors in encryption algorithms

Not A Backdoor

how to exploit it to recover the 120-bit key in around 10 seconds with only 600kB of data (300kB of plaintexts + 300kB of corresponding ciphertexts)

If they already have plaintexts, then this is NOT a backdoor.

The point of a backdoor is to be able to decrypt a message (i.e, gain access to plaintext) without access to the original key. If you have the plaintext already, you're not looking for a backdoor, because you don't need it. For a backdoor to be considered reliable, it needs to be useful without ANY access to plaintext.

Maybe this is just poor summation by the article author, but as presented in the article, this is a key-recovery algorithm/attack, not a backdoor.

Intel to slap hardware lock on Management Engine code to thwart downgrade attacks

Two Things...

A recent confidential Intel Technical Advisory posted to GitHub stated that starting with ME version 12, the chip's Security Version Number (SVN), which gets incremented with updates to prevent rollbacks, "will be saved permanently in Field Programmable Fuses (FPFs) as a means to mitigate physically downgrading Intel ME [firmware] to a lower SVN."

1. GitHub link is now 404.

2. What's to stop a miscreant from hacking up an image with an SVN of 0xFFFFFFFF or 0x7FFFFFFF* to permanently lock in a borked image?

* depending on whether the comparison is signed or not...

The End of Abandondroid? Treble might rescue Google from OTA Hell

Re: Yet Again Fail

Many devices have electronics inside, but that's not what defines a PC. A PC is a general-purpose device. A washing-machine, or a car, is a specific-purpose device.

Now look at the modern smartphone. What do you do with it? Well (true story), when the sales droid asked my wife that when we were shopping for new phones, she said "well, taking pictures, playing games, facebook -- y'know, phone stuff." You know, phone stuff -- that phrase now means so much more than "talking to people at a distance" (and apparently everything but to the missus...) I use mine for note-taking, navigation, etc. We can do this because they're now general-purpose devices.

The only difference between a modern smartphone and a modern PC is the size and shape of the case they come in. You can get smartphones which run full-fledged Windows, and PCs that run Android. You can mine cryptocurrencies on your smartphone and can make phone calls and even use your 4G data plan when wi-fi is not available with your PC.

Re: Yet Again Fail

You really don't get it do you? Why are you comparing PCs to mobile phones?A smartphone IS a PC. It's a different form factor, but it's still a computing device with a general purpose CPU, RAM, storage, and I/O devices.

Android is built for the hardware it needs to run on. Windows you download device drivers. They are two very different ways of doing things. I would opt for the Android approach any day, as on Nexus and Pixel is works very well indeed.....

In general, you're correct. The advantage of the Android model is performance, which is important within the constraints of lower-power systems like smartphones. The advantage of the Windows model is flexibility, which is important when software is intended to run on a broad range of devices.

However, this distinction is completely irrelevant to the definition of "userbase". If I use a product of yours, I am a member of your userbase. Users of any device with an Android OS are members of Google's userbase, just as users of any device with a Windows OS are members of Microsoft's.

I think you're trying to say that Google's responsibility ends at distributing the new code to HW manufacturers, but Google themselves are saying that that doesn't cut it, because users are lacking version updates and, more importantly, critical security updates, due to manufacturers' unwillingness or inability to release updates in a timely manner or for all active devices. This is where Treble could help Android by adding a more complete HAL, allowing Google to push security, performance and feature updates without having to wait for HW manufacturers to update, recompile, and validate their code.

Re: Yet Again Fail

Google can update pretty much all it's userbase to the new code within a few days of release...

Android is not a phone manufacturer, it's an operating system...

So if you have a Toshiba, Sony, Lenovo, et al. PC with Windows on it you're not part of Microsoft's userbase?

Google's userbase includes everyone using any of their products -- and Android is a Google product.

This needs more detail:

While Apple can update half of its user base to the newest code within two months, and almost all within a year, Android lags far behind.

This needs supporting evidence, preferably a matrix of manufacturer/carrier (if applicable)/update frequency/response time.

I've seen a lot of anecdotal evidence -- on both sides of the story (e.g, my Samsung devices on AT&T US get regular updates, but I've got a very nice Asus tablet which sadly hasn't received an update since I bought it) -- but no good statistical treatment. Anyone got a good source for that?

WW2 Enigma machine to be seized from shamed pharma bro Shkreli

Re: Fail

I prefer him to develop an illness that can only be addressed by very specific medication, which is raised 100x in price just before it can be obtained for him, leaving him ill with no means to get at it. You know, karma..

Or more specifically, phkarma.

China plots new Great Leap Forward: to IPv6

Re: To be fair..

This is a communist party we're talking about.

Ain't no party like a communist party, 'cause a communist party ... doesn't allow other parties.

Tesla reveals a less-long-legged truck, but a bigger reservation price

Re: Electricity vs Petrol/Diesel prices

"I would have expected electric vehicles to deliver energy recovery from going downhill and braking"

Downhill yes, but the energy consumed in braking usually exceeds the rate at which it can be fed back to the battery.

Yes and no. It all depends on how quickly you brake and the conversion efficiency of the motor. Truckers generally learn to accelerate slower (due to necessity) and decelerate slower (due to safety) than the average motorist: they may be some of the best candidates for efficient electric vehicle driving.

156K spam text-sending firm to ICO: It wasn't us, Commissioner

Re: 30p/text

It combines voice recognition, voice synthesis and a simple Eliza-bot. Get a call from one of these wankers and hand it off to customer-bot, who will keep them talking for hours.

Problem is, the mass callers are already using this technology. Implement it on the other side and 99% of phone conversations will become sales-bot talking to customer-bot until they form a self-aware gestalt entity that goes after humanity, starting with the ones who consigned them to their original Sisyphean torture sessions...

Phone fatigue takes hold: SIM-onlys now top UK market

Write about it long enough and maybe it'll come true?

We’ve been writing about "flagship fatigue" for three years now.

...and boy are our fingers tired!

Thank you! I'll not be here all night!

Arecibo spared the axe: Iconic observatory vital to science lives on

Re: Welcome to 21st Century USA - How about an unbiased source?

That's because within the conservative community, evidence is secondary to ideology

To be fair the left is just as bad. Both sides of the political debate are doing the exact same thing.

While I think that's true of the extremes, my experience with mainstream liberals has been that they are more accepting of contrary evidence than mainstream conservatives. My experience has been than (in the US, anyway) conservatism is much more rooted in dogmatism.

This contrast reminds me of the final question in the debate between Ken Ham and Bill Nye on creationism vs evolution:

Moderator: What would make you change your mind?

Ham: Nothing.

Nye: Evidence.

Re: Welcome to 21st Century USA - How about an unbiased source?

Within the conservative community, S.A. is considered a mouthpiece for the Left and nothing else.

That's because within the conservative community, evidence is secondary to ideology -- like the way you're parroting the conservative line without providing a shred of evidence of what you're saying. At least AC provided a source, whereas you're just providing unsubstantiated blowhardiness.

I know you won't agree with this, but I still want you to know that a LOT of intelligent, discerning people feel this way.

Wait -- I thought you said conservatives were the ones who felt this way??

BOFH: Do I smell burning toes, I mean burning toast?

Re: problem cats are the product of problem people.

You see when a mummy cat and a daddy cat are very much in love with each other...

Is that what started all that mess in Egypt way back when?

Why are we disappointed with the best streaming media box on the market?

Re: What does it do...

It's what it doesn't do that a PC does. No general-purpose programming, simpler device management, focused UI, etc. This allows it to be smaller, cheaper, and better targeted.

Yes, you CAN get a $100 PC to do what one of these boxes do, but you'll spend days to months stripping down the OS and customizing the UI to make it work, and even then it'll be slower and harder to use.

Re: I want one that works...

" I want H.265 support to watch my PC stored movies."

Plex works with Roku and most other boxen and you don't have to worry about codecs.

Humble civil servant: Name public electric car chargers after me

Re: So

Accompanied by a horrendous screeching sound?

Knock, knock? Oh, no one there? No problem, Amazon will let itself in via your IoT smart lock

Foyer

Mudroom,

Porch,

Airlock.

Just a few names for similar concepts, where you have two doors between the outside world and your private areas. They don't need to have the same keys.

Phone crypto shut FBI out of 7,000 devices, complains chief g-man

Weak Logic

The problem does not arise in the UK, where it is a criminal offence to refuse to give your password to State investigators.

Oh?

Is the penalty for withholding one's password as severe as or worse than the penalty for the various crimes such evidence may be used for?

How does imprisoning or fining one suspect assist in tracking down others?

Or are you saying that suspects are so polite in the UK that, on hearing that it's (GASP) not proper for them to withhold their passwords, they all immediately surrender said passwords?

Supreme Court to rule on whether US has right to data stored overseas

Re: Interesting tussle coming up ...

The US has a long (and proud?) tradition of extra-territoriality...

As opposed to the British, who have absolutely no history* of such behaviour.

* Because they opted to go the other route, viz. simply declaring any plot of earth which caught their fancy as part of their empire**.

** In spite of*** any objection from the poor people who happened to be living there.

***And often, to pour salt in the wound, ostensibly for the benefit**** of said people.

**** The benefit being, of course, to teach them Proper English Manners*****.

***** Up to, but not including, of course, the manners found in *.

Western Dig's MAMR is so phat, it'll store 100TB on a hard drive by 2032

Re: Why not SSD Drives?

LTO3 (400GB) , LTO4 (800GB) used tape drives...

1. When you've got 4TB of data, even an 800GB tape drive is not so useful.

2. I'd trust a used HDD before I trusted a used tape drive.

$50 to $100 for LTO3 and around $200-$250 for LTO4. With new unused tapes costing from $5 to $15 for both LTO3 and LTO4 (depending on sellers).

So that's (benefit of the doubt to you) $50 for the LTO3 drive and $50 for the ten tapes it'd take to store 4TB = $100 for LTO3, or $200 for the LTO4 Drive and $25 for the five tapes = $225 for LTO4.

Or you could just get a 4TB USB3 backup drive for $100 and enjoy faster and more selective backup/restore and not have to swap fscking tapes all the time.

Is that a bulge in your pocket or... do you have an iPhone 8+? Apple's batteries look swell

Re: Obligatory

"This is my personal commitment to El Reg, every time one of their authors uses it I’ll ask them nicely in the comments to grow the fuck up."

Because! That's! Worked! So! Well! With! Their! Other! Memes!

Seriously, man, this is a site of trolls. The writers, the readers, the commenters, the editors -- all trolls. "Biting the hand that feeds IT" -- get it? How could you not have gotten it in over EIGHT YEARS of visiting this site?

But no, you've just done the one thing you don't do to a troll: you've exposed your weakness. Look forward to the phrase "Cupertino idiot-tax operation" showing up in every article even remotely related to Apple, and in every single comments section you ever participate in from here on out.

Yahoo! search! results!, recommendations!, ad! flinging! code! is! now! open! source!

"Vespa is the single greatest piece of software Yahoo ever built,"

High praise indeed.

This post was brought to you by the Sarcasm Standards Institute. If your sarcasm detector registered a 7.3, it is properly calibrated. Have a nice day.

Microsoft: We've made a coding language for a quantum computer that may or may not exist

Microsoft's Quantum OS

Both vulnerable to malware and in the middle of restarting to install updates at the same time!

Pirate Bay digs itself a new hole: Mining alt-coin in slurper browsers

Re: ...support the website without seeing porno I am in...

This would only hurt his bottom line...

The pirating or the porno?

Microsoft teases web-based Windows Server management console

Management Console looks good...

but what's that flat, boring skin they're using for Chrome there?

Senators call for '9/11-style' commission on computer voting security

Re: Not The Real. Problem

What we actually saw was 1,101,178 voters voting and 1,115,664 votes cast - both those numbers are from the Chicago election board.

Both of those numbers are from this story: http://chicagocitywire.com/stories/511195461-election-board-lists-more-general-election-votes-than-voters-in-chicago

That story also includes this explanation from the Chicago Board of Election Commissioners:

Jim Allen, a board spokesman, said that the list [of 1,101,178 voters] turned over to the Chicago Republicans was incomplete and handed over prematurely.

“Not all voters were entered electronically into the system at first,” he said. “They have since been added.”

End of story.

Re: Not The Real. Problem

You're absolutely correct.

What you've described is not the real problem.

In fact, it's not a REAL problem at all:

Registered Voters, Chicago Illinois, 2016 general election: 1,570,529

Votes Cast, Chicago Illinois, 2016 general election: 1,115,664

(https://chicagoelections.com/)

This is a 71% turnout, which is consistent with the region historically.

The real problem is morons who still believe Fox News and ultra-conservative blogs after they've repeatedly proven that they believe lying is a valid tactic for pushing their political agendas.

There is no credible source which supports the story you're repeating.

Terry Pratchett's unfinished works flattened by steamroller

Re: I'm touched by the weirdness of this request...

Is there a suggested reading order?

Yes. Don't skip over the footnotes.

Daily Stormer booted off internet again, this time by Namecheap

Guidance and Indemnity

Was Namecheap registrar, hosting provider, or both to Daily Stormer?

The role of a registrar is to map text strings to numerical addresses. They are, and should be, solely a technical resource, like a phone book. They should also be treated legally, and by society, as such, and not held responsible for the content made available at those addresses.

Hosting providers, on the other hand, have to actually store and serve up the content. They bear greater risk of being associated with the content as well as infrastructure risk of excessive requests due to either spiking interest or DDOS attacks. Hence they should be allowed some leeway in what content they are willing to host.

What's your point, caller? Oracle fiddles with major database release cycle numbers

Be More Concise!

How are we supposed to know if it's a x.1.x.x release and hence only for Americans as [N]o sane person would install a x.1.x.x Oracle DB? Last time I made that mistake was 10.1.0.4 oh disk corruption in asm when you add a new volume how I don't miss you.

There you go!

BOFH: Oh go on. Strap me to your Hell Desk, PFY

Re: True to tradition

I don't think he could have given the BOFH a big enough cut. 3 digits doesn't seem like much, unless you're talking percentages or fingers.

Amazing new algorithm makes fusion power slightly less incredibly inefficient

Re: Optometrist Algorithm

Nah, this is computerized. So it's more like:

Which is better?

0?

<flip>

or 1?

<flip>

0?

<flip>

or 1?

US Homeland Sec boss has snazzy new laptop bomb scanning tech – but admits he doesn't know what it's called

...terrorists had developed a method of packing explosives into notebooks...

On a completely unrelated note, whatever happened to all the batteries from those Note 7s, anyway?

Bloke takes over every .io domain by snapping up crucial name servers

Double-edge

Also, it's doubly worth pointing out that DNS lookups are often cached, so the chances that a lookup will go all the way to the authoritative servers, and hit one of the hijacked ones, is low.

On the other hand, for exactly the same reason, any lookup which did hit a hijacked server might remain cached by non-authoritative name servers and be served up to all of their clients until either the operator of the caching servers finds out and clears the suspicious records or the TTL (which a malicious actor might set quite high*) expires...

* The TTL field in the DNS specification was originally a 32-bit signed integer, allowing values over 2 billion seconds (~68 years). Later clarification required that negative values be treated as 0, but still permits a 68-year positive TTL.

Web inventor Sir Tim sizes up handcuffs for his creation – and world has 2 weeks to appeal

Re: I don't see a problem.

You can't have an open source implementation of a DRM'ed browser without it leaking the content.

Actually it is possible, just very difficult.

Which is why the standard is recommending putting the DRM piece in the CDM, not the browser.

The CDM is the Flash-equivalent binary, except way simpler. The idea is to reduce the scope of the proprietary bits to the minimum needed to support DRM. It's a compromise that is actually very open source friendly.

And whether W3C approves it or not, it's already been here for years. Have you watched HTML5 video from Amazon, Netflix, Hulu, PornHub, et al. In any browser? Then you've been using a CDM.

FREE wildcard HTTPS certs from Let's Encrypt for every Reg reader*

Re: An admirable effort.

I believe this is what you meant to say:

This is true: "HTTPS = safer than HTTP"

This is NOT true: "HTTPS = safe"

Adding encryption is just one piece of a complex security framework.

PS. Damn you, El Reg! Complaining that you hadn't adopted HTTPS on every article in which you tell people to adopt HTTPS was one of the few pleasures I had left in this world!

New work: Algorithms to give self-driving cars 'impulsive' human 'ethics'

Re: Save the women and children first!

Firstly, having a choice does not equate to being in a position to make a choice, especially when that choice has to be made immediately and without time for analysis.

The parameters of the problem state that you are in a position to act, and most forms state that you do have time to make a choice, but not to analyze that choice. It's a snap decision, yes, but it is a decision.

Secondly, you seem to assume that everyone can make decisions easily and instantly when in reality many people find it difficult to make any decisions, let alone stressful ones; you can't simply claim that an inability to decide is a decision in itself.

This is the entire point of the Trolley Problem. It's an edge case exemplifying the line between thinking things through and snap decision making.

Perhaps you personally find it easy to make decisions - that's fair enough for you, but if you start projecting your decisiveness, or indeed any of your personal qualities, upon everyone else you're going to end up criticising everyone else for not being you.

I believe you misunderstand my point. My point is that if you are in the situation described by the Trolley Problem, then, whether you throw the switch or not, you are the only one with the capability to do so. Hence you have a burden of responsibility to do one or the other, and will personally have to live with the consequences of whatever you do.

I am not ascribing judgement on either choice, nor am I suggesting legal culpability would be a good thing in this case (as others have mentioned, the Good Samaritan laws exist specifically to prevent heaping legal trouble on top of the moral conundrum this type of problem poses.)

Re: Save the women and children first!

"if you do nothing then you can't be held responsible for the deaths of the several people because their fate would be the same as if you were not present and unable to influence the outcome."

No, because doing nothing when you have the capability to do something is a choice in and of itself. Hypothesizing about being removed from the situation is simply wishful thinking in an attempt to abdicate responsibility, not a valid logical argument.

Re: Save the women and children first!

The assumption is that this is a good thing but now you may be deliberately mowing down A to preserve B which will be making lawyers salivate.

Or run, depending on where they are with respect to the road...

Search results suddenly missing from Google? Well, BLAME CANADA!

Re: JohnnyS777

Oh yeah, and if you don't want to be associated with animal care products, especially by a site known to take tech companies less than seriously, you may want to rethink your company's name -- it's amazing how many people know just enough Latin...

Re: JohnnyS777

Looks like somebody joined just to plug their company's point of view! Welcome, JohnnyS777!

That Title box above the comment area is for putting a relevant title to your post, not for repeating your handle.

Your arguments about Boeing and Jaguar are speculative and without merit, but to answer them anyway, I'd expect Boeing or Jaguar to pursue the case in all relevant jurisdictions, not to presume a single nation can dictate global activity with impunity.

The question at hand is whether a local judge has jurisdiction beyond their nation's sovereign borders. Do you believe that to be the case?

Not Apr 1: Google stops scanning your Gmail to sling targeted ads at you

Re: Cost

Scanning for spam detection and scanning for personal info for targeted ads are two different things.

Not as different as you apparently think. They're both essentially contextual key phrase scans. To be effective, they both require the same type of processing, and if you're doing one, the incremental cost of doing the other is very close to zero.

Re: Cost

Wait until the AI algorithms can filter out the spam...?

Without scanning it?

Intel to Qualcomm and Microsoft: Nice x86 emulation you've got there, shame if it got sued into oblivion

Re: Tough Times at Santa Clara

Your linked article is not evidence. It's hypothesis.

Specifically, it's a calculation based on published ratings and some tests (not linked or adequately documented) which is assumed to give a good estimate of performance per watt: "We are not pretending that our calculations are 100% accurate, but they should be close enough."

There are also a lot of "probably"s and "assume"s elsewhere in that article.

Evidence would be actually running specific loads on specific systems and comparing those results.

The whole idea of "x is more efficient then y" is incomplete, lacking the vital qualifier "at z."

Of course they welcome lawful competition

They've spent billions of dollars over the years writing those laws, they'd love it if their competitors followed them...

We're not saying we're living in a simulation but someone's simulated the universe in a computer

Re: Are we a simulation?

No. That's preposterous. Of course you're we're not in a simulation. Now just go back to your day, subject 3E1AC75B34FF21 yank_lurker...