Posts by clocKwize

Disputed eBay platform vuln poses ‘severe risk’ to tat bazaar's users

This isn't a new thing, this has always been the case. Its been reported many times and I'm sure its been highlighted in many news articles (maybe on El Reg)... Why do I think its not going to get fixed this time either?

At least 10 major loyalty card schemes compromised in industry-wide scam

rewrite of subways response: Hey, the personal data you gave us, that we gave to a third party got stolen, BUT IT WASN'T US! WE AREN'T RESPONSIBLE! LOL

VW's Audi suspends two engineers in air pollution cheatware probe

It is definitely bollocks. Devs build what someone above them tell them to build, then there are other people that test it, and other people that sign it off, and other people that ensure that that particular change gets in to a final release build of the software..

Unless they seriously on their own accord snuck it in without anyone noticing for no reason other than thinking they were helping the company but not wanting any credit for it, the story doesn't fly. Even that doesn't make sense.

Maybe nobody considered it would interfere with the regulatory testing, could have been an honest mistake. That still doesn't make it the developers fault. Its a team/company problem, regardless of who done what. Stop pointing the blame at singular people and hold your hands up and say "yeah, we fucked up, sorry".

Dad who shot 'snooping vid drone' out of the sky is cleared of charges

How fun would it be to shoot a drone out of the sky though? I envy him.

Symantec fires staff caught up in rogue Google SSL cert snafu

Employees shouldn't have the ability to generate legitimate certificates for testing. If its that easy, there is a bigger problem with their security and procedures and Symantec should no longer be trusted to issue certificates. Its that simple.

Boffins nail 2FA with 'ambient sound' login for the lazy

What if you want to login on your phone?

Facebook's React Native is exciting devs. Or is it, really?

This article seems like a mash up between something about react native (a thing that lets you write native apps with react) and a comparison of web frameworks. Are these 2 things related? Not really. Does react native deserve an article? probably not. There are other frameworks that do exactly the same thing, except without react. Its not new(s)

Vauxhall VXR8: You know when you've been tangoed

No picture from the outside?

Odd to review a car without posting a photo of it..

That EVIL TEXT that will CRASH your iPhone: We pop the hood

I love these in depth write-ups about why these kind of things happen. More of this.

Instagram's HTTPS cert expires, millions of crap photographers panic

Rookie mistake.

Sysadmins, patch now: HTTP 'pings of death' are spewing across web to kill Windows servers

What the hell

I didn't read all the comments so this might have come up before..

Talking of "attack surface". Who the bloody hell implements part of a public facing web service as a kernel module :O ARGH.

+5 ROOTKIT OF VENGEANCE defeats forces of gaming good

People have been using kernel drivers to hook core system functionality and expose features via some API to a user land app for years. This isn't news..Even down to the "double paged memory" thing mentioned, which is definitely based on http://phrack.org/issues/63/8.html "shadow walker" released in august 2005. I used to hack games. Its all about finding inventive ways of modifying another application without using any of the same methods as anyone else has released in to the wild (and therefore patched) so if you can totally hide the memory you've changed (at least in the view of the game) you're almost unstopable.

Oh no, Moto! Cable modem has hardcoded 'technician' backdoor

"Lets add a hidden backdoor!" Nobody could possibly disassemble the firmware and find it! Famous last words..

GitHub ordered to hand over access logs to Uber

Where does the fault lie?

"secret access key" to the database... You mean password.

Posted to a gist, which was probably a secret gist, but it's still accessible by anyone who knows the url... I'm assuming they are trying to find the engineer who probably accidentally posted it with a paste of some code.

Is it their fault alone? Probably not.. Keys should be stored in configuration files or ENV, not code. If that was the case the whole team is responsible for never fixing that massively bad practice

Boomerang rebound: Site shut amid credit card securo-fears

If they are using sage/world pay, those providers I doubt leak credit card information, and i think they are both redirect payment providers, so card details aren't taken on their customers server.. so I don't know how this would happen?

If they do offer solutions where its tunneled through their customers server, they've probably stored them in some form (naughty: database, stupid: logs)

Users shun UK.gov flagship digital service

I like gov.uk in general. It looks nice, the information is generally easy to find, its often laid out in a nicer way. Far better than the old sites its replacing, its always a work in progress I guess, there is a lot of information and functionality to move, but I think they've doing a good job so far.

65 patches later and Java STILL breaks stuff

If you are going out of your way to manually generate bytecode that does not conform to the specification but just happens to work, I'm not sure how much sympathy I have.

I know it might be indirectly via some tool or another and those doing it might not know it was happening, but someone somewhere was doing it and it sounds like an all round bad idea that would obviously byte(geddit) them in the arse at some point.

How to make $7,000 a month and benefits: Be a teen tech INTERN

Re: If they can code why work for someone else?

I'm a developer.. It doesn't mean I have enough time (outside of a job and family life) to dedicate enough time to building a product. I can't market the product, I can't do fancy designs for the product.

These things often require a lot of support around developers to make them happen.

BMW's ConnectedDrive falls over, bosses blame upgrade snafu

RE: worry that it can disable limiters, change fuel parameters, etc... If you think of it like a remote control, there is only a limited set of buttons to press. it works via SMS (from BMWs server to the car) and it will only perform certain actions it knows how to perform.

Mine lets me remotely lock/unlock it - which i think is kind of useless and I've never tried to do (why would I?)

The feature I actually use is sending locations to the car, so when I get in, sat nav is ready to go... It would be far better if I could do that from google maps, or something, instead of having to login to BMW ConnectedDrive and using their cumbersome interface, but still quicker than using the spinny wheel thing to enter postcodes!

Internet-of-stuff startup dumps NoSQL for ... SQL?

Re: Is this news?

"NoSQL doesn't work if you try and do it in a relational way"

"It does - you've just got to change your thinking. Instead of mapping your data model to the abstract, normalised relationships, you map your data model to the use cases of those relationships."

But then thats not a relational way... you are expanding on exactly what I was talking about :)

Is this news?

NoSQL solves a different set of problems. They have relational data, they even described it in a relational way (one to one, one to many, many to many..).

The problem is 1 of 2 things:

1) Its relational data and fits best in a relational system, maybe they should have thought about this first and picked the right tool for the job.

2) After describing it as relational, maybe they just implemented it in a relational way? NoSQL doesn't work if you try and do it in a relational way. I made this mistake once.

Slow news day though?

Altcoins will DESTROY the IT industry and spawn an infosec NIGHTMARE

Dedicated mining ASIC chips etc won't crack passwords without modification

Unless the host computer gives it a list of every hash to try, which would be horribly inefficient as it could probably try them faster than its given them.

the code that mines basically double SHA256's a few parameters joined together to see if it gives back the correct result. Its the previous hash, a nonce and a timestamp (my rough interpretation, probably wrong but along the right lines), and from those parameters it can iterate through many inputs.

To actually turn an ASIC chip in to something to brute force a password would require changing the ASIC chips in a big way, I'd guess. Not to say someone (read: NSA) wouldn't do that.

Bitcopocalypse! Top cryptocurrency can be hijacked, warn boffins

When it costs more in electricity to mine them than they are worth, won't the currency go tits up? Or will it just fall to botnets to mine coins as their leccy is free..

Facebook fix a bounty boon for researcher

RE: This bug represents a cultural problem at FB

Unfortunately people can't possibly comprehend every possible path an application can take especially when that application has as many different parts as facebook. I'm sure they try their very best but its easy to overlook something once in a while.

At least they are doing something positive by paying bounties to security researchers who find bugs, instead of prosecuting them..

The best possible way to try and fix vulnerabilities like these is to get a bunch of people to try and find them from the outside in and tell them, looks like its working.

Earthworm Jim

Re: Antiques Code Show

<quote>It's called Code Show in an attempt to make a pun out of the name of a certain staple of Sunday night BBC TV, namely Antiques Roadshow.</quote> I got the reference ;) It would only make sense were there some code.

I'd like to see DOOM source. I've never written a game but I've played with the idea and know the SDK of a few newer engines rather well..

Maybe if I get some time between working and family I'll go find it :)

Antiques Code Show

Good game. I hate the way its called Antique Code Show though - I'd like to see some code, I'd find that rather interesting. The only significant game code open sourced is Quake right?

Chinese student fails job interview because of iPhone

Meh, I have an iPhone, I got it a month or 2 ago after having various android handsets for the last 4 or 5 years. I also have a mac book air.

Because they are just far less hassle. They just work most of the time. Which in my experience is far more than an android.

Also my mac book air is way more powerful than most laptops, and I sometimes have to check to make sure its in my bag, not reposition the strap because its hurting my shoulder.

I also dislike fanbois. I don't buy apple products because they are hip and make me look cool (the hundreds of comments so far prove that is not the case right?) I bought these 2 because they do a better job than other things I've used.

I think its wrong to not give a job to someone because of their phone choice. I'd definitely have been happy to not work there anyway.

LG claims UK Ultra HD TV first

This reminds me, I'm still waiting for my 2 pairs of active 3D glasses to arrive that I got free "via redemption" with my Panasonic TV - Why didn't they just put them in the box with the damn 3D TV?

Beware the malware-tipped SPEAR TRAP in your inbox

Things like gmail give you an infinite amount of aliases, you don't have to do anything to set them up, its just how they are routed - for instance, if you sign up to something as you~[e-mail] when they email you it'll get routed to [e-mail], but you'll see it being addressed to you~[e-mail]. This means you can see where spam is originating from.

This isn't very hard to get around for the spammers though, they can just remove the ~somesite if they want.. but it wouldn't be hard to come up with a more sophisticated solution if you run your own mail server.

Call of Duty: Black Ops 2 game review

Pick 10 is basically you can have anything (any weapons, perks, attachments, wildcards, etc) as long as you have no more than 10 in total.. so you could have 2 primary weapons, if you a wild card that lets you have 2, but then you'd have to give up 2 other things (1 for the wildcard to allow it, 1 for the thing the primary weapon was replacing.. probably the secondary weapon right?)

Twitter survives election after Ruby-to-Java move

You can't bash Ruby for not handling a global service that has clocked 15k tweets in a single second. Ruby is slower than other languages, we know this. Yet we'd all still rather use it and know our systems are slightly slower.

If you were to build the same system in java/c++/c# it would be faster, hell yes. But it'd also take a LOT longer time to build and would be harder to maintain.

It's very easy to over-optimize "my app isn't as fast as it can possibly be, lets spend 3 months making it quick" but then there is probably a 95% chance you will never have enough traffic to even notice it being slow. That is a waste of resources.

and if in the happy event that your site does become so popular its straining under the load, thats GREAT. spend some of the mountains of cash you've just made rebuilding it for what you now know isn't wasted effort.

Might I point out, is exactly what Twitter have done.

WoW cities wiped out by 'exploit'

This reminds me of exploits in online games when I used to write them...

In F.E.A.R MP I basically copied some code that was called when you were in a car and hit someone, it sent an event to the server like PLAYER_HIT(player_id, damage) I put the damage to 10000 and called it in a loop for everyone I could trace a ray to and hit from my current location, then run it every tick...

That had the effect of everyone who is in view of your character dying the second the come round the corner...

Maybe this is something similar? I know the anit-cheat in WoW is meant to be good but it can't be perfect and I be there must be some holes like this? Obviously FEAR was badly written in a way that let clients tell the server what had just happened, not the other way around, but there must be some?

Apple MacBook Pro 13in Core i5 laptop

For a start don't be bias just because its from Apple and you HATE apple fanbois.

I fucking hate iPhones, iPods, iPads, iMacs and anything else with an i on the start. All overpriced and ok, but nothing special.

I'd never have tried a mac book pro or air if my company didn't buy me one. Having said that, they are fucking amazing to work on, the operating system once you get over all the weird/pretty ui and just use it like you want, is great.

Build quality is amazing, I've now had a MBP 15" and an MBA 11" - both are the best computers I've ever had. Things never go wrong, it always just works as expected, it doesn't feel like you might break it by dropping it, we've had someone knock a bottle of water over a MBP, about 300ml from a 500ml bottle, and we turned it upside down and left it to drip out for a few minutes, wiped it off and carried on, it didn't ever crash it or shut it down..

If you want a really high spec computer, then don't spend your money on a MB but if you are realistic about your usage of said computer, I'm a developer, I don't need high power spec or graphics, i need a decent amount of ram, a dooable processor and I need it to work without any hicups. which it does fine. my MBA has 4gb of ram, which isn't great nowadays, but the systems runs smooth no matter what i do on it, no matter how many things i have open, it just works. 4gb on a windows pc just about keeps the operating system happy.

If I was to buy my own laptop, I maybe wouldn't go for a MB, they are expensive, no doubt about it. But if you get over the fact you won't get as high spec for your money, its clearly worth it.

penguin because its in there somewhere.