Posts by PeteA

Antivirus vendors fail to spot persistent, nasty, stealthy Linux backdoor

Re: Wow, that's no script kiddie

the malware “integrates deeply into the authentication stack, survives system updates, and leaves almost no forensic traces. Combined with layered obfuscation and environment tampering, this makes it exceptionally hard to detect using traditional tools."

That statement sounds almost breathless yet doesn't actually make a lot of sense based on the article. Disassembling it a bit:

- It's a PAM module, so obviously it is integrated into the Pluggable Authentication Module stack.

- It only survives system updates if the update doesn't reconfigure the PAM stack. Same as any other bit of malware that uses a modified configuration file somewhere.

- It definitely leaves forensic traces, in the form of [1] entries in the PAM configuration and [2] `.so`s in unexpected locations. It doesn't seem to leave much in the way of traces *when activated*, though you'll still get the audit records which should ring alarm bells.

- Where is the "layered obfuscation"? There is obfuscation by means of the `.so` names, but I didn't notice any _layering_ involved.

- "Leaves almost no forensic traces" appears to be a reference to the "environment tampering", i.e. getting rid of the SSH_* environment variables and redirecting history to `/dev/null`. Which I'd suggest is more related to self-protection by avoiding little things like the IP address of the SSH client (read: malicious actor) being logged than to hiding forensic traces. The traces should still be pretty visible if you know what you're looking for, unless there's more going on than the article suggests.

Given that installing the malware requires root access to do PAM reconfiguration then far from needing a bunch of knowledge to envision this hack it actually seems rather overblown. I'd imagine it'd be easy enough to configure standard PAM modules to have the same effect. For example,`pam_succeed_if` should do the job quite nicely.

Microsoft promises it's made Teams less confusing and resource hungry

Make it fast?

Hmm, I know about the other parts of the approach, but don't remember that bit. Don't think anyone could accuse Windows 3 of being fast. Or Windows 95. Or 98, millenium edition, NT, 2000, 7, 8 or 10 really. Haven't had the misfortune of having to use 11 yet, but I'm sure it's coming.

NHS tech chief dismisses concerns over loss of statutory power to protect patient data

Re: Medical misinformation

You get to see a GP? How do you manage that?

PanWriter: Cross-platform writing tool runs on anything and outputs to anything

A markdown editor

So it's a markdown editor then. If you're just looking for a lightweight markdown editor, then when not just use vim? Ultra-lightweight, intuitive commands (e.g. 'w' to Write a file, 'q' to Quit, can even be strung together so a simple `:wq` is sufficient to enter command mode, write the file, and then quit).

Flames incoming in 3... 2... 1...

Waterfox: A Firefox fork that could teach Mozilla a lesson

Re: Palemoon, check. Seamonkey, check.

Yes - vim

Re: Palemoon, check. Seamonkey, check.

Emacs as an HTML editor? Whatever floats your boat, I suppose. Although _exactly_ why the unwashed heathen masses don't bow down to the power of the One True Editor, Vim, escapes me*

*Have realised on occasion that I'm busy changing things with vim ... running in a WSL session in a VSCode terminal ... ho-hum!

GCHQ boss warns China can rewrite 'the global operating system' in its own authoritarian image

Re: Global operating system

To an extent, the "global operating system" is the emergent behaviour from the combination of all the various standards (formal and informal), legislation and "standard practice" that has developed over the years into a rather arcane IP-based API.

It's all fractals-in-fractals ... what's the OS on my desktop? I'd probably say "Linux", although I really mean "a Linux kernel with a GNU userland and whatever other binaries I install". But in fact, that's just the OS I interact with. I imagine that each of my disks has an OS too (pointless having an ARM processor if not!!), along with all the other peripherals that gain "smarts" over time. So yeah, I buy into the idea of higher- and lower- level control planes^h^h^h operating systems. A shell running inside a container might _think_ it has an operating system, courtesy of the various kernel features (such as namespaces and cgroups) that have been cunningly kludged into the virtualisation construct known as "a container", but it doesn't really, it's just an illusion.

When I deploy some workload into Kubernetes ... I'd suggest that the k8s API's come very close to Wikipedia's definition of an operating system ("An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. ") ... hmmm ... a bit like kubelet then? And how does kata fit in?

Von Neumann / MIT architectures are interesting concepts. The reality is that we are rapidly moving to a much more distributed & interconnected system which resembles an ecological environment and has lots of different morphologies. Many of the inhabitants are symbionts (such as the OS on my HDD's), some are classic Von Neumann / MIT behemoths

Glibc 'abortion joke' diff tiff leaves Richard Stallman miffed

Re: Shouldn’t quality and professionalism be the issue?

Doesn't informative and _instantly memorable_ documentation constitute professional quality? Bit better than than a dry description of enforced descheduling which barely references the offending word - note that "Aborting" is a logical derivative of the function abort(), so it's pretty hard to document the function without using that word somewhere .... and I really appreciate this stuff being documented!

That said, no room for gratuitously offence content, and even though I appreciate freedom etc. I do wish that we could standardi[sz]e on one spelling convention for technical work .... sadly, probably American because it is the dominant branch ... I often get caught-out by UK-origin CLI commands that use my native language (`--colour` ...) because 97% of the time it's the American spelling

Partial beer print horror as Microsoft's printer bug fix, er, doesn't

Re: For shame, Richard

A mild observation, more bitter personally

Harmed by a decision made by a poorly trained AI? You should be able to sue for damages, says law prof

Re: Theory and Reality

Clearly rhetorical question answered: the person who used the gun. Exactly the same as any other murder weapon.

Framing the AI question similarly: the person who chose to entrust [a particular] AI with a life-critical decision. The AI is just a tool, speaking purely personally I'd like to some _real_ intelligence before we move on to artificial.

Back in the real world, it's usually not so simple - in my experience, you often see organisations forming a "cultural identity" which is essentially a shared-belief-system. This can help promote workforce unity, but can have ugly consequences when a "freak wave event" of shared identity ("tribalism"), social pressure and external pressures are combined with dubiously ethical directives from "The Boss". Haven't personally experienced the phenomenon to this level of importance, but have seen the general sequence of events a couple of times.

On his way out, Trump emits exec order suggesting US cloud giants must verify ID of all foreign customers

Missing the point?

[IMO] this order isn't really about ID'ing "foreigners", though the language and implications of foreign malevolence will of course play to a certain demographic. The actual *aim* of it is to cut foreign resellers of IaaC out of the US market by making the cost of entry prohibitive. Typical misdirection in the pursuit of MORE MORE MORE in my personal (malleable-to-reason) view.

What happens when a Chrome extension with 2m+ users changes hands, raises red flags, doesn't document updates? Let's find out

Re: They go after the older weaker members of the herd

Straw man - the "Linux plug" was in response to a comment relating to the installation of native software:

Had a shock a couple of days ago, building up software on a new PC. Moving through the list of stuff on the old one, came to BitTorrent, and installed the latest.

Irrespective of operating system, browser or other specific technology choices though, the fundamental issue is one of untrusted code execution; specifically, _who_ do we trust? Can I trust my hardware (particularly the firmware) at all? If so, then do I trust the operating system - even if it was pre-installed by the vendor (think Android) together with a bunch of arbitrary software of their choice? How about when I choose some ${package} for the software I'm developing as a convenience utility?

The reality is that at some point you have to trust your supplier. I don't claim to have a good answer for the core problems, though I do like the kubeos ideas. Given that I'm a reasonably experienced "IT professional" without a watertight solution, and in the context of the article; is it truly reasonable to expect "average users" to be able to make an informed decision about what they install from an apparently-supplier-sanctioned source (the Chrome web store)?

If the answer is "No, an average user cannot be expected to make an informed choice" then there is a consequential burden on the supplier to do so on their behalf. Apparently, in this case, they have fallen short because the black-hats have found a loophole in the decision-making progress and are ahead for a while. Unfortunately, Google appear to have chosen the Boeing strategy of denying this and working to close the hole.

You love Systemd – you just don't know it yet, wink Red Hat bods

Concept OK - implementation lacking

The essential concept behind SystemD (modelling the system as a dependency graph) works for me, but unfortunately the implementation is rather lacking in reliability. I've developed the same level of nervousness about rebooting that I used to have for Windows a decade or two ago. Init relied on you to get things right, and had nothing more than basic linear prioritisation. Much more basic - and much less maintenance hassle.

Devs strung up about .NET 5.0 string changes that may break working code are told: It's not a bug, it's a feature

Semver FTW?

Re: Future issue of PowerShell as well then

Sodding good reason to stick with a proper shell then

Re: "... that doesn't create new productivity improvements for our users"

s/regexes/regices/g

Re: "... that doesn't create new productivity improvements for our users"

CRLF is correct ... for a TTy.

Sadly, TTy/VT is lowest common denominator ergo CRLF is corrrect regardless of 1-bye (semantic) excess. Seems a bit ironic to refer to {CR}/{LF} as "clearly seperate operations" that should be treated as such for RTL, which is reason they're separate operations^h^h^h TTy codes in Windows.

Speaking as an old fart who *used* mechanical typewriters, MS got this one right. CR and LF are different. VTxxx mimics the mechanical operation, ipso facto *either* CR/LF or LF/CR are just fine but merely LF is not. Oh, and please remember line-oriented hard-copy output, e.g. DM printer* .... I know, it's archaic, but it still *works* and some of us don't like wasting money on shiny)

* Citizen 120D - amazingly robust kit

Re: "... that doesn't create new productivity improvements for our users"

CRLF vs LF vs LFCR - let the religious wars being.

Heretic here - I think C/LF is spot-on-right semantically, Un*x / MacOS is wrong. Horrible admission, but there we go. Maybe because once upon a time I use a real mechanical type-writer where CR and LF were different physical actions, as replicated in VT{52,1xx} and thereby into history..

Icon because, well, DOS^h^h^h Windows got it right IMO

Re: comprehension

Too easy to down-thumb, some of us have been doing this for a while and some haven't. Kudos.

Re: "... that doesn't create new productivity improvements for our users"

Too long since I actually wrote code - but agreed, that's good behaviour. It's essentially a bit of static-analysis baked into the `compiler` (inverted commas because it's all JIT compiled to MC anyway). Always been a proponent of static analysis/"code contracts" personally, the less that fail at runtime c.f. compile time the better IMO.

Icon because, well, I've rather obviously had a few based on this comment's lack of literacy ...

Relying on plain-text email is a 'barrier to entry' for kernel development, says Linux Foundation board member

Welcome back, amanfrommars

See title

Dear Microsoft....

How about you bugger off and get your own house in order. When you've caught up with the processes pioneered in OSS to deliver reliable software at scale, we'll talk.

Thank you.

Geneticists throw hands in the air, change gene naming rules to finally stop Microsoft Excel eating their data

Re: I must be missing something...

Perhaps tweak the first line identifier to "#!/bin/vi" ?

Re: Happens in Google sheets as well.

Unfortunately, the day doesn't really have "an end" point - there's a concrete *start* at 00:00, and various times leading up to that such as 23:59:59.9999. But no specific end point, just an analogue rollover. There's also no such time as 24:00; the constraint is 0 <= HH <= 23. So midnight is always YYYY-MM-DD 00:00, where DD represents the day that is just starting [which feels a bit counter-intuitive].

FWIW, the most serious Excel issue here doesn't seem to have been noted: the default association of a CSV with an application that doesn't handle CSV's properly. All one of those scientists has to do to destroy their data is double-click the file and then hit "Save"; there is no point at which it is even possible to intervene during the "import". This has caused grief in just about every business I've worked in, particularly when the marketing team have been involved.

Mine's the one with the group policy to associate CSV's with notepad....

It's been five years since Windows 10 hit: So... how's that working out for you all?

Re: Windows 10 worked out super-great for me

"As a consolation, I can use Raspbian on my Raspberry Pi, and it's based on Linux. Apparently they now have a version that can run on a PC "

OK - I sympathise with your desire to use Linux on your desktop, but think you might need to do a bit of reading around before the assertion that you're not able to use any current distribution on your machine [presumably PC]. It may also be useful to quantify "not a one of them will work" into HOW they don't work; are they all the same [i.e., possible hardware-vs-Linux-defaults issue] or different [i.e., possible distribution-specific issues]

Finding files? `find` works pretty well, or `locate` if you want to be efficient. Just setup the config in wsl ...

Re: Nope

No joke ... after enduring 1.5 hours of the latest upgrade I rang a colleague to warn them and generally grouse. Too late - they started the conversation by complaining of the 2 hours just spent upgrading.

Why is it that my [multiple] linux boxen at home upgrade within a few minutes and rarely with any issues, whereas my work machine with Windows always takes "forever"? Admit to no recent [in last 2 years] issues though, this has gotten better in my personal experience

Dems take a crack at banning Feds from using facial-recog tech. Congress will put it on todo list after 'learn Klingon'

IT news sites in the UK?

Does anyone know of a good UK-based IT news site, ideally with good journalism backed by sarcastic British cultural references? There used to be one here, but some American outfit seems be cybersquatting. I really miss El Reg '(, you were part of IT's good times where craftmanship, elegance and creativity were seen as aspirational virtues rather than potential impediments for hordes of generic code-monkeys.

Outages batter UK's Virgin Media into wee hours as broadband failures spike 77% globally

Not caused by a spike in usage or a lack of network capacity

So just sheer bloody incompetence then?

Chrome suddenly using Bing after installing Office 365 Pro Plus... Yeah, that might have been us, mumbles Microsoft

Re: Antitrust

s/flashback/ptsd/g

All three of the Insiders on Arm64 can now muck about with Windows Subsystem for Linux 2

Windows kind of works on Raspberry Pi, but it is extremely slow and driver support is very buggy.

So it's just like Windows on x86 / AMD64 then.

You're not Boeing to believe this, but... Another deadly 737 Max control bug found

Real solution...

Fix the aerodynamics, lose the band-aid.

Essentially, the problem is that the aircraft is inherently unstable because of the engine positioning compromises. Boeing's initial test pilot (Ray Craig) recommended a hardware [aerodynamic] fix during simulator testing, but Boeing went with software compensation instead. Unfortunately, more issues emerged during real flight testing, and the software was "enhanced" and given more control. The rest, as they say, is history. Very good analysis available at engineering.com.

IMnsHO, this is a typical greed-induced clusterfsck resulting in an essentially unsafe design without the knowledge of anybody important (engineers, pilots, technical regulators etc.). I've no doubt that the approved "fix" will involve various changes so that the calculated probability-of-failure is inside some arbitrary threshold value, but the aircraft will continue to be unstable by design. And one day, everything will align in just the wrong way, the tiny probability of MCAS failure will come to pass, and more people will die. Refer to swiss cheese, or the old software development adage is that "If something can happen, soon or later it will happen".

The in and outs of Microsoft's new Windows Terminal

Re: CHUI: CHaracter based User Interfaces

OK, I'll bite ... it's not infrequent that I use vim from WSL (at work - at home I can use gvim). In general, I can open up vim, change code, recompile & get the changes pushed before Visual Studio's even got around to opening. So terminfo's still very important for me :). Excellent point about a terminfo entry for the shiny new terminal (ROFL - MS've caught up with the noughties. Next thing you know, we'll even be able to split it into a grid! OTOH, why you'd want to try doing anything serious on Windows eludes me anyway unless you've got a sadistic employer.)

Icon because it's what I look forward to after a week of fighting Windows at work.

Microsoft throws lifeline to .NET orphans in the brave new Core world

Re: "Orphans?"

Middle bit? <seealso cref="wsl" />

We don't know whether 737 Max MCAS update is coming or Boeing: Anti-stall safety fix delayed

Said for a while I prefer Airbus as a passenger - though the Embraer 190's are very nice, the ride feels very 'crisp' with none of the wallowing that I associate with this size of aircraft [and the 737 in particular].

Accused hacker Lauri Love to sue National Crime Agency to retrieve confiscated computing kit

Go Laurie!

That's all! Innocent until *proven* guilty (not charged, smeared, innuendoe'd, or anything else).

Sudden Windows 10 licence downgrades to forced Xcode upgrades: The week at Microsoft

Re: Insanity

You mean suspend/resume, I think

Re: Solidarity

Most Valued Capitali[sz]er...

Rejoice! Thousands more kids flock to computing A-level

Re: Fundamentals of IT

I have doubts that justice will ever be served.

You're an optimist then - I'm quite certain won't be.

Open plan offices flop – you talk less, IM more, if forced to flee a cubicle

Re: What about disturbing others?

I'm just human. I like to talk to my fellow human beings F2F. It's how you get to really know them.

What you doing on the El Reg fora then?

Happy birthday, you lumbering MS-DOS-based mess: Windows 98 turns 20 today

Re: The ONLY things going for it were

OS/2 Warp holdout here, until finally forced to admit defeat and use XP. Soon changed to SuSE though... then through lots of experimentation and distro-hopping to a stable environment with Windows relegated to a VM :).

Is your gadget using secondhand memory? Predictable senility allows boffins to spot recycled NAND chips

Re: I'm suspicious of the age of...

I'd like to help, but my core's gone rusty :(

Bloke fruit flies enjoy ejaculating, turn to booze when starved of sexy times

Re: Either good research or bad reporting

Don't ... feed ... don't ... feed ... ah sod it, I can't help it

But there is no reason to suppose whatever that this would have been forced to occur by "evolution".

There's every reason. Why do you think they looked where they did [a PET bottle dump] for "PET-eating bacteria"? In other words, they formulated the hypothesis that bacteria might evolve which could digest PET, then they proved the hypothesis, and then they started studying the discovery. It's evolution being predicted and exploited. Consider reading the abstract of A bacterium that degrades and assimilates poly(ethylene terephthalate).

Mad Leo tried to sack me over Autonomy, says top HP Inc beancounter

Re: Sounds liek the lawyer is trying to muddy the waters.

Are incompetence and being on the take exclusive conditions?

The first rule of maths class: Don't start a fight club

Re: Norwich

Oh, I assumed it was just your local dialect. Guess it's from across the pond, eh?

eBay has locked me into undeletable Catch-22 trap, complains biz bod

Re: unregulated rip-off site

Interesting - I prefer buying independently where possible (just got some kit from ebuyer, who were actually the cheapest of the 'usual suspects' for standard gear). Direct was (very roughly) 5% lower than Amazon price, and I really loathe the way Amazon treat me with the constant devaluation of their products.

What the @#$%&!? Microsoft bans nudity, swearing in Skype, emails, Office 365 docs

Re: Linux Torvalds

... and thereby demonstrating the reasoning behind Richard Stallman's viewpoints.

Brit regulator pats self on back over nuisance call reduction: It's just 4 billion now!

Scary recent exchange

This is a phone call I had last week:

Hello (my name), how can I help?

(Sales bullshit)

Are you aware that this number is TPS registered?

Yes, but I don't really care

(click)

First one I've experienced which was that brazen.

libcurl has had auth leak bug since 'the first commit we recorded'

Re: location trusted

Indeed. Props to the libcurl team for helping people not to shoot themselves in the foot, but the (previous) behaviour is exactly what I'd expect from the man page:

-L, --location

(HTTP) If the server reports that the requested page has moved to a different location (indicated with a Location: header and a 3XX response code), this option will make curl redo the request on the new place.

Headers are part of an HTTP request, so I'd expect them to be sent to "the new place".

Windows Store nixed Google Chrome 'app' hours after it went live

<quote> Windows 10 S is Microsoft's answer to that by trying to ensure that applications installed do pass basic quality assurance.</quote>

Ha ha ha. That's an interesting explanation for the windows app store...