* Posts by David Eddleman

217 publicly visible posts • joined 20 Jun 2007

Page:

Compromise turns Kaspersky site into malware hub

David Eddleman

Ouch

I didn't know some of these things about Kaspersky. Nevertheless, I've never really liked it as a feasible product. It sounds too fishy to me. But they have a track record far worse than McAfee!

Man enraged by sagging pants pops cap in teen's ass

David Eddleman

Don't...

...blame the guns, blame the idiots. Sadly, just like internet access and making children, there's no suitable license required that tests for maturity (emotional and mental) and intelligence.

David Eddleman

Memphis

Goddamnit, Memphis. Stop giving gun owners a bad name.

Apple censors shut down BitTorrent app client

David Eddleman
Jobs Horns

Speaking of Android

I went to the market and did a casual search for Bittorrent. Found at least 6 clients in the first page (without scrolling down), some paid, some free.

Fail, Apple.

Google's 'instant' search springs keyboard controls

David Eddleman
Stop

Friggin' yes!

The first time this came out and I tried scrolling up and down the page with my arrow keys, I wondered why the page wouldn't scroll. Then I noticed the blue arrow and how it reacted.

This is probably the worst 'improvement' Google's made to search. Not everyone uses one window and one tab for anything. With the prevalence of tabbed browsing, I often open multiple tabs of the same search results just in case the first isn't what I was looking for.

Symantec HackIsWack contest packs in

David Eddleman

What?

"surfers are entitled to expect higher standards of website security from Symantec-branded sites than from your average mom and pop website"

Anyone remember how the "Hacker Safe" logos did absolutely nothing for security? In fact, for the longest time, XSS wasn't considered a security problem, and some 10k sites went exploited by XSS while still wearing the Hacker Safe badge? Give me a break.

Battle of the US super-soldier robot suits hots up with XOS 2.0

David Eddleman

Better for civ applications

Honestly, they need to focus on the civilian applications of these objects first. Once they get them perfected to civilian standards (not too hard), they can focus on the up-armoring, mount points for gear, mobility issues, etc. Military standards are way more exacting than civilian ones, why not try to get a base market for it going then work on improvements and gain more interest that way?

Wait, that would make sense.

Iowa police mugshot exposes world's worst tattoo

David Eddleman

Quad Cities

Redneck central.

Sigh.

Prosecutor resigns over sexting spree to crime victim

David Eddleman

Calumet County

I had no idea where that was, so I had to look it up. Turns out it's on the eastern side of WI, near Manitowoc and Sheboygan. That explains a *lot*.

(p.s. those are very redneck parts of WI.)

Google mounts attack on penis-pill pushers

David Eddleman

No power otherwise

"The account suggests that Google is going after the lowest level offenders, the narcotics equivalent of the corner dealer selling nickle bags."

That's because the higher-ups are operating outside the US or using 'bulletproof' hosting to get away with it, so those takedown notices sent by Google get laughed at. Also, they're probably poisoning the search results to include their wares, exploiting the flaws in the Google search algorithm that's been a game of cat-and-mouse since day 1.

Steve Jobs in iPhone bitchslap to creationists, Tea Party

David Eddleman

It's a shame

That despite having some really bright minds in this country, we have people who still believe -- and try to force others to believe -- in antiquated notions. Back when I lived in San Diego, an area that's heavily Catholic due to the influx of Hispanic immigrants, I could proudly openly exclaim that I am an atheist. No one would really care. But here in the midwest...there are times I think that if I state as such, I might get a lynch mob formed for hinting at it.

I am a little disappointed at El Reg for using the word "monkeys". There's a notion used by Evolution bashers and more that describe evolution as claiming that we're related to monkeys, which is simply not true. Our closest common relative in the modern primate world via evolution are Chimpanzees, not 'monkeys'.

"Christine O'Donnell, has stated that evolution is no more than a "theory""

As someone's no doubt said, so is gravity. So are a lot of things that we take for granted in the world. So is creationism, if you want to get down to it.

I'd be more than happy to allow creationists to teach in classrooms as long as they A) Keep religion out of it (as much as possible, trying to keep a neutral environment in schools) and B) Properly inform students of what it is (a theory, just as much as evolution) and C) Give the facts and evidence of each. Any student who will question and show the slightest shred of critical thinking and logic will pick the obvious choice.

Google data center links shot down by 'bored' riflemen

David Eddleman

Yep.

Just like the internet, I say that you should pass an IQ test before you can purchase a gun. Some people doing some really stupid stuff with them on the range, like sweeping (passing the barrel over someone) and similar incidents which will eventually result in a accident...

Google dismisses engineer who violated privacy policy

David Eddleman

I think I know what that is!

Given your very key choices of words, I suspect I know who your employer is (as I also work for them). Look me up to confirm it. :)

Email worm wants to party like it's 1999 (almost)

David Eddleman
Stop

Excellent point, Bob

I made the same comments about the iPhone, back when it was first coming out (the very original), and within a week, someone had found an exploit or was circulating malware. I said, over and over, the more popular a system is the higher the liklihood of having viruses and other forms of malware written/introduced for it.

If Mac or Linux were taking up 80% of the market suddenly, I guarantee you they'd be found as an insecure OS due to the sheer number of vulnerabilities that people would be finding. Hell, if you want to think Linux is secure completely, go look at a patching list, like Red Hat's. See how many patches are released each month to cover vulnerabilities within the OS and subsystems that are installed by/come with the OS.

Texan cooks up deep-fried Guinness

David Eddleman

Some of us...

Are trying to lose weight. Myself included.

Occasional indulgences are good, but some people (the ones who make the news) are the ones who s/occasional/frequent

VW to eliminate worst road hazard: drivers

David Eddleman
Joke

I wonder if it'll be like The Matrix...

*Cue up Mona Lisa Overdrive*

Drunken employee pops cap in server

David Eddleman
FAIL

Nope.

Gun control = limiting arms of law-abiding citizens.

Criminals, 9 times out of 10, won't go into a shop, do the paperwork, etc. They'll steal, buy stolen/smuggled, smuggle them, etc.

David Eddleman

Title

Not if it was legally obtained through NFA.

"Automatic" likely refers to .45ACP (Automatic Colt Pistol), rather than .45LC (Long Colt). The differences are night & day.

Inmate-frying microwave pain blaster turret installed in US jail

David Eddleman

No.

"You'll be talking about exposed core or "dumdum" rounds"

You're talking about hollow-point rounds, I think. I haven't heard anyone use the term "dumdum" rounds in a long time. They have a divot in the center of the bullet, nose-first, along with cuts down the sides to adjust how they expand.

"Meanwhile, the world's military have moved en masse to usiing deformable nose or "tumbling" bullets"

No, most of the militaries out there use either regular FMJ (full metal jacket) rounds or steel-core rounds. "Deformable" noses would be soft-point bullets, which are mostly used by hunters. Steel core rounds are for extra stability to the round as well as imparting a mild armor-piercing effect (although true AP rounds have hardened steel penetrator cores and a steel jacket).

David Eddleman

Prison

"in use at a prison in Los Angeles"

Gotta be San Quentin, then. That place is full of some really insane criminals. Just ask Danny Trejo.

Facebook broadcasts your location in meat space

David Eddleman

Well...

http://pleaserobme.com/

'nuff said.

Shopping mall mulls Supreme Court bid to back no-speaking ban

David Eddleman

Nope

The owner can delegate others to that authority. Usually it's only managers and supervisors who can do that, 'regular' staff can't do that.

Rise in Latvian botnets prompts Spamhaus row

David Eddleman
Thumb Down

Bound?

Bound by *what*? There's absolutely no legal or contractual obligations to check a mailbox. It's a nice thought but a lot of abuse mailboxes are automated and the only thing they do is send an alert when so many hits happen to a particular address.

David Eddleman
Happy

Precisely!

My own servers & networks have large chunks of addresses blacklisted due to a high chance of crap coming from them. For example, China and Korea. I used to maintain a forum for my first employer and I set up large banlists there because of bots. I only had 1 legit user come out and ask why he couldn't register, and I added an exception.

Junk mail kingpin held on child abuse charges

David Eddleman

Yep

It's how they got Al Capone. Everyone knew he was guilty as hell, but the only thing they could pin on him was tax evasion. For it, he went to prison and was killed in there.

Turkish groom accidentally sprays wedding guests with bullets

David Eddleman

Title

Because it's a matter of skill? Trying to say that ANYTHING is designed exclusively to kill someone is a logical fallacy. Let's see you try to fire on automatic and even keep your sights on a target, let alone score some decent hits.

David Eddleman

And...

Even if it doesn't, it's designed to kill tanks, not people. Shaped-charge + copper disc means a precise hit. Despite what you see in movies and video games, the standard AT warhead on an RPG-7 has a very limited blast range. Now, the OG-7V warhead, which is a long tube designed to fragment and spray shrapnel on the other hand...

David Eddleman

Precisely!

"This is why you train in the use of a weapon before you go around shooting it."

When I've taught people how to shoot, I show them all the features on the firearm and shoot a few rounds off first to show them what it's like, plus teach posture, form, etc. If you start firing any round on automatic, even the low-recoil .22LR, you might get spooked and drop the weapon which could cause a slam fire.

David Eddleman
FAIL

Wrong!

"you should at least set the thing in "semi-auto" (3-round bursts) or single shot"

Semiautomatic is NOT burst-fire. Burst fire is fully automatic, but with a reset after a certain number of shots have been fired. Semiautomatic is one cartridge expended per trigger pull. Single shot would likely encompass any weapon that requires manual reloading between shots, like a pump/lever/bolt action firearm or a single-shot firearm (like a breech-loaded shotgun).

David Eddleman
WTF?

What?

What's so wrong with the AK-47? You realize that people over the pond have them too, right?

Saudi Arabia beats UAE to BlackBerry ban

David Eddleman

Probably a miscommunication

I doubt that RIM said "over a hundred governments". They probably said "over a hundred government *agencies*".

David Eddleman
Stop

Killer feature? Not really.

"Push email, long the killer feature for BlackBerrys, is standard smartphone fare these days,"

Fuck no. Push e-mail is a moronic idea. Especially when you have some person who has their e-mail hosted on a third-party source and all of a sudden it stops working and the fault -- surprise, surprise! -- is on RIM. And now you have to go and push RIM to convince them, yes, it is their fault, and to fix the problem. Which is not an easy task.

Adobe confirms remote code-execution flaw in Reader (again)

David Eddleman
Troll

I guess...

...that iPhones are vulnerable to Flash exploits too.

Oh wait...

Hack uses Google Street View data to stalk its victims

David Eddleman
FAIL

Not compelling

The two requirements for this are major 'if's. For starters, it would require someone to be on a network that is completely open (either with default credentials, which is the more likely scenario, or on a router that doesn't require authentication to get to the admin page (of which I've seen none)). Given how I'm seeing fewer and fewer open wifi networks out there there's very little chance for this to take root. It also requires Google Maps to have cached the area. That means only someone with a wifi signal strong enough to be broadcasted to a Googlecar or more likely, living in proximity to a street where a Googlecar would be bothered going through, is at risk.

Sorry, buddy. Not very likely.

Fake Firefox update used to sling scareware

David Eddleman
Stop

Seems to be some confusion

El Reg should fix the article since it's not clear.

There is a completely legitimate page that appears very similar to the one the VXers use that also informs you to upgrade Flash. However, it DOES lead to Adobe's site and goes through the regular channels to update Flash. What this fake version does is appears to give you an upgrade, but when you attempt to use the 'upgrade flash' link, it has you download a payload.

Read the F-Secure article, folks.

Also: "In related news, McAfee warned earlier this week that VXers were offering a Trojan disguised as trial versions of its VirusScan anti-virus software."

So it's going to perform like regular McAfee - slow, bloated and does no good at all?

TalkTalk turns StalkStalk to build malware blocker

David Eddleman
Stop

Wrong

Reading any information not destined to you is intercepting communications. Imagine if TalkTalk stumbled upon some sensitive data that's not to be released to the public (confidental private/company docs, gov/mil/edu docs that are nocirc, etc.). They'd be accountable for it as the logs would plainly see and could easily be sued or have criminal proceedings on them for it. It doesn't matter if that agency or entity's security is poor, it would easily stand up that TalkTalk used an exploit (since I doubt their system does any error checking to see whether or not the URL is "followable", using blind logic).

David Eddleman
Unhappy

Charges?

As someone who's worked in the web hosting industry before, I have to wonder how much scraping TalkTalk is doing on sites it "checks". Does it just grab the page and scan, or does it download the entire shebang and run it through some heuristics engine? If it's the latter, I have to wonder just how much they're costing webmasters in bandwidth fees.

Bandwidth is NOT cheap, folks!

vBulletin vuln gifts admin credentials to unwashed masses

David Eddleman
FAIL

Wow

I can't say anything else. That's probably one of the most asinine vulnerabilities I've ever seen.

Judas Phone: more Photoshop tomfoolery

David Eddleman
Happy

Send it over to b3ta

They'll gladly take it.

Meanwhile, that first one is going on my desktop at work.

Raptor over Blighty: Watch the stealth fighter in infrared

David Eddleman

It does

The F-22 has the old-gen issues with the stealth system, but the F-35s newer stealth system uses a new system that's more effective, doesn't degrade under poor conditions and doesn't require nearly as much work to maintain on the ground.

David Eddleman
Grenade

Yet more

"Good guys: A $Bn fighter aircraft capable of evading any other $Bn fighter aircraft

Bad guys: A road side bomb that kills the pilot"

Exactly. You simply CANNOT compare the F-22 and the Typhoon at all. The F-22 is a 5th gen air superiority fighter, designed exclusively to combat enemy planes. It's best effort is a set of JDAM-equipped Mk83 (1000lb) bombs internally, which reduces how much anti-air power it can carry.

If you want to compare a US-made fighter to the Typhoon, compare the F-35. It IS a multi-role fighter, capable of carrying more firepower (internally AND externally) and capable of taking on many different targets. Hell, it can carry Mavericks and JSOWs, something that the F-22 can't. It has superior stealth and flight tech.

If you want a better aircraft to compare to the Typhoon in terms of tech and cost, look at the F/A-18 Hornet (or better yet, Superhornet).

David Eddleman
Stop

Raptor

"That's in the same price range as a Raptor (just 185 Raptors are to be made, which has pushed their unit price up)."

Well, the Raptor may not be made anymore. The latest 2010 funding has no space for them, and there is a law banning export of this craft (not so with the F-35 IIRC). They're great air superiority fighters, and are meant for that. Their primary armament is AMRAAM missiles, which are Air-to-Air (not Air-to-Ground).

"The F-22 does not have hardpoints"

WRONG. The F-22 and F-35 both have external hardpoints (F-22 has 4, 2 each wing, and the F-35 has 6, 3 each wing). However you are correct about diminishing stealthiness. As it breaks angles (and missiles have all kinds of right angles) it makes it have a much larger radar signature. Without external stores, the F-22 is described as having a "radar signature of a steel marble".

Google Chrome bug bounty ups Mozilla's ante

David Eddleman
FAIL

Copycats?

Monkey see, monkey do.

FBI hunt gun-waving, skateboarding bank robber

David Eddleman

Open Carry

He's lucky no open carriers were in the bank at the time. Otherwise they'd be bagging and tagging him.

US data firm blows s**t out of server

David Eddleman

Re: Dalen

It's not that hard, depending upon the state you live in. If you live in a state that doesn't prohibit the use of suppressors, you just fill out a form, send it to the ATF, pay a fee, and there you go, you get a tax stamp to transfer or construct a suppressor to you. That's it. It's expensive, sure, but not that hard.

David Eddleman
Grenade

MP5?

I don't see a MP5 in there. I see someone with what looks like a GSG-5 (with a real suppressor over the fake can that comes with it) shooting at the equipment.

btw: most guns in the US are not suppressed or automatic. It takes a lot of paperwork and money to get automatic weapons. Most civilians who legally own weapons use simple semiautomatic or bolt-action/pump-action/lever-action weapons. It costs a lot of money (we're talking several thousands) to get a legal automatic sear or an automatic weapon and anywhere from a $200 to $400 fee to get approved by the ATF, not to mention requiring a Chief Law Enforcement Officer to sign off on it (or barring that, a trust, which is more money).

Those hicks/yokels/rednecks/etc. that you see shooting automatics and lobbing grenades/cannons/etc. constitute less than 5% of the lawful gun-owning populace.

Kanye West death prank used to sling scareware

David Eddleman
Dead Vulture

Meme

El Reg uses the most idiotic meme ever? I'm done with you guys.

Firms still struggling with data security standard

David Eddleman
FAIL

PCI is crap.

"PCI compliance doesn't cost extra money/budget. Neither does it take longer to implement or more effort to maintain. To be PCI compliant all you have to do is follow best practices and stop being lazy with procedures and systems."

You've absolutely never ever done it before, have you? Next time you decide to talk shit, take a deep breath and pull your head out of your ass.

You have to pay a firm to become PCI compliant. And if you handle your website through a hosting company, they may have to make you compliant if you don't have an in-house team that can handle it. It becomes especially tricky if your site is being managed through a control panel, since there are tons of businesses that have them since there are TONS of tech-illiterate folks out there. And the hosting company will charge fees (likely) and take time.

Ask me how I know this. Go ahead, ask me. I used to work at a webhost, I've seen this far too often.

They go beyond "best practices". They check all kinds of asinine stuff. For example, if you run the Plesk CP, which listens on port 8443 (and uses a completely different HTTP daemon for the CP as compared to the one for serving web content, lighttpd vs. Apache), and the port is open, they'll detect an open port that has poor encryption even though it has 0 relevance to your site, and flunk you. And different firms will have different regulations. One of the customers at my last job had a firm that would give them things to fix every day, refusing to certify them until he finally told them enough was enough, certify or I go to the prosecutors. Some barely do anything, and will certify you on a whim.

PCI/DSS is utter garbage and does nothing to fix the problem.

Fraudsters add IM to phishing attacks

David Eddleman

Been like this for a while

I get an occasional call from "Verizon" wireless, claiming that I am on track to running overages. First thing I get with the foreigner on the line is a request for my phone number, my social and something else (can't remember what else it is they want), but basically with it they get free reign to use your account to buy whatever they want.

OpenSSH exploit rumours swarm

David Eddleman
Boffin

Not so hard

"Red Hat Enterprise Linux ships with OpenSSH as a component and may therefore need upgrading"

So hard.

yum update openssh*

y

Then for good measure: service sshd restart

Ooh, so hard a monkey could even do it.

Page: