Posts by Androgynous Cupboard

Opsec oopsie: Dutch navy frigate location outed by mailing it a Bluetooth tracker

I'm not sure they're broadcasting AIS while on active duty though...

You can finally control serial devices from Firefox

Re: I used this the other day

We're still going on this? OK.

• Running JS in the browser: the security risk is that someone breaks out of the browser sandbox and is able to run arbitrary commands.
• Running a program or script: they're already able to run arbitrary commands.

DrXym gets it, but I'm kind of surprised we're having so much trouble getting this across. Do I trust Google or Mozilla? No. Do I trust them more than random company X not to attack my computer, accidentaly or intentionally? Yes.

The browser in this context is an additional layer of security - no one claims it is perfect, but removing it does not make things more secure.

Re: This is NOT needed

> The worst is http itself -- it takes TCP, a protocol that's ironically designed to emulate a serial terminal over a network and adds the framing mechanism from FTP to convert it back to a datagram oriented protocol. It being text oriented it can't efficiently transmit binary. It really is a mess.

Er, what? Of course it’s not text oriented, where on earth did you get that from? For streaming a large binary file it is on par with any other TCP stream. For short files the headers are a bit wordy, but HTTP/2 and SPDY improve on that.

As for “FTP framing” and “datagram oriented” (in TCP?!?), if you mean chunked encoding that is possible but certainly not the norm.

Re: I used this the other day

> If you have to download a dodgy executable it is trivial to run it under a dummy user in a chroot jail or a container or something.

A statement that also applies to Chrome, of course.

Re: I used this the other day

Just want to note I have had that sort of install process render a machine unbootable after installing a kernel module in the wrong place, trashing the kernel boot arguments and rebooting, unaware I used nfsroot.

But of course, it’s browsers that are insecure and that we should all be worried about.

Re: NO!

You don't need 13 nested divs to do anything, but there are plenty of people that do it that way. There are many shit web-designers, just like there are plenty of shit programmers, piling on complexity in lieu of understanding. This shouldn't be a surprise.

Guard rules, I genuinely have no idea what you're talking about. Are you referring to the old MS IE hacks that people still include despite the fact the MS IE literally no longer exists? See previous observation. Same for 1GB web pages. Modern CSS can, and does, style down to the pixel - see those 60,000 tests, some of which I've written so I do know what I'm talking about. The results are quite literally pixel perfect.

The irony of a bunch of people that clearly haven't spent the time to understand modern HTML and CSS, using the output of other people that don't understand modern HTML and CSS to complain about modern HTML and CSS is not lost on me, but may be on you. Learn to properly use the tools you've been given, that is my advice. Like the tools, it is free of charge.

PS. "put this thing beside that thing", assuming beside means horizontally - well you could try CSS anchor positioning for any arbitrary thing in any arbitrary hierarchy, or you could use...I dunno, flex, or grid, or inline-block layout, which for the trivial case you describe will give you 100% predictable results on any Browser written in the last ten years. HTH.

PPS. "on a connection that 30 years ago would have been blistering fast?" - I could not illustrate my "Brexit" point in my previous comment any better, thank you. My 56kb modem from 30 years ago would like a word.

Re: NO!

That would be HTML and CSS, the most widely used document model in the world by many orders of magnitude? The one used for billions of page views a day, that can give identical layout in software by multiple manufacturers on multiple platforms, that works on our desktop and your phone in every language in the world, that has best-in-class support for accessibility and that that is an editable, open, documented text format not a proprietary binary one? The one with an open test-suite running to over 60,000 tests? Yeah, it sucks alright.

As with Brexit, the good old days you want to go back to are largely imagined. Here is some HTML I wrote for a contract in February 1996:

<HTML><HEAD><TITLE>Netscape NNN prototype</TITLE></HEAD><BODY BACKGROUND="gif/paper.jpg" BGCOLOR=#ffffff LINK=#ff0000 VLINK=#ff00ff TEXT=#000000><center><FONT SIZE=5>Welcome to the Netscape Web NNN prototype</FONT></center><TABLE CELLSPACING=25><TR VALIGN=top><TD WIDTH="50%">To run this prototype you will need:< UL>< LI>Netscape Version 2.0 beta 5 or later. < em>Please note that releases prior to beta 5 will not work</ em></ LI>< LI>A monitor displaying at least 800x600 in 16 colours</ LI></ UL> ... etc

That's 30 years old and yet will still render roughly correctly in modern software - as markup formats go, I'd guess only PDF can make the same claim - and it's already using EM not B, making Steelpillow's blog ranting about the modern "tale of em and strong" look a little silly. And it's nasty: arbitrary colors and sizes hard-coded in, no ability to adapt on smaller screens, no "dark mode". The semantics of HTML are largely unchanged - what's really changed is the ability to focus on just semantics in the HTML, and push all styling into the CSS. You think it's a step backwards? Convince me that "font size 5" was better, and I'll believe you. A bit later in the above document I felt it necessary to tell the user to "turn off underlining to improve appearance". Halcyon days they were not.

Re: I know this one!

Ah, the inevitable knee jerk “browsers are inherently unsafe” response. In fact for this case the opposite is true if you think about it..

First, the user has to select the device and approve the connection - you can’t sneakily connect to devices. Second, this is happening from a sandboxed and very well tested browser, not some random binary supplied by the hardware manufacturers you’re just supposed to trust.

Anyway, security comes from the process not the tools.

I know this one!

I used this API very successfully to create a UI to control an industrial lighting controller I designed a few years back - super useful being able to represent the internal state with graphs and controls in HTML, and it made updates a breeze as I could flash it from the web-page too.

The UI only worked in Chrome as a Chrome app, and Google (inevitably) pulled the rug out from that a few years later, necessitating a complex workaround. Great to see it in Firefox - it’s pretty useful.

Cisco Wi-Fi boxes are filling their disks with 5MB of undeletable data every day

Re: How do you screw up that badly?

We have shipped code to clients with debug logs writing to files in /tmp - fortunately not in a production build, but if it happens to the best of us (he says modestly) it can definitely happen to Cisco

Physicist reckons two-button calculator can do all elementary math

I was thinking the analog equivalent of the NOR gate. Good enough to get Apollo 11 to the moon.

France’s digital directorate dumping Windows desktops, adopting Linux instead

Re: A Bad Start by DINUM

In a world where people are posting about the evils of Musk and Twitter on Twitter, this only merits a 5/10 for irony.

Apple update looks like Czech mate for locked-out iPhone user

Re: Moral.

"It's not uncommon one goes hiking for weeks" - I would think that's a pretty good definition of uncommon for most people.

Re: Moral.

Have a downvote - memory card? What is this, the nineties?

Mine is backed up to my laptop, which is backed up to my RAID-Z2 server, which is backed up to tarsnap. No memory card.

DARPA looking for battery that could power a laptop for months

Re: Radioactivity on your lap ?

Mrs Assange?

Brits are falling out of love with posting every thought online

Re: Ofcom have an agenda to destroy all but MSM

So many red flags in just two paragraphs, impressive.

Least Surprising?

> Perhaps the least surprising finding is that more than half of social media users say they have seen false or misleading news during the past year.

Er, what's really worrying me is that there's a significant minority that think they haven't.

Stack Overflow abandons redesign after loyalists criticize it

Re: No JavaScript

Maybe you need to suck it up.

I know of at least two sites that have a lot of information available without hiding it behind a login wall, that are being absolutely crippled by Bot access.

IP addresses are distributed and hard to block, but collectively it’s millions of hits. All presumably AI scrapers. So every business that has a site like this is having to act.

Renewables reached nearly 50% of global electricity capacity last year

Take a look at the gulf or Russian gas supplies to Europe and tell me if you think the word "reliable" is appropriate for any single source of energy.

More generally I do get the argument against dependence on solar in northern Europe, but I'm of the opinion that the most reliable "reliable" lies in building oversupply and grid interconnections, not shifting our single-point-of-failure back to the Strait of Hormuz. That's my point of view from the UK and the logic for your region may be different - something else we shouldn't lose sight of.

The company's biggest security hole lived in the breakroom

Re: I dont doubt the story...

I remember reading a - mildly self disparaging - blog about a guy who had gone all in on the smart home, one of the memorable entries was "ate dinner in the dark while the lightbulbs downloaded a firmware update".

'Uncle Larry’s biggest fan' cut by email in early morning Oracle layoff spree

Re: The US employment hellscape

Whiskey?

We know what day it is but these Raspberry Pi price hikes are no joke

Re: The inversion of capitalism

The ghost of Karl Marx is rubbing his spectral hands with glee and mouthing the words “called it”.

Folk are getting dangerously attached to AI that always tells them they're right

> Of very real concern are the numbers of people severely affected by AI - including suicides, huge debts, divorces, hospitalisations etc.

https://www.theguardian.com/lifeandstyle/2026/mar/26/ai-chatbot-users-lives-wrecked-by-delusion

Huge debts, divorce and hospitalization - no suicide, but you got three out of four. The term "AI Psychosis" is one we'll be hearing a lot more of. What strikes me is how many of those affected understand the technology to some degree - they should know better, in theory.

But it looks very much like gambling addiction - there's a dopamine hit on the first success, a "what if", the explaning away of failures, and before you know it you're in the news.

It reads like it was trained on The Inbetweeners. Less HAL9000, more Holly.

Not all of it. And as with "all politicians are the same", this kind of simplification discards the wheat with the chaff.

Bad as it is, even the Daily Mail has more editorial accountability than some ranter on Youtube.

Iran war drives urgent need to counter underwater attack drones

Re: How about instead...

Do you see any silent voices around here? Literally most of the comments on this thread and any other thread re. Iran have been "what the fuck are the US playing at"?

The voices condemning the USA are fucking everywhere. Everywhere. Every headline, every commentator in the news, every social media post. Everywhere. Trump's war is reprehensible but guess what? So is Putin's. It is possible for both of these things to be true, and the sooner you wrap your head around it the better for everyone - although I expect the irony of you "holding the west the the same standards" while manifestly failing to do just that yourself is unfortunately going to be lost on you.

Brit lawmaker targeted by AI deepfake fails to get answers from US Big Tech

Re: "it was down-ranked"

Try running a video claiming "Zuckerberg is an X" for some suiitably damning X, and see how long it stays up there.

Open source isn't a tip jar – it's time to charge for access

Re: Development != Distribution

No, I'm really not. I get that stuff has to come from *somewhere*, but it doesn't have to do that as a live part of the build process. If you design a system that works that way, it seems odd to complain you see too much traffic - it's simply being used the way it was designed.

Put another way, pulling in an updated version of a dependency should be a conscious decision. To do otherwise is to build on sand - how do you manage regression testing if you're not keeping track of changes in dependencies?

Development != Distribution

This article conflates the two. OS development, that's an issue I care about, and charging companies to prioritise fix X or similar is probably the way to go.

The unnecessarily complex infrastructure that has grown up around open source, where Sonatype, NPM etc replace the need to manually keep up-to-date with your dependencies (a problem) with the ability to depend on tens of thousands of packages of unknown provenance (a bigger problem). I have very little sympathy for them, nor the build systems that enable them (Maven, spits on floor).

I appreciate not everyone wants to write their own ICU package, but pulling in (eg) Apache Commons just because you want to have a slightly nicer IO interface is the wrong approach in my book. And as evidence of this I cite Log4J, XZ, and all the recent crap that's been going on with NPM. If you can't manage your dependencies manually, you have too many.

</rant>

We have a licensing system for that - it's called commercial software. You've just taken the F out of FOSS.

Country that put backdoors into Cisco routers to spy on world bans foreign routers

Open-source? Ain't that some kind of... socialism? (spits baccy juice, plays banjo sinisterly, etc)

Re: Ha ha ha ha ha

100% OP SEC !!!111!!

Time to end the 'uncontrolled experiment' of social media on kids, scientists say

Re: Why stop at kids?

And where are these subversive communists, exactly? I've looked under the bed already.

Water company wasted $200k on bad answers from an AI model – so built its own slop filtering system

A water company? $200K?

Pfft, amateur hour. Somebody call Macquarie.

It's not a binary choice. Independent boffin builds a ternary CPU on an FPGA

Re: Confused Old Bunny Here!

the Turing Machine was a thought experiment involving "tokens" on an infinitely long rolls of paper tape, as I recall.

When you come to implement that in hardware, for at least seventy years that's involved binary signals - a high signal on a pin for one, a low signal for zero (other option is also available).

So there's your challenge: go out and find me a chip - any chip (RAM, CPU, Bus arbiter, clock) that operates on a ternary signal. Hell, I'll even accept a transistor - yes, I realise BJTs can operate as amplifiers within a limited voltage range, but FETs not so much and semi-conduction leads to heat.

Switzerland built a secure alternative to BGP. The rest of the world hasn't noticed yet

Re: IPv6

Nah, not evil government actors. It's well known IPv6 was designed by the Lizard People working with the Illuminati, and if you reverse the bits in the packet header your packets are routed straight to Beelzebub

Thanks, I didn't know about the Swiss card scheme. But it might not be unique for long: https://www.theguardian.com/business/2026/feb/16/uk-bank-bosses-plan-visa-mastercard-alternative

> build the governance first, get the key parties committed, define the trust roots, enforce the rules – is precisely the kind of process that works in Switzerland and struggles almost everywhere else.

Quite possibly the truest thing I will read all day, in both its assessment of Switzerland and its assessment of not-Switzerland.

Thanks for this article, genuinely interesting even though this level of routing is not my field.

Oracle unveils Project Detroit for faster Java interop with JavaScript and Python

C and C++ have entered the chat

Nanny state discovers Linux, demands it check kids' IDs before booting

Insert unfocused rage here

I'm struggling to get animated about this. My kids both under sixteen have iphones, they need apple accounts to do this which I set up with their ages (roughly correct), and that's fine. They can't do certain things and if there needs to be an exception, as the responsible adult for those accounts I'm asked and can give approval. It largely works.

If they use a computer rather than a phone, it's also going to be one I've set up for them. Frankly I don't want them on pornhub or 4chan, and while obviously I keep an eye on them I would have no major issue if the OS also had a knowledge of their (approx) age and was able to use this to limit them too. None of this stops me setting up a Raspberry Pi for them to play with. But the internet is an open sewer and if you're under sixteen and using it unmonitored, I would ask why.

And if you're over sixteen, this doesn't matter one jot. If my next computer asks me for an age to create an account, I type in a random date from the 1970s and move on without a second thought.

Will it work 100% of the time? No. Is it going to prevent adults from doing what they want? No. Will it make it harder for dubious businesses to target my kids? Yes.

I realise this is off-message so lets just assume I made lots of allusions to Orwell and government overreach, and said "think of the children" a few times.

So much for power to the people – AI datacenters could jump UK grid queue

Re: "The British people must resist!"

I predict it will generate more heat than light.

Most chatbots will help plan school shootings and other violence, study shows

No Grok?

Fair enough. We already know how it would have answered.

Ig Nobel Prize flees US for Switzerland after 35 years over safety concerns

Re: He is in a uniquely powerful position, akin, yes, to a Roman emperor.

> The problem is that killing Trump - as was attempted - would only cement his legacy through martyrdom. Nor is political violence good to democracy.

Exactly. It's critical his failure must be recognised as his alone.

LibreOffice learns to speak Markdown in version 26.2

Re: no asciidoc?

Yep. Core Markdown is pretty limited, so to do more (eg tables) you wind up in one of several slightly incompatible dialects.

ASCIIDoc is definitely where it's at, and I can say that with confidence having written a few hundred pages of documentation. It's also the input to https://www.metanorma.org, which means ASCIIDoc is now being used to create ISO specifications too (fun fact: the ISO process requires specifications are submitted in MS word for review - so Metanorma can convert from ASCIIDoc to MS Word).

NASA’s asteroid defence mission slowed targets by 1.7 inches per hour

Phew

At least the use of inches didn’t come from NASA or the Reg - it’s a quote from an analyst. Failing to shoehorn 42 (as in 42mm) into a website for grizzled techies seems a missed opportunity.

Firefox taps Anthropic AI bug hunter, but rancid RAM still flipping bits

Not sure that’s fair actually. Think back 20 years and how often you’d see crashes: all the time, in everything, doubly so if the product included “Microsoft” in the name. Now I can typically run my browser of choice for weeks without a crash, with hundreds of tabs in constant use throughout the day.

As for memory hogs, true, but I’ve seen single page websites with 1MB of CSS, and I bet you could name a website right now which performs terribly, probably due to being stuffed with badly written JS displaying adverts. There are people to blame for this, but it’s not browser authors.

Office EU waves sovereignty flag with a familiar stack under the bonnet

Re: Thank you Trump

> > Your unhinged, rambling and totally unprofessional behavior

> I didn't read the title of the post at first, and I thought you meant *me.*

Well, if nothing else you would have got a "flame of the week" out of it...

UK watchdog eyes Meta's smart glasses after workers say they 'see everything'

Re: Easy fix?

I think I saw a similar suggestion for the original google glasses on this very website, which has stuck with me for years: "ok glass, safesearch off, horse porn".

Some thiings which are seen can not be unseen.

Apple's budget-friendly MacBook Neo is bursting with color and compromise

Re: Swap

Maybe, but I can't find the PS/2 port.