Posts by Adam 1

Set your alarms for 2.40am UTC – so you can watch Unix time hit 1,500,000,000

Also, seconds! Really? I thought this was a tech site. Shirley we should be measuring time in beard metres.

JavaScript spec gets strung out on padding

solving the song problem

The issue here isn't with left pad, it is with dependency frameworks like npm that make it all too easy to consume disparate collections of third party libraries in a way that makes this sort of thing inevitable.

Should the language have it built in? Probably, but that is going to be years away before you can safely assume any browser hitting your site supports it. The bigger question is what function disappears next for {reasons=null,noticeDays=0}.

G20 calls for 'lawful and non-arbitrary access to available information' to fight terror

Re: I'm going to keep doing this...

I especially liked this bit:

7ttqmBCzMoNKFcSliD7f6cLUNw6/nqeWqkGJ6HxJbd

Nice write-up Vanessa. Salient points.

Re: Hmmm

Ironically, it's the same Turnbull* that was explaining in breakfast TV the merits of wickr a few years back.

*allegedly, it isn't entirely clear given his position on so many issues has changed in exchange for the top gig.

We will be calling on the biro and paper industries to work together with law enforcement agencies to provide access to such information in order to help keep our communities safe.

@grahamcobb

Signal is open source too and guess who uses that.

Re: Except they won't, because they can't

> And how will people know that?

Well if they switch from the signal protocol to something new without the public discussions about whatever weakness they see in what they currently use, it's time to be suspicious.

Ghost of NTLM still haunts Microsoft: Aged protocol hole patched

Is the rabbit European or African?

Better mobe coverage needed for connected cars, says firm flogging networking gear

I can see the benefit of a connected car for safety. If my car's autonomous emergency braking kicks in to avoid something, it is a good thing if my car immediately broadcast to surrounding vehicles so they can take evasive action if needed (particularly those following me). I am thinking things like exact position, speed, shortest time to stop, longest time to stop whilst avoiding the obstacle (so cars with different braking capabilities can avoid collisions if possible), negotiating cars in adjacent lanes or the other side of the road to pull over/speed up/slow down to avoid or minimise a collision.

What I don't see here is any need for a mobile network. This only needs WiFi range. A car that is 1km away doesn't need to know my intentions in an emergency.

> They can't even get ubiquitous coverage throughout the UK.

Can't is not the same as economically unfeasible. Each base station has a capex cost to purchase, build and wire up, a lease cost for the site and an operating cost (power/administration/maintenance/licensing bandwidth etc). The coverage is dictated by environmental factors (hills/buildings/etc) and capacity constraints (a single cell could easily convert a couple of football pitches, but could not carry the load of grandstands full of customers). Telcos are therefore interested in an optimistic outcome, not ubiquitous coverage. The fewer base stations they need (in general), the less needs to go on the expense side of the balance sheet. The more customers they can sell to at a coverage level where they are happy*, the better the revenue side. They aren't going to put in a new base station to allow them to sell to a handful of potential customers.

*using a very loose definition of happy that equates to "won't go to another provider"

Bloke takes over every .io domain by snapping up crucial name servers

Curious. Could he have generated a wildcard certificate for *.io?

Imagine the fun he could have had if this was live....

His Muskiness wheels out the Tesla Model 3

Re: It will retail for just $35,000

H2 is a non starter for cars in my view (and I'm hardly alone). It isn't dense enough without compression/liquefication for a practical driving range (huge energy overhead right there). It requires some pretty expensive parts inside the catalyst (that bit does have some progress but it's not happening tomorrow).

Most importantly, it requires hydrogen in very large quantities. Hydrogen is light* so doesn't on its own collect in untapped wells. That means you need to split it off some other molecule. Water works, sure. Add some electricity, get your 2 H2O => 2 H2 + O2. But you have just lost at least 35% of the energy you put in. Far more cost effective to start with natural gas: CH4 + O2 => 2 H2 + CO2. Then I guess you can vent that CO2 into the atmosphere thereby defeating the purpose of switching away from fossil fuels in the first place.

So apart from being dirtier, less efficient, harder to handle, more expensive to construct the"engine", I say it had great potential. It's only saving grace is that you can refill it quickly. Don't get me wrong, that's important, but to me that's a much easier problem to imagine a solution to than all the others I have listed.

*Citation needed

'My dream job at Oracle left me homeless!' – A techie's relocation horror tale

> The story also has something of a happy ending.

Well, obviously. You already said that he job didn't work out for him. Imagine if after those international moving hickups if he still had to work for them.

in his defense

It doesn't mention that it was a good dream

Just in time for summer boozing: Boffins smash world record for the most perfect ice cubes

any true chemist would know ...

...that the secret to the perfect ice cube is to refine it in a water container with some special mix that contains barley, hops and yeast.

Former GCHQ boss backs end-to-end encryption

> The Americans tried that in the 1990s under the Clinton Administration and it didn't work.

It didn't work? If only that were the end of it. You know a pretty substantial portion of the crypto attacks over the past couple of years are a direct consequence of those export ciphers. Now 20 years later, attackers were using the fallback mechanisms to get our systems to use the very weak ciphers that every man and their dog can crack with next to no expense.

Talk about a hit and run: AA finally comes clean on security breakdown

It's also worth considering whether you used to reuse the same password on other services.

A good opportunity to spend the hour or two resetting the password on those online accounts you only use every tenth of never with strong random passwords you store in a password manager (any of the top few password managers are fine). Use a strong password to unlock the password manager. Backup that password database frequently and depending on your threat model, decide whether to print out your password putting it out. One last thing, if you backup to the cloud, then have your cloud credentials somewhere else too because you'll need them to recover the password database.

FREE wildcard HTTPS certs from Let's Encrypt for every Reg reader*

Re: An admirable effort.

@ShelLuser,

Now I have a conundrum. Your rant deserves to be upvoted in one part and downvoted in the other.

CAs abusing their positions, reminding of the need to continue using the grey matter in addition to HTTPS, yes, yes, yes again.

But then you go off and claim it is no safer than http. Sorry, but that is amanfrommars crazy talk.

Let's address what you get from HTTPS. Firstly, you get a degree of privacy from MitM observers.* You get a guarantee that the page and resources referred were not changed in transit. You also get a guarantee that data you submit (including identifiable information) is not visible to a MitM. You are right to point out its limits. For example, the certificate on this site stops anyone interfering with the site between here and cloudflare. It doesn't say anything about MitM between cloudflare and el reg. It doesn't mean that El reg has appropriate controls about its staff access to those servers and databases. It doesn't mean they don't sell my data to advertisers. But I don't think HTTPS needs to cure cancer for it to have earned the praise of "an improvement".

It is like arguing that autonomous braking systems are a load of bull because people who have them adopt riskier behaviour.

* I should note here that the DNS lookups and data payload from those domains still allow partial MitM tracking, at least at the ISP or VPN provider level.

While USA is distracted by its President's antics, China is busy breaking another fusion record

Re: Who still uses farenheight for things like this ?

> Technically, it's 49999726.8 C

Wow. That's nearing 5 MegaHiltons.

Oz government wants its own definition of what 'backdoor' means

Re: Semantics?

I read your post with a Peter Harvey voice.

secret knowledge

Yes, I am happy to share with the relevant authorities technic knowledge about how to gain access to messages that were encrypted on our platform.

We're not shouting this flaw from the rooftops for obvious reasons, but we have a particular weakness whereby if you apply integer factorisation using any polynomial time algorithm then you can read the message content without creating any specific backdoor. Please keep this vulnerability mum.

Aptare: Eight exabyte-juggler pimps its 'data centre MRI' product

Re: 8 or 9 exabytes?

Well it says 9 on the tin, but it's only about 8.2 once you format it.

European MPs push for right to repair rules

There comes a point where the fact that this year's model is half a bee's dick skinnier really wasn't worth that sacrifice. 7 years back pretty much all phones had replaceable batteries. Some even came with a spare in the box. The difference between then and now is how hardware is plateauing. There was always the case to buy the next model after a few years. Higher resolution screen, better camera, more storage, more memory. The landfill android category is basically gone, even the cheap ones will comfortably run the os and a handful of apps. In turn, we respond by holding onto our phones for longer, so planned obsolescence isn't about how much ram is installed anymore or how crap the camera is but rather knowing that in 3 years the battery will have lost 75% of its capacity and can't be replaced.

> A smartphone should be as fixable as a refrigerator

Oh great, now Samsung have started glueing the lamp inside the fridge into place.

/Be careful what you wish for

MH370 researchers refine their prediction of the place nobody looked

> its analysis of the drift patterns revealed by wreckage suggested the original search was in the wrong area.

As did the fact that they didn't stumble upon it when searching there, Shirley?

Minister says Oz Medicare breach was crims, not hackers

My name is

My name Alan Tudge. My date of birth is 24 February 1971. Here is $30.

GnuPG crypto library cracked, look for patches

Re: Lessons will be learned

@AC, sorry, not following your point. I am not railing against the failure of some open source project to implement some feature that I want. I do not personally use GnuPG, but no doubt some information about be is at some point encrypted using this library, so I am an indirect stakeholder. Or do you personally also check up on openssl, ms crypto, and the dozens of others that other people handing your data may be using?

This isn't even a complaint that they got something wrong. Good crypto is freaking hard at the best of times. But what has happened here according to TFA is that they *knew* of the partial compromise but believed the keyspace was big enough that they could get away with it. As with the OP above, that sort of attitude of near enough is good enough, bred through an entire codebase of a security product is concerning. All I said was that I hope that when they concluded "not practically crackable because of massive key sizes at play"that they nonetheless had an expectation that they needed to get back and fix it properly anyway.

Re: Lessons will be learned

> data leak was tolerated because it was believed only part of a key was recoverable

Such assumptions do grate with me. Every bit you allow to leak literally halves the keyspace. Although with large key sizes it may still remain practically secure (half of unimaginably massive is still unimaginably massive) but I would hope that they would be uncomfortable about it and there is some Todo on it.

Medicare data leaks, but who was breached?

Re: AUS Medicare and US Medicare

Not following your line of argument. The US equivalently named card is easy to guess if you have the SSN, which is a apparently cheap. Therefore people must be crazy for paying 30 bucks for it? They aren't buying a US card, so the fact that you can get a US version cheaply is irrelevant. From your subject line you seem to know this.

When you apply for a loan or a passport or a birth certificate, phone contract, lease, etc, they request that you provide a copy of some quantity of documents from list 1, some quantity from list 2 and so on. A Medicare card goes a long way towards passing that test.

interesting angle

We've all seen or heard of exploits captured via poorly secured systems containing backups or SQL injection via havij, but I find it interesting that they claim to be able to extract on demand. Normally, they would just be monetising something that they already grabbed, but this is claimed to be a permanent back door. That is both interesting and frightening because they can't just spend 3 months sending out new cards to everyone.

Two points:

1. Hon. Tudge, a bit more time securing your systems and a bit less time taking pot shots at "activist judges" and releasing Centrelink records of citizens who dare speak out to the media, eh?

2. Hon. McCormack, remember that whole #censusfail thing and how you were brushing off the concerns about your census retention changes and cross dataset matching? You were more or less accusing anyone who disagreed with you as tinfoil hat wearers. This breach was inevitable. Unfortunately, so is the census data. Don't worry though, we can all just move house, change our family living arrangements, employment, etc if that ever happens.

Linux 4.12 kernel lands: 'Go forth and use it' quoth Linus Torvalds

<div class="TotallyCoherentAndLogicalObservationsAboutTheTopicAtHand" />

EPIC LINUX FAIL

-Nodae

Blunder down under: self-driving Aussie cars still being thwarted by kangaroos

Re: Deer may be worse in the US because of what's around our roads

They weigh similar to an adult male human and can move at over 10m/s+. They are unfortunately coloured making them very hard to see in the first place, especially at dawn and dusk where they are most active. They can and do change direction on a dime making appropriate evasive action difficult to determine. The only real way to minimise chances and reduce collision severity is to slow down at those times of the day. They tend to congregate in flocks (called mobs) so if you see one or two in a short distance then slow down.

Re: Walabys

Wombats, yes the first time I activated ABS two decades ago was one of those buggers. It simultaneously felt like the strongest braking force* I had experienced in a car and time went very slow, the wombat disappeared under the field of view as the car stopped. They are both properly fast and solid as a rock. If you make contact, you aren't driving away.

*my prior car had drum brakes on the rear. Very glad that I wasn't trying to stop in that.

Why not just punch them like normal person...

Re: What about wombats

> Not to mention the drop bears

Well short of fitting a couple of nukes to the roof*, I'm not sure there is a solution to the drop bear attack.

*Even that is probably just going to piss them off. Best just to succumb to your fate and pray it happens quickly.

Australian govt promises to push Five Eyes nations to break encryption

Re: Imminent danger.

I disagree. I have complete confidence that George Brandis is exactly the guy you need when trying to balance personal freedoms against safety.

US engineer in the clink for wrecking ex-bosses' smart meter radio masts with Pink Floyd lyrics

Re: Well, at least he has good taste in music

If he wanted a lighter sentence, he could have just come up with a scheme to bundle junk loans into credit default swaps.

Queensland Police want access to locked devices

sounds reasonable

After all, Qld police have never in the past misused their powers.

Smart burglars will ride the surf of inter-connected hackability

Re: Link mayhem

ICBMaaS?

AES-256 keys sniffed in seconds using €200 of kit a few inches away

Re: AES was not cracked, cut the click bait

And I should acknowledge the title has been corrected (thanks) from "AES-256 crypto cracked in 50 secs using €200 of kit one metre away" to "AES-256 keys sniffed in seconds using €200 of kit a few inches away". If you didn't see the original headline then my comment definitely seems unreasonable. Wayback machine caught the original.

Re: AES was not cracked, cut the click bait

> So it's not clickbait, it's a real issue.

I think you have missed the point on why I have called it out as click bait.

Just because something is a real issue doesn't mean it isn't misdescribed or exaggerated in order to get you to read something. That an implementation of AES can be oracle"d this way is very serious.

AES is a description of what should be done to a byte stream to encrypt a secret with a key and how to get that byte stream back knowing the key. For a crypto algorithm to be broken means that I am able to decode the byte stream cheaper than attempting every possible key in the keyspace.

As far as I am aware*, AES is still not broken, and this technique, whilst novel and even significant, shows a faulty implementation of AES, not a fault in AES generally.

*if some TLA does crack it then don't expect them to scream it from the roof top.

AES was not cracked, cut the click bait

A poor* implementation of AES permitted a side channel oracle attack on the key.

*That's not a criticism of the implementation. A non-poor implementation is really hard to achieve. A good implementation will not have a different profile between a correct and incorrect guess at part of the key.

obviously...

The government needs to ban software defined radios.

Apple, LG, Huawei, ZTE, HTC accused of pilfering 'find my phone' tech

Re: I'm baffled

You must have missed this bit then:

"filed suit in the East Texas District Court"

PC rebooted every time user flushed the toilet

Re: A big job.

But was it severity 1 or 2?

Cisco's 'encrypted traffic fingerprinting' turned into a product

Re: It's an old idea

All tor packets are the same size. Any malware with a c&c server that is remotely a threat is using the dark web to make it hard for law enforcement to locate.

Also, with any modern crypto you can't differentiate the byte stream from random. If you can via DPI then we all have much much bigger problems.

Maybe some sort of crypto downgrade attack might be possible during the negotiation phase to something practical to brute force (and the Muppets in charge still like the idea of backdoored encryption, will they ever learn from past mistakes).

Tesla death smash probe: Neither driver nor autopilot saw the truck

Re: Bleh

Firstly with g/G, I read g as a unit of mass but whatever floats your boat. I was originally going to convert to N but that makes the sheer forces more difficult for someone who hasn't studied physics to comprehend. I don't think that central to my point. There are some pretty unrealistic assumptions in my 25x acceleration due to earth's gravity at some specific location and altitude.

Firstly, I was very generous with the amount of distance the car has to crumple. Having no engine up front certainly improves that, but you don't get 25G resistance equally across the whole collision. So if the first part of the crumple is say 4 or 5G, the remaining parts must increase well above my quoted figure.

Secondly, there is a velocity squared relationship here, so 33ms-1 is 4 times the energy to dissipate as 16.5ms-1 all else equal (not double as many people assume).

Thirdly, I'm not aware of any crumple zones that are able to be dynamically strengthen or weaken their rigidity based on collision speed. I am only guessing here that they pick a set of materials that get progressively more rigid the closer to the T cell you get. I guess it may be possible to use explosive charges to selectively weaken panels during an accident but I'm not aware of any production car that attempts anything like that.

Re: Bleh

Some quick back of the envelope calculations show that had such bars been present and the car collided at the same speed then this would be circa 25G of deceleration.

Airbags are a great safety feature of modern cars, but you ain't surviving 25G. Your soft brain will collide with your not soft skull that'll see to that. The only help such bars may have been in this accident is that it might have showed up on the radar/camera/lidar/whatever and the autopilot may have stopped. (The bars would improve survivability of much slower speed collisions though.

Honda plant in Japan briefly stops making cars after fresh WannaCrypt outbreak

Re: The price you pay for using generic OS for industrial control

> I suspect it is more down to shitty vendor's software that breaks easily with MS patches

Reminds me of the time about a year back when this obscure little product named Outlook 2013 was broken* by a Windows 7 patch Tuesday "fix" that took them 2 or 3 goes to get right.

* As in, crash on every launch and not fixed by a reinstall of Outlook.