Posts by Adam 1 2545 publicly visible posts • joined 7 May 2012
> I hope that IPv7 or IPv8 routers
At the risk of having a Bill Gates moment, what on earth do you think we'll be doing in the future to need such an immense address space.
Perspective time. The surface area of earth is roughly 5.1 x 10^8 km2
IPv6 gives 2^128 addresses (ignoring reserved ranges for the minute). That's a big number*.
That results in 667,220,330,000,000,000,000,000 ipv6 addresses per square metre on this planet. How much IoT tat do you need?
*Citation needed
What counts as biometrics in this case? Is a photo or collection of photos of a known person considered to be holding biometric data? If so, then this net captures a lot of other businesses and indeed people.
Or does there have to be a conversion on those images to a series of measurements of ratios and angles between features before it is considered a biometric template. If so, does this mean that there are certain algorithms that are not permissible to run on a photo. Would smile and blink detection algorithms fall foul of such definitions.
Don't get me wrong, I'm hardly the person who would stick up for a massive advertising, tracking, manipulative company, but I have much bigger concerns about how they use such data to link people with other people in shadow profiles.
Re size of Australia, if the bottom of Tasmania is in Egypt, Perth is somewhere in Spain, Darwin somewhere up in Sweden, and Brisbane in Turkey. It has a cattle farm that is bigger than Israel (see Anna Creek).
All with the population of California.
But we don't each get our own mountain range. Rather, that population is largely collected in a few cities in the south and east with almost nothing in the middle (except big spiders and drop bears obviously). Serving remote communities with infrastructure of any sort is not without challenges, but nbns problem has always been political. The current mob needed a 'the previous mob are clueless wasters of money angle', a classic case study of not invented here syndrome. History won't look kindly on what the current mob have done to the project.
Really!? I must have missed Google ceding to New Zealand law and suppressing that name.
What does Apple maps call the spratly islands? How is China with that call? What about the Philippines or Vietnam?
How very quaint of you to think that these companies structure their legal entities and technical responsibilities such that those outposts have no capability to comply with demands made by those companies.
Let's not even get into whether China accepts your right to publish certain political commentary, or whether YouTube should depict women driving cars as prohibited in some backwaters from which a lot of your oil comes from.
If AWS has a bunch of bit barns across western Europe that become illegal to use for servicing European citizens due to GDPR or something, they will have no choice but to sell the bricks and mortar to some European company who isn't subject to American law. This was my very first point.
> If a "rogue host-level administrator" is in charge of your network then you have bigger problems.
So where does an AWS or Azure sit in your threat model here?
If it helps, imagine there is a country out there, let's call this place Murika, which believes that it's laws apply to all other countries. Let's call these other mysterious places Notmerika, and let's pretend that they have their own governments, laws and legal frameworks. Notmerika has certain laws that governs the treatment of data of its citizens and companies. These laws restrict what data an organisation may collect and with whom it may be shared, including how law enforcement can, through legal mechanisms like subpoenas, force the organisation to hand over data.
If the host can access the guest's memory in a decrypted state, then it becomes practically certain that they will be subpoenaed by a Murikan court to produce contents from the guest which would otherwise have required the appropriate paperwork be passed to the Notmerikian authorities.
Two classes of people should care about this:
1. Murikan's who hope to sell their cloud services in Notmerika; and
2. Notmerikians who went to run services for other Notmerikians whilst complying with Notmerikian law.
For any Aussies caught up with similar misrepresentations, you can thank your lucky stars that the Australian Consumer Guarantees explicitly cover motor vehicles unless bought at auction or from a private seller.
See here.
Specifically some pertinent quotes
"Products must also:
* match descriptions made by the salesperson, on packaging and labels, and in promotions or advertising
.....
* be fit for the purpose the business told you it would be fit for and for any purpose that you made known to the business before purchasing
....
* meet any extra promises made about performance, condition and quality, such as life time guarantees and money back offers"
That said, if I'm spending 6 figures on a car, I'm spending a few hundred in getting a lawyer to draft something which they'll find a little trickier to ignore.
> - To encrypt the connection to
> the endpoint.
> - To verify that the endpoint is
> the intended recipient.
> Self-signed combats the first
> but not the second.
A subtle point here that I suspect Lee understands but others may have missed.
The first point is more correctly stated as "To encrypt the connection to some endpoint". If you deliver your site over a self signed certificate, you cannot be sure that the self signed certificate presented to the browser is the one you sent. Here is the scenario in action.
1. Alice visits bob.com from Mallory's internet cafe.
2. Mallory intercepts the initial clienthello negotiation and sends a fake serverhello with a self signed bob.com certificate.
3. Simultaneously, Mallory does her own clienthello to the real* bob.com and negotiates everything from there.
4. When Mallory gets the response back from bob.com, she decrypts it with the negotiated session key between her and the real site, then re encrypts that stream with the session key she negotiated with Alice.
5. The process is reversed for sending any requests to the server.
Realise that neither Alice nor Bob see anything unusual in this interaction. Alice would be informed by a big red warning box in her browser that the certificate is untrusted. The problem in our scenario is that this is exactly the error she will see where communicating with bob.com without Mallory in the middle.
*A comment on real site in this context. Even Mallory could not know in this step whether another mitm exists between her and bob.com. It's turtles from there.
> There is a New Zealant arm of Google, as well as an NZ-localised version of their site, so it's not unreasonable to expect that part of Google to comply with local laws. Saying they don't have the technical means to do it, when they do so for various European jurisdictions sounds ... wrong ..?
One wonders whether they may find compliance cooperation more forthcoming if that lovely
.co.nz domain disappeared.
Yes. Paying less per month now* line rental isn't a thing, but getting unlimited data, unlimited national calls and unlimited calls to mobiles.
Will look at NBN at some point. We have the box drilled onto the outside wall, but they still need big Mal to sidestep some laws of mathematics with the Telstra under-provisioned fraudband cable before they can shine some lightelectrons down it.
*Ok very marginally more if you add the VPN cost but I value my privacy, but no bill shock on bigger. months.
Works both ways. When I moved into my current place, they had a pensioner discount* applied on the plan. Did the right thing and called up their accounts. They said thanks, told me they'd fixed the issue, just pay the discounted amount and next month it'd be normal.
Next month, you'll never guess what happened.. so I called them again, explained again how they had applied it by mistake and asked for its removal. Sure thing, they said. The last phone monkey pressed the wrong button but it's all fixed now.
Next month, go on, take a guess. So I called, told then that this was the final time that I would call them, re explained that I don't want this on my account. Then explained that no, I am not trying to apply for a pensioner discount. Eventually they got it, told me about how the other phone monkeys must have missed the steps. Got a receipt number that time.
So next month, actually let's fast forward a bit. About 5 years later, they sent me a nasty letter demanding documentation proving I'm entitled to the discount in 30 days or else they would cut off my discount. Perfect.
So about a year later, I transferred my phone line to nakeddsl with "not Telstra", still receiving my discount every month.
*This is Telstra's idea of a discount, which means only 1.9x the competition instead of 2x
@allan, the salient point is that seemingly non identifying attributes in combination can build up a profile that is anything but anonymous. I'm not really sure why you bring up authentication or reasonable doubt testing. But I guess if somehow police knew your date of birth, gender and suburb but absolutely nothing else about you, they would only catch you 80% of the time.
Three facts: Date of birth + gender + post/zip code get a surprisingly unique profile. I don't have the figures on hand, but it is enough to uniquely fingerprint a single person in well north of 80% of occasions.
So you heard it here first. Want privacy, be an identical twin....
> To say that .NET is a shit copy of Java is a bit harsh..
More than a bit harsh. Can we interest you in a mutable datetime class? Whoever thought that was a good idea, I'll have whatever they were smoking.
XAML is a brilliant idea terribly executed. Over engineered to the point where the winforms folk scratch their head as to why it should take an hour to write the code to hide an element based on an enum with some value and'd with some other bool property. Your triggers end up just as long as war and peace, can't be easily unit tested, resulting in people (ab)using their viewmodels and having to add a gazillion notify property change events, or (ab)using multivalueconverter because the expression is much simpler and you can at least write test cases on the converter. If it transcompiled to html5 then it would be very strong, but it doesn't open up any web options, unless you count silverlight or xbap (er, just no)
But back to my point, it's a bit stupid to claim it as a poor copy. It was able to avoid some of the more stupid architectural traps Java found itself in and end up with things like lambdas much earlier. The async await stuff is also excellent.
> FFS most script kiddies could launch a working GPS system.
Totally true. Saw this on stackoverflow just this morning
I have written a GPS system. Here's my code.
#include <stdio.h>
int main()
{
printf("Hello, World!");
return 0;
}
I want to have sub metre accuracy in both longitude, latitude and elevation but I don't know where to start. I think I need generics.
> Anyone know why they can not just use https without sni?
There needs to be a way for the web server to resolve the intended domain of the HTTPS request so it knows which certificate to use.
Without SNI, your server needs to rely upon a unique IP address per hosted domain. IP4 addresses are a limited resource, making that a costly proposition.
I guess SAN certificates are another option, but then you get a list of unrelated sites (including potentially, er, questionable activity sites) listed on your certificate. Try explaining that to world+dog.
and I've got to say he nailed a few things. I can't really comment about hostility to women or people of colour (being neither myself). I haven't seen anything but that may be because the mods catch it early. But there is definitely a vigilante element where someone dares to ask two questions about a block of code. They get strung and quartered if they dare start a sentence with "what is the best practice for ....". They could have answered "The best practices in this area is heading into opinion territory. Rather, here is one way to achieve what you want that uses recognised design patterns XYZ."
I totally support the downvote of the code dump "My code has a problem" or the "insert literal quote from someone's homework with no effort of a solution". I totally support the XY response. I think people can be too aggressive on the duplicate flag, but support it in the right circumstances. I just don't get the idea of down voting something without you or someone else pointing out why the answer is wrong or dangerous or just a code dump without context.
At the end of the day, if there are people out there who don't contribute because of prevailing attitudes, then the answers aren't as good as they could potentially be. That doesn't mean that everyone is a snowflake. But it is possible to show respect to someone even when you think they are wrong. If you cannot articulate why there are dragons (or at least missed opportunities) on the suggested answer or comment that you disagree with, then that says more about you than the answer and you should defer to someone else to respond.
He called it a measure, not a silver bullet to fix all debt. And on that basis I think his point is strong. Quite strong.
The sorts of organisations* that don't value unit testing** are highly correlated with the organisations that are too focused on the here and now to allocate time to resolving this technical debt.
It's understandable at one level because resolving technical debt is expensive. The only thing more expensive is to not resolve it and then attempt a fix/improvement. But don't expect the business to recognise that the week spent on fixing some deficiency here has saved them two weeks on other projects over the following 6 months.
*I speak of organisations because individual developers within those organisations may well be pushing the proverbial uphill trying to get the business onboard, but if they can't be convinced of the benefits of unit testing then they are likely to see any attempt at technical debt reduction as developers taking liberties with valuable company time.
** By value, I don't mean platitudes about their merits. I mean actually invest time into doing it, as well as investing in some sort of ci that runs them on every commit, as well as actually being prepared to rewrite code so badly coupled that unit testing is nigh impossible, as well as actually using the facts about whether an individual developer is consistently decreasing coverage as a KPI at their performance reviews.
@wally, I agree with 90% of your post, it's just the other 90% where we differ ;p
> Seriously, whoever is responsible for ensuring that a car hitting that barrier at the legal speed should not result in a death
Newton has a thing or two to say about such a possibility. Kinetic energy follows a square relationship to velocity.
ie. K = 0.5 * m * v2
What that means in practice is that a car doing 120km/hr must shed 4 times the energy it would have at 60 (or 16 times the energy of a 30km/hr crash).
At highway speeds, the barrier's main goal is to control the direction of the collision so you are less likely to be torpedoed into another vehicle (especially head on). With that much energy to absorb head on, the shear force of your brain mass hitting your skull is likely to be fatal, even if the barrier, crumple zones, air bags, pretensions, etc all perform perfectly. For perspective, EuroNCAP frontal test is at 64hm/hr. Take a look at one of the better performers in that test, then try and picture it without 4x the crash energy.
But I totally agree that replacing safety barriers after a collision must be a priority. I also share a big concern over why the sensors failed to detect the obstacle even if it got confused over the lane markings, or if it did see the obstacle, why it didn't appear to attempt to avoid it.
> They're only about a dozen kilometres apart, but on different floodplains and nicely close for networking and failover purposes.
lucky that Canberra isn't vulnerable to any other types of disaster.
This site has quite a proven track record of predicting the future.
A year ago, coincidentally to the day, there was an innovative suggestion about JavaScript crypto miners being delivered by a website rather than ads to annoy people. Now we have coinhive to deal with.
My best wishes to the successful applicant. May this be a memorable day for you.
The client then says which encryption system it plans to use for the weaker, session key – which allows data to be sent much faster because it doesn't have to be processed as much
That's a bit misleading. The session key allows data to be sent faster because it uses a symmetric cipher. That is AES these days, and this is computationally as simple as bit shifting and XORing.
Asymmetric encryption is usually done with an elliptic curve* variant of the Diffie Hellman algorithm. In ballpark terms, that costs about 5000x more CPU time for the same payload. The real question is why not just use symmetric encryption? Spoiler alert, symmetric encryption requires both parties to know the shared secret (session key). How are two parties to communicate this without "Eve" learning it too? By using the asymmetric encryption to send the session key, you, in general, get the throughput close to symmetric alone but without the problems around how to share that key without another party discovering it.
*There is nothing wrong with Elliptic curves, just don't use the parameters that NISTNSA were pushing.
> Why would porting a language's 100-ish keywords and 300-ish error messages to another language take any longer than a few hours or a few days?
It probably wouldn't, but it is a courageous assumption to think that the only difference between English and other languages is the spelling and pronunciation of words. The inverse of that process is how we end up with DVD player manuals.
In English, the flow
while (condition is true)
{
PerformSomeAction();
}
makes grammatical sense.
Maybe some other language would be more grammatically correct if expressed like
Continue with
{
PerformSomeAction();
} providing precondition was met
So? I have no issues with Azure. It seems a reasonable cloud platform, but it's hardly the only game in town. Even if it's number two, it's generating more revenue than some countries. Then there's Google/Rackspace/Oracle*/IBM which are still viable alternatives for many customers.
Let me spin this another way for you. Company X gets cross with Microsoft for raising prices and directly cutting into their profit margins. They decide cloud is more economical for some of their workloads. Do they:
(a) blindly run to sign up for Microsoft's cloud offering, or
(b) swear off that vendor to the extent possible.
Again, it is different if some new magical network stack can handle double the TCP connections, but if the feature set is best described as evolutionary, then the pricing better well be too.
*sorry, I'll wash my mouth out with soap.
> the price bump was to be expected with the new version of Server, and could be used to nudge more customer toward Azure
Or AWS, Golden Geese and all that.
Price increases are fine if they follow inflation, but otherwise they had better think pretty hard about efficiency dividends. That is to say, if the price increases above inflation then the savings otherwise made because the thing is faster/copes with more concurrency/etc/more automation and management features better make up for it and then some. They would do well to remember that many are dealing with the meltdown/Spectre overheads already so may have needed to provision more servers for their workload and will be even less keen than normal for a price bump.
You are right in the general case*, however being a feature in the nightly builds (ie, your beta testers) there is already self selection going on. In this specific research, the specific addresses that they're searching DNS for would be unimportant. I'm guessing they're interested in performance/network overheads in different environments with different potential fail conditions.
*Food for thought, some countries think that non compulsory voting gives an accurate indication of the wishes of their citizens and even pick their representatives with such self selection errors.
> Is that necessarily true ? Why do supercars have huge actively cooled carbon fibre discs?
Ah, the thing your are missing is the second corner. Even regular stock brakes can do an emergency stop from any speed your car can travel. The issue is when you want to do the same thing again 30 seconds later at the next corner. And again. And again. You cannot do that with stock brakes
Your braking limit is the maximum deceleration at each tyre before it loses traction. That depends primarily on the road surface and the contact patch of the tyre. That is why wide profile tyres and racing slicks improve stopping times (in the dry). You do also need to take into account that under heavy braking, your car's centre of gravity will move forward (blame Newton), so you have higher traction on the front tyres but lower on the rear. Modern ABS braking systems continuously monitor each wheel speed (plus steering angle) to make sure this each brake is doing the most that it can possibly do beneath this limit to wash off the speed. There is some serious boffinary in these systems.
> If with perfect reflexes +perfect brakes I can stop from 30mph in 6 car lengths, then the kid is safe if they step out 6 cars ahead of me but not 4. So speed limit in school zones is 20mph = 4 car lengths. But what if they step out 2 cars ahead of me?
That's not how physics works.
d=(v^2)/(2*μ*g)
v is your velocity
μ is your coefficient of friction
g is 9.8ish here on earth
In your example, the only variable is v. So if it takes 6 car lengths under some condition to stop from 30, then
Assuming a 5m car length and otherwise just doing si unit conversions
μ=(13.4^2)/(2*9.8*(6*5))=0.305
Plugging those back in for the 20mph case
d=(8.9^2)/(2*0.305*9.8) = 13.2m
That's a pinch over 2.5 car lengths. Not 4. So you would still hit, but at a *much* slower speed. Maybe they'd even survive.
But if people undertake an activity that requires them to assess the safe speed for a certain visibility distance, like we driving say, they owe it to society to get a basic understanding about how speed and conditions affect stopping distances.
For anyone responsible for the design of a password handling system, please remember that your users are almost certainly the weakest link in your design. Our brains are not good at random and not good at memorising character sequences with no pattern or overlaying meaning. We (users in general) fail to see how our password choice on catappreciation.com matters. It's not my bank after all. Inevitably, we put a 1 on the end of we're forced to add a number, and change a to @ for the symbol requirements to construct a simple to crack but hard to remember password.
My suggesting to system designers:
1. Get the server side right. Forget build your own hashing with sha-whatever. You need to be looking at bcrypt/scrypt/argon to manage things.
2. Guide your users well. Let them paste passwords so they can use a password manager. Integrate your (re)set password screen to pwndpasswords API (the V2 one) to reject stupid choices (or download the torrent and roll your own private version if you don't trust Troy). There are plenty of public libraries for nuget/mom/pretty much anything you can name already, so you are talking about an hour of effort to really practically boost your users' security.
> You, on the other hand, have never worked on or been close to someone who works on a transport system, or else you would know that the look and feel of an official card is part and parcel of spotting forgeries.
One of us is making some assumptions there. But Let's talk about forgeries for a minute. Do you honestly think that someone is going to go to the effort of getting a fake printed. I mean, wouldn't it be easier to steal a half used box of blank cards from one of those popup kiosk newsagencies and write your fake data to the NFC chip inside it? Then there is no difference that one can garner from typefacing or colour bleeding.
Also, you have an unrealistic understanding about what the transit officers actually do. Four of them board a carriage from both ends, just before the doors close. Two from each side go upstairs. Two go downstairs (stopping someone doing a runner). They then ask to see everyone's card and concession entitlement if it isn't a full fair card. This involves holding a thing that looks like a 6" mobile against everyone's card, getting a bing sound, then giving it back and saying thank you. I have even on one occasion had them validate my card from inside my phone case. They have to get through the 100 people in the carriage between two stops, check concession cards, and usually write up one or two people. They're not sitting there with a black light trying to see if the NFC antenna is in the correct spot or whether it was printed upside down or whether there's an extra petal in the waratah.
> The card itself may have contained other security features such as a holosticker or a serial number in human readable form.
It doesn't. It has the word adult, the opal logo and the new government logo on it. On the back is the remember to tap off message, phone numbers, website, the card number and 4 digit security code. Certainly nothing a human can use to spot a forgery.
I would be utterly amazed if security wasn't handled by encrypting the data it holds.
> These are not your innocent TOR users mixed in with criminal elements, anyone can use TOR
Aren't they? Some of us have the romantic thought about having the right to the presumption of innocence and letting any facts to the contrary be established in a court of law.
Just because you or I don't think we have any secret worth several K per year, does not mean that others do not have legitimate need for this sort of security. I can well imagine a business in an industry where millions or even billions worth of IP could be the target of theft by companies with not such a long arms length relationship with their ruling party.
Different issue. The same applies in NSW. If you are traveling on a concession fare, you are required to show your proof of entitlement to do so (that'd be your senior/student/whatever) to anyone authorised to validate your ticket (that'd be the inspectors/bus drivers/fare collectors/gate staff). This case doesn't change that, nor was that being challenged.
What was being challenged was the ability for a concession holder to travel on a card that is not linked to their personal identity in some big data hoover.
Siri, can my air-gapped PC be compromised by a speaker?
Tomorrow's weather in Turkmenistan is cloudy.
What the, Siri, can my air-gapped PC be compromised by a speaker?
The best drink to accompany a steak is a red wine.
Errrrrr, Siri, CAN my air-gapped PC be compromised by a speaker?
Would you like to hear about my notch?
Screw it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
