The Register Home Page

* Posts by Sproggit

464 publicly visible posts • joined 8 Jul 2012

Page:

Iran claims US used backdoors to knock out networking equipment during war

Sproggit Silver badge

Re: False flag operations

While I absolutely agree with your point... my concern isn't e.g. pfSense or opnSense... it's the hardware to run it on.

Glovary? Made in China

Protectli? Made in China

And on and on.

We've just had OpenRetch put fibre along our road and are waiting for connections, so I'm looking to sign up with CityFibre's 5Gb service and host@home. The problem is... can I trust the Chinese manufacturer of the hardware that pfSense is going to run on? I think the code can be robustly audited... but how hard would it be to compromise e.g. the Ethernet sockets?

[Yes, I know that some of these machines run Intel Ethernet for that very reason... but in my case I could not spot a "genuine Intel" Ethernet socket from a fraudulent, compromised clone.]

The concern is that if it's your perimeter firewall that is compromised you have a much-reduced chance of independently spotting unexpected network traffic between the compromised device and it's remote operator, because it literally provides your outer perimeter.

Tricky.

Intrigued to know if you've come up with any decent/effective way to select a good h/w platform for the likes of pfSense?

Sproggit Silver badge

Re: Policy Change - in the Wrong Direction

When you use the term "made" you may be implying hardware... But of course that is not true with software. And it is in software that vulnerabilities and exploits are most common [that's inherent to the "nature of the beast" - hardware is rarely as complex as software - with the possible exception of microprocessors, some microcontrollers and VLSI chips.

We don't know the details of the cyber strikes or what specifically was attacked.

But my hunch is that it will be software vulnerabilities that were exploited. Not an absolute certainty - Stuxnet is proof of that.

But on a balance of probabilities, this was a software-based attack.

Sproggit Silver badge

Re: Policy Change - in the Wrong Direction

Two quick observations on your points.

First, there is plenty of evidence - if not overwhelming evidence - that the US had cracked Japanese Navy ciphers and had decided the message that informed the fleet of Japan's intent to surrender *before* Enola Gay dropped "Little Boy" on Hiroshima, on August 6th, 1945. I don't think that undermines the spirit of your argument - that sometimes you need to "make a move" that also "makes a statement" .. but I don't think I can agree with anyone who says that it was right to "make a statement" that resulted in the deaths of between 80,000-140,000 people, most of whom were civilians.

Second, I may have failed to articulate my point clearly. In your reply you suggest that many vulnerabilities may be of the "use them or lose them" variety and this is why it made sense for the US to exploit those back doors before they were discovered and patched. I think there's something of an argument that we might be able to make in that regard... if the target had access to new technology and the budget to keep their tech and vulnerability patching up to date. But my point was much more "ATT&CK" than "CAPEC" - namely that the risk to the US was as much about "sources and methods" (Tactics and Techniques) as it was about specific vulnerabilities.

For example, think about SPECTRE and Meltdown, the two high-profile speculative execution vulnerabilities that were found in Intel chips a little while back. As soon as news of those flaws became public, other researchers found similar vulnerabilities in other silicon. It wasn't knowing that SPECTRE existed on Intel chips that was the big deal, it was knowing how it was found, what to look for, how to scan an environment to find similar examples and so on.

China, Russia and others are going to be able to "work backwards from the point of impact" and learn a great deal about US techniques. They may find forensic evidence left behind. They may find new ways to scan for the exploited vulnerabilities - once they know what they are and devise test to detect them for themselves.

But most importantly of all... the last thing you want to be doing with your cyber offense capability is a "shock and awe" campaign. Not when you don't know who else is watching or what they will see.

Sproggit Silver badge

Policy Change - in the Wrong Direction

Thanks to Edward Snowden, those of us paying attention have been aware of these possibilities for more than a decade.

However, what has been interesting is that we haven't seen significant evidence of the offensive use of cyber weapons/tactics/techniques by the US prior to this administration and the appointment of Pete Hegseth.

Since Hegseth came on board, we know that he spends his days looking at war plans.

We know that the US used offensive cyber techniques against ***Venezuela*** and ***Iran***...

As even a moderately competent "Top Trumps" [sic] player will tell you - or "Contract Bridge" if you want to be a bit more formal about it, you don't play the strongest card in your hand to win a round when a weaker one will do. You play the weakest card that will be sufficient to win the round.

What we've seen from the US military in the tenure of this Administration is perhaps best described as the bombastic use of offensive cyber weaponry where likely none were needed. Not when you're dropping bombs from 10s of thousands of feet and have no "boots on the ground". In other words, what we've seen from the US military is nothing short of strategic stupidity.

Surely someone in the US DoD has told Command that there will be Chinese [or Russian] agents on the ground, collecting any technology suspected of being compromised by the US in order to enable forensic analysis and auditing to take place. Surely someone in the US DoD has told Command that deploying sophisticated cyber capabilities against a third-world nation which - outside of it's petrochemical sector - is based almost entirely on agriculture?

I'm sure that China - and Russia - are celebrating. Just that I'm not sure that it will be for the reasons suggested here. Rather, I think that China and Russia are going to be so incredibly grateful to Iran for helping them to get a handle on US cyber-offensive capabilities.

I'm sure that will come in useful when Putin invades his next neighbouring state, and/or China decides to take Taiwan by force.

Another foot-gun moment.

Right to repair champ Framework punts modular 13in laptop with Core Ultra Series 3

Sproggit Silver badge

Re: I want to like it, but spec limitations kill the deal

Pretty sure that the reason that the Frame.Work 16 models don't offer Thunderbolt is because they're all based on AMD silicon... AMD, of course, is not certified for Thunderbolt 4 silicon...

However, having said that, the Frame.Work 16 *does* offer a degree of support for USB-4 [just not in all of the module slots] and that not only offers speeds up to 40Gb/s, almost all devices that use Thunderbolt 4 are also compatible with USB-4.

So I suspect that if you have hardware that provides Thunderbolt 4 connectivity - like say a portable NAS or storage solution - then you'll be able to get where you want to go with the USB-C module placed in one of the two provided USB-4 sockets.

NASA working on 'Big Bang' upgrade to keep the Voyagers alive for longer

Sproggit Silver badge

This isn't so much Off Topic as "Out There"...

Launched in 1977, Voyager 1 weighed approximately 1,797 pounds [or 815kg]... Voyager 2 was about the same...

Using the technology commercially available today, SpaceX and the Falcon Heavy - not Starship / Super Heavy, SpaceX could put approximately 37,000lbs or 16,800kg in to Mars Orbit. If you're willing to accept that "If you can get to Mars you can probably get to anywhere in the Solar System and Beyond; it's just a question of how long you'd have to wait to get there", then today, SpaceX has the capacity to pit give or take 20x the payload in to deep space.

Given a mission profile with a total mission weight of something in that capacity - assuming, of course, that SpaceX chose a single-launch approach and did not contemplate any sort of "in-orbit assembly" of a larger or more complex vehicle... then with the addition of the latest reliable version of say the NEXT (NASA Evolutionary Xenon Thruster) drive, or maybe AEPS (Advanced Electrical Propulsion System) [either of which are many times more thrust efficient than either Voyager vehicle.

Add in some 21st century power plant technology - a radioisotope thermoelectric generator (RTG), powered by Americium-241 and you've got a power supply with a half-life of 432 years, making it ideal for a multi-century long-range mission.

The sheer lifting capacity available to NASA today [in the form of Falcon Heavy], coupled with a Xenon-based thruster and 21st-century RTG and you've got the ingredients for a deep-space exploratory vehicle that could probably make it to our nearest stellar neighbour. Not in our lifetimes, of course, [we're talking thousands of years for that sort of vehicle mass] but it's much more likely that we could keep in touch with it than some of these smaller, lighter, "laser light-sail" approaches.

Or... that would be enough of a payload to send a much more serious amount of kit to the more interesting planets/moons in this solar system...

Booking.com warns reservation data may have checked out with intruders

Sproggit Silver badge

This has to Hurt before it will Get Better

If a robber were to break in to my bank [more likely to be a hacker these days] and steal money from my back account, the bank is liable for my loss.

If I book my car in to a dealer for a service and the vehicle is stolen while they have it, they are liable for my loss.

Yet if some random company has my personal information - which given that we all know such data is bought and sold on the dark net and thus has actual value - the random company responsible for the loss seems to be able to shrug, say "sorry" and have no other liability.

Yes, sure, they may suffer a reputational hit, especially if the data loss becomes a repeating incident - as is the case here. But I wonder how long the knowledge of this break-in will stick with potential or new booking.com customers?

The reason that breaches like this continue to happen is simply because the "cost" to booking.com is negligable - not worth their concern. Yet if a couple of dozen of us were to book holidays with them using fraudulent card details and leave them out of pocket for a few tens of thousands of pounds, that would likely be a greater impact than a major data breach.

Unless or until that equation, that calculus actually changes, companies simply don't have any incentive to take security seriously. We can put a large part of the problem at the hands of relevant regulators. If the company concerned is a Mom&Pop shop, they might hit trouble... But if it is a large employer, if it competes with overseas competitors, then the chances are that there will be no come-back whatsoever.

We can easily and objectively tell when this situation is likely to improve. It will only happen when UK legislation changes in such a way that the companies who experience breaches like this - and their leadership - are made to feel some pain.

If there were:-

- a minimum 6-month prison sentence for any CEO and CIO of any company where more than [random number - 1,000] client details were stolen/leaked

- fines equal to the average value of dividends paid in the preceding 3 years

- fines equal to the total amount of money paid out in performance bonuses to all staff over the preceding 3 years

- significantly escalating penalties for repeat offenders

or a similar set of incentives that ensure that the company leadership will be made to *hurt* if they leak data like this, then companies will take this seriously.

Until that happens, they are laughing at us. This is the "cost of doing business" - and it costs them next to nothing, but it might cost you everything.

Don't hold your breath...

Sproggit Silver badge

I appreciate this is a bit of an extreme approach, but I took your practice to a logical conclusion.

I have dedicated email addresses for every regular supplier and vendor I deal with (plus a "disposable" email address [thanks, Hotmail]. OK, to do this I registered my own domain and then each discrete "address" is just a forwarder to a single collection mailbox, from where I'm able to download all emails quickly and easily. [It is of course possible to do this purely with free email from e.g. Hotmail or GMail, but that can be a bit tedious]. having a domain means I can set up email addresses such as "booking@mydomain.net".

If booking.com are stupid/unfortunate/irresponsible enough to disclose my email address or other information, I can drop that single email address and move on - using a discrete forwarder for each vendor takes no time to set up and reduces the blast radius [for email] to an absolute minimum.

I'd very much like my bank to move to a one-card-number-per-transaction model - like an OTP but for credit card numbers - but they haven't done that yet. However, if there is an issue with a supplier and a data leak, I simply insist on having a fresh card with a different card number. I figure that making the bank hurt a bit keeps their focus on unreliable vendors and reduces my risk further.

But the other area where I've found per-vendor email addresses to be an absolutely brilliant solution is tracing spam. If I get an email from some random company to "amazon@myregistereddomain.net" and that email hasn't come from Amazon, I know who has been leaking my contact information and I can take them to task over it. And when Amazon *did* exactly that, I went back to them and demanded to see where I had given them permission to hand out my personal details to third parties. They pushed back, saying that the GDPR allowed them to do that for "necessary" business purposes, but I countered that it wasn't "necessary" for a courier to have my email address. That debate got quite unpleasant, but they eventually backed down.

I realise that not everyone is going to want to set up their own domain just to handle that sort of thing, but maybe handling 3-4 email addresses to partition up your digital life isn't too hard and isn't such a bad idea?

Electronics industry says FCC's foreign-made router policy is a bit of a mesh

Sproggit Silver badge

Re: I'm fine with this

"Because in the name of some ill-thought "freedom", Linux can't have standards - so it's not a welcoming target for desktop applications developers, and that's even before GPL keeps many commercial applications away."

Respectfully, I don't think that's true - or fair.

- There's LSB - the Linux Standards Base, from the Linux Foundation

- There's robust device support - Linux had USB ahead of Windows, for example...

- There's a healthy ecosystem for application portability - with both Flatpak and AppImage supported

- There's leadership on data formatting standards, with e.g. full support for ODF from multiple applications [better than proprietary platforms!]

- And there's even support for Linux from Microsoft - either via e.g. their .Net Developer Platform, which runs just fine on Linux, and/or their support for tooling such as Visual Studio Code.

However, I wonder if what you're calling out here is the difference between the "Cathedral" and the "Bazaar", as identified by Eric Raymond? Linux can look as though it has less in the way of Standards, but that's because it is a melting pot for good ideas. Maybe you've seen [or own?] a T-shirt with: "Talk is Cheap. Show Me The Code" on it? The big difference between Linux and the proprietary platforms like Wndows is that they are brutal meritocracies, with much less "infrastructure lock-in". So another way of looking at this is to accept that the inverse to the "freedom" advocated by the Open Source community is to stay on a proprietary platform - and be a passenger/victim to all the decisions that platform owner decides to make.

When Microsoft abandoned the Zune music player, all the devices bricked and all the music those devices held [in that form] was lost. If that had been an Open Source project, someone else would have picked up the code and continued support.

To put it in even more stark terms: today, more than 60% of Microsoft's Azure virtual machines run Linux. Linux is the most-used Operating System on Azure. Microsoft even have their own Linux distribution [Azure Linux, formerly "Mariner"], used for it's own services, such as Azure Kubernetes.

Sproggit Silver badge

Re: I'm fine with this

"The EU lost a large, prosperous ally from its coalition, and the UK lost a seat at the table. Brexit Winner: America."

You make lots of thoughtful points, but I have to respectfully challenge you on the assertion that the US saw Brexit as an advantage. Barak Obama was US President at the time of the vote and he spoke publicly on multiple occasions in favour of the the UK remaining in the EU. If there was a significant external winner to the UK's decision to leave, it was Putin. And I make that observation still believing that the EU was beyond stupid in refusing to rethink their negotiations with the UK and allow the UK to leave. I understand the cultural motivation for it - particularly from Germany - but they were blind and insensitive to the way that their desire for unification would be interpreted by the UK. And it cost them as much as it cost the UK, if not more.

Obama's motivation for his pro-Remain stance was pure self-interest: the US saw the UK as a critical vector [not ally] when dealing with the EU writ large: a UK Brexit would have the effect of pushing the US further from the decision-making process in Brussels.

What's interesting is the fact that it is "home routers" that has come to the fore as being an early candidate in this switch towards a different type of US dominance. But it's also logical. Of all the different types of electronic devices used by average families today, the US have chosen to mandate one which, if the device were to have a back door built in to it, would give all sorts of advantages to the company and nation that knew about those vulnerabilities.

Just like we learned of the PRNG vulnerabilities from Edward Snowden, I won't be remotely surprised if our future selves discover that this new wave of US-made home routers contain well-hidden back doors that only Uncle Sam knows about.

Sproggit Silver badge

Re: I'm fine with this

It may actually be a bit more subtle and a bit more serious than you have expressed the situation.

The challenge here is that the US economy is so huge that anyone manufacturing anything has to ensure that their product is compatible with the US market or they are effectively locking themselves out of the vast majority of their potential customer base. In turn, this means that the US has a "soft power" option by mandating a specification that meets US interests, whether other nations like it or not. A good example of this might be e.g. encryption: if you want to sell in to the US you have to support US-approved [and thus US-generated] encryption schemes... but, as we now know thanks to Edward Snowden and others, US encryption schemes had obscure weaknesses that made them easier to crack by the US government.

Then you get to more of a "hard power" scenario, where the federal government itself can mandate the use of particular standards for technology. These mandates are also enacted in all their purchasing decisions, which means that if you want to be a direct supplier to the federal government, you need to comply with those standards... and this in turn ripples back up the supply chain, so that suppliers-to-suppliers also have to comply. It doesn't take much of this to get to the critical market mass where something basically becomes a "de facto standard" because the federal government has mandated it for internal use.

As others have noted, that amount of leverage gets significantly amplified when it is being used for a combination of security and nationalistic/economic objectives.

But there's another interesting [and really quite hypocritical] dimension to this. As far back as the Obama administration, the US government was working hard to secure massive trade deals with other nations - things like the Trans-Pacific Partnership, the now rather muddled history of NAFTA/USMCA and of course TTIP - the Transatlantic Trade and Investment Partnership. In each of these agreements, one of the things that the US does is to insist on acceptance of intellectual property through patents... whilst at the same time using the USPTO to grant patents on just about anything so that it is a group of US companies that hold patents on key markets. This effectively gives the US industrial dominance over pretty much anything they want - because if you don't want to accept those rules, you don't get access to the US market.

Except.

The one nation in the world with absolutely ZERO interest in respecting intellectual property law is.... China. And the US are belligerently "I see no ships" myopic when it comes to China's flagrant theft of intellectual property from all Western nations. Clearly the calculus has previously been that, meh, let the Chinese make stuff cheaper - they can have all the low-paying jobs and the sweat shops, we'll just buy from them. Which is fine as long as the west retains the technological edge and the ability to step up industry to match China if needed.

Something that is no longer the case.

And all of the above is *before* we get to observing the ways that China is thoughtfully and quite deviously undercutting critical western infrastructure. China has been dumping massive amounts of very high quality steel in Europe for years as part of a concerted effort to kill of European steel manufacturing. Small-minded people ignore this; precious few see this as a move by China to ultimately force up the price of steel in the long term, once the West has dismantled local production. Only now are Western governments realising that, hang on, European countries are right on the precipice of losing all the steel-making plants that produce the materials needed for e.g. military armour such as the sort used in tanks and heavily armoured vehicles.

This isn't one thing... This is a perfect storm of insanity and malice. And it likely won't end well for the UK/Europe/West.

Britain seeks views before it drops the hammer on signal jammers

Sproggit Silver badge

Curiously, one area where I would *like* to be able to use a signal jammer - for the record I don't possess anything of the sort - would be to defeat drones. We seem to get more than our fair share where I live and through the warmer months there seems to be no shortage of the things patrolling back gardens. It was one of my neighbours who said - I suspect correctly - that most are probably being flown by pre-pubescent boys scanning for topless sunbathers... but they also seem to be being used with increasing frequency by conventional burglars looking to "scope out" a potential target.

I think it's pretty well established that it's illegal to shoot down a drone (with e.g. a shotgun, even if you hold a firearms license), but that does nothing to safeguard the general public from malicious use of drone tech.

Raspberry Pi leans into semiconductors as sales climb – especially in US and China

Sproggit Silver badge

Meanwhile...

... and I know this isn't an R-Pi "problem", but on "The Pi Hut" web site today, Easter Monday 2026:-

Pi4B 4Gb RAM - £96

Pi4B 8Gb RAM - £158.40

Pi 5 4Gb RAM - £105.60

Pi 5 8Gb RAM - £168

Pi 5 16Gb RAM - £292.80

I bought a Pi 5 16Gb from them on April 1st last year and paid £137.88 for the Pi 5 and £13,63 for an Aluminium Armor Heatsink case for it.

So the price of the Pi5 16Gb has gone up by 112% since this time last year.

I'm not suggesting that either the foundation or ThePiHut are scalping... but I do think that what is happening with RAM and storage prices at the moment are going to combine with the growing oil crisis and cause untold damage to businesses and the world economy.

Forking frenzy ensues after Euro-Office launch sparks OnlyOffice backlash

Sproggit Silver badge

Meanwhile, CollaboraOffice for Mobile...

... absolutely sucks.

I suppose there might be a myriad of reasons why the folks behind Collabora Office seem to be trying to take a new direction with the core code on desktop platforms.

But I am the only one who would much prefer that they simply focus their energy on making Collabora Office for mobile a [much] better product? Using the native "QFile Pro" application for iOS and Android, I can access all the files held on my QNAP NAS hosts... and using Collabora Office I can sort-of view them...

But the interface is clunky, it's not possible to make edits [access is read-only] and even basic things like rendering a spreadsheet on screen are so slow and broken that it makes scrolling almost unworkable.

It feels like one of those "first remove the plank of wood from your eye before you try to remove the speck from mine" kind of moments. I don't begrudge Collabora the freedom to explore the desktop platform if that is what they want to do. But I'd much prefer that they did it *after* sorting out their mobile solution - and without taking pot-shots at the team that made it possible for them to pick up and use the code in the first place...

Sproggit Silver badge

Re: "but that's a side-effect, not the main thrust."

I think your comments, specifically, "Stallment wanted it [sic] software for free, and kill commercial software development because he didn't make a living by writing software and selling software", is not only factually wrong, but completely disingenuous.

The history behind the GPL is pretty well documented. See for example here:-

https://medium.com/curious-burrows/the-story-of-open-source-so-far-bfcb685d85a4

The actual origin of the GPL and the free software movement happened because of a faulty laser printer. The MIT Lab where Stallman was working in 1980 installed a Xerox 9700 laser printer, which turned out to be a bit glitchy. Stallman hunted down the engineers at Xerox and asked for a copy of the software so that he could modify it to deal with the glitch, but was told by a Xerox employee that they were unable to share the software because it belonged to Xerox and the company didn't want to disclose the code.

He spent a bit of time working through what a viable solution might look like, then in September 1983 announced a project to create a free operating system, that would be called GNU.

The rest, as they say, is history.

I hope you don't mind me correcting you here, but the distinction is really important. Your post suggested that Stallman sought to undermine people who did "make a living by writing and selling software", but this is also factually wrong. Most of the major contributors to the GNU/Linux ecosystem work for "other companies" - you can look at Linus Torvalds employment history and see that - and their employers allow them to spend time on open source projects because it brings benefits to the company for them to do so. Most of the major "Open Source" companies - like Red Hat or Canonical - operate as commercial entities, selling support. They seem to be pretty successful.

Open Source and profitability are not mutually exclusive.

Cryptographers engage in war of words over RustSec bug reports and subsequent ban

Sproggit Silver badge

Re: Rust cult

I appreciate this may not be directly related to Rust, but if you haven't already watched it, I'd recommend that anyone reviewing this threat hops over to YouTube, located the Channel, "Veritasium", and watches their video from 3 weeks ago, entitled, "The Internet Was Weeks Away From Disaster and No One Knew".

The TLDR; is that the video discusses events relating to a single individual, responsible for maintaining a subfunction, XZ, used for lossless compression, which was a personal passion project for that lone developer, a Finnish guy called Lasse Collin. Their story describes the way that Collin was bullied over a period of time about accepting patches to his code, until eventually a guy calling himself "Jia Tan" offers to help.

Turns out that Jia Tan did more than help - [s]he basically corrupted the XZ package by hiding malicious code in test files and then harrassing major distributions to accept his code and push it in to their next releases. The discovery that the code had been compromised was a sheer fluke - and when that happened "Jia Tan" vanished like a puff of smoke in a gale.

The way this article is describing the harrassment at the heart of this story - and the fact that the Veritasium article revealed the way that an absolutely catastrophic vulneraiblity could have been introduced in to pretty much all servers running the Linux kernel gives an idea of just how serious the compromise could have been.

I have to wonder if the backdrop to this story is another attempt at either protecting an existing vulnerability - or perhaps introducing a new one - in a code library used by e.g. Signal. Don't know enough about the code to comment on that.

But I think what's interesting about this story is the lack of clarity and lack of transparency with which this possible issue was dealt with.

From the article it definitely feels like "sunlight is the best disinfectant". Get it all out in the open. Invite specialists to review the code. Make sure that lessons are learned.

The Veritasium video is about 53 minutes long, but if you have a decent grounding in basic crypto you can skip the first 15 or so.

Well worth a watch...

Ofcom: Rule change to force UK comms providers to tell you when your contract expires

Sproggit Silver badge

Is This Progress?

Ofcom legislation passed in 2002 and it really came into being as a regulatory body in 2003. We've had mobile phones and broadband and similar technologies for at least as long.

Has it really taken Ofcom 18 years to figure out that the providers are basically serial abusers?

Ever tried raising a concern with them? They're basically useless.

Microsoft picks a side, aims to make the business 'carbon-negative' by 2030

Sproggit Silver badge

Start with Code Efficiency

It is not without reason that certain Microsoft products have become known as, ahem, "bloatware". Whilst it's easy to point the finger their way (Clippy, anyone), one of the trends we've seen from Microsoft as they seek to justify upgrades to new products is to add "features" such as "animated toolbars" which provide zero productivity benefits, but take much more resource [disk for the code, electricity to execute] to provide the same functionality to the user.

So I'm going to applaud Microsoft for making this commitment, but they need to be very clear what the world expects from them in return. They need to remove the faff and bloat from their products.

In fairness, to Redmond, Microsoft are not the only culprits who need to get that memo.

As my works laptop gets a bit long in the tooth, it is becoming more and more useful for sniffing out bloatware: anything that wastes CPU cycles typically forces the cooling fan to kick it up a gear. Chief culprit? Google Chrome [have no choice: mandated by Corporate - we have to use it]. That software is a pile of utter garbage: slow, a ridiculous resource hog for both member and CPU... but it doesn't render pages any faster or more accurately than, say, Firefox.

So yes: well done Microsoft... keep up the good work. Oh but by good work, we mean carry on stripping out the needless bloatware and give us something that just works.

What's that you say? Someone has already done that? Splendid. Ah, right. LibreOffice on Linux Mint. Right you are.*

* Simply the best platform... and if you don't like Mint's Cinnamon or Mate desktops because they are too "resource hungry" for you, by all means just use xfce or fluxbox. Simples.

Another rewrite for 737 Max software as cosmic bit-flipping tests glitch out systems – report

Sproggit Silver badge

Re: So...

The Max would be better described as an all-new aircraft, disguised to look like a 737 in the hope that the FAA would fall for the ruse and allow Boeing and the airlines to train the flight crews with nothing more than a differences course provided in an iPad.

The Max is no more a 737 variant than a Mack Truck is a variant of a Ford transit.

Basically, when Boeing came to refresh the 737, they wanted to provide significantly improved fuel economy, to counter the much newer and better performing aircraft from Airbus. The problem? They could only do that by fitting new engines. Engines that are so much larger than the previous generation that the Max had to be fitted with extended landing gear to stop the bottom of the new engine cowlings scraping along the runway.

But the problems ran so much deeper than that. The larger diameter engines moved the centre-of-mass of the engines lower. Which moved the centre-of-mass of the aircraft. Which meant not only that the flight surfaces were the wrong size and in the wrong place, but that the entire flight geometry of the aircraft was screwed up.

In a conventional airliner, the flight characteristics [in flight trim] should be level flight. Let go of everything and the aircraft should jut fly along, straight and level, until the fuel runs out. With the Max, that was impossible, because the mass of the new engines screwed up handling. So Boeing invented "MCAS" to generate a completely fake flight characteristic for the aircraft. Just like the F-16 is fly-by-why and inherently unstable [cannot fly without the computer], so the Max used MCAS to keep the thing stable when it would otherwise not be.

That's why the partial failures of the MCAS system caused such catastrophic failures, even when the pilots followed the correct procedures.

There were other issues, for example the MCAS design changed significantly during development, but when the plane was tested for certification, the old design limits were tested, not the new, more aggressive ones. And of course the inspectors were Boeing employees, recruited and paid for by Boeing, not independent FAA inspectors. In other words, serious regulator capture issue, right there.

Ultimately, though, the crashes were caused by greed. Airlines didn't want to pay the additional cost of developing an all-new replacement for the 737. Threatened with loss of sales to rival Airbus, Boeing chose to cut all sorts of corners and basically ended up pushing an old design too far.

In the heart of Boeing are engineers and designers who are brilliant at what they do. These issues aren't "engineering-led", but "management-led". Congress should order the FAA to step aside and have the relevant House Committees conduct a thorough hearing. The House should demand access to internal emails, summon witnesses from engineering and management and fully understand how the series of questionable decisions that led to the Max being certified came to pass.

But there's an interesting fly in this ointment. Unlike aviation regulation agencies elsewhere in the world [say the CAA in the UK as an example] the FAA has two roles. One is to inspect aviation and ensure that it remains safe for the public. The other is to promote the use of aviation to the nation and the world. Those two missions are in uneasy conflict.

You only need to look at recent history to realise that the FAA were one of the last agencies to order the aircraft grounded to see the impact of poor governance.

Bottom line is that Boeing are too important for balance-of-trade to take a serious Congressional hit for this. Especially with the serial failures the current administration have with trade deals. Expect this one to be swept under the rug in due course.

Royal Bank of Scotland, Natwest fling new bank cards at folks after Ticketmaster hack

Sproggit Silver badge

Force Change

Last year I was unfortunate enough to be caught up in the NewEgg shopping cart malware issue... Apart from a couple of notifications I received from them, along the lines of "Hey! Guess What? We've been hacked! Fancy that...", I've seen or heard nothing from them.

However, I did immediately call my bank (Bank of Scotland) and demand a replacement card for the one used on the NewEgg site. At first they did their best to talk me out of replacing my existing plastic, suggesting that I could just keep an eye on transactions and call them if I saw anything suspicious. At that point I suggested that if they didn't want to send me a new card, pronto, I would happily cancel my card account there and then. Funny old thing, they changed their mind...

During that process (it was, for me, the first time I've been involved in a potential loss of my card details), I made careful notes of all the places I had to contact (those I remembered on the day and those that were identified during the subsequent sweep-up) to change my details. I now have that list, which I can re-use when needed.

The reason my bank tried to talk me out of getting a new card was because it costs them to do so. If you are involved in anything like this, DEMAND an immediate replacement of your card. No bank can reasonably refuse - and you should not be doing business with one that tried to refuse you. The reason is simple - the more of us that demand that banks do this, the greater the expense to the banks from having to. It's only when the cost of having to continually re-issue cards reaches a point of irritation that banks will actually bother to do anything about it.

For example, for those with smartphones [such as those with smartphone banking apps] there is no technological reason that your bank could not include, with your mobile banking app, a piece of software that generated a one-time pad that could be used with all card purchases, among retailers who supported that use... This would mean that instead of using a fixed 3-digit CV2, the number could be 4, 6, or 8 digits and would change with every transaction... This one change is not it itself a cure-all (your phone can still be stolen or lost) but it makes it incrementally harder for criminals. For non-smartphone users, banks could issue hardware tokens...

The cold hard truth is that card fraud hasn't yet reached the level where it's hurting the banks. Until it does, we won't get a more secure solution. If, by demanding our rights, we can accelerate that process, we stand to benefit through (significantly) reduced risk of being defrauded or inconvenienced if we're unfortunate and have our card details compromised.

Hit them where it hurts - and they will do something about it.

Shortages, price rises, recession: Tech industry preps for hard Brexit

Sproggit Silver badge

Re: And all we can do...

When David Cameron won the General Election in 2010, he got a solid majority in the House of Commons on 44% of the popular vote.

Nobody complained.

When the Referendum took place, the Prime Minister and the Remain camp used public funds to advertise, used public funds to perform a leaflet drop to every single household in the UK - and still the final result was 52% in favour of leaving the EU.

Whether you support the outcome or not, it is critical that participants respect the democratic process. The numbers voting in favour of leaving the EU significantly exceeded those voting for the party that has won any of the general elections in my lifetime, yet I don't recall a single GE result being challenged.

Going in to the Referendum it was made very, VERY clear that it was a one-time vote with a binding result.

It really is time to accept the result and move on.

MI5: Gosh, awkward. We looked down the sofa and, yeah, we *do* have intel on privacy bods

Sproggit Silver badge

Nature of the Debate

We have to be careful here, because it is easy to be drawn in to a debate where the context of what is being discussed has been defined before we have a chance to look at it and agree to it.

In this case, the context needs to be an answer to the question: "What level of intrusion on personal privacy is acceptable in the defense of things like personal safety, the Defense of the Realm, etc?"

Ultimately, this is a risk-based decision. When a bank agrees to let you have a credit card, they weigh up the potential for making profits from you against the potential risk you pose if you run up a debt you cannot pay back. So when we as a society make a decision about the surveillance powers we are willing to give to our Security Services, that needs to be on the back of a clearly defined risk or threat.

The problem that we have with this entire debate is that any interest by citizens to become engaged in the debate is met one of three ways:-

1. A pat on the head and a condescending smile as we're told not to worry our pretty little selves about it, Nanny State has got this covered...

2. A sneered response that this sort of topic is discussed on a need-to-know basis - and that we don't need to know...

3. A stern frown and a knock on the door only to be asked to accompany someone away for an "interview".

Everything our governments do for us - *everything* is paid for by taxes that we pay. Our government is supposed to serve us - it is where the terms "Public Servant" and "Public Sector" came from. Unfortunately, in an increasing number of areas, governments the world over seem to view the electorate as the enemy.

Sproggit Silver badge

Re: GDPR

Not it's not. See here:-

https://www.itgovernance.co.uk/dpa-and-gdpr-penalties

To quote:-

What is the maximum administrative fine under the GDPR? There are two tiers of administrative fines that can be levied as penalties for non-compliance:

Up to €10 million, or 2% annual global turnover – whichever is higher.

Up to €20 million, or 4% annual global turnover – whichever is higher.

NSO Group bloke charged with $50m theft of government malware

Sproggit Silver badge

If you run a company that found ways to defeat, say the encryption on a DVD or BluRay, you will be prosecuted by music and movie studios and bankrupted.

If you run a company that finds ways to defeat the security and integrity of computer operating systems, including the way that those systems protect encryption systems, you can make a lot of money from selling your exploits around the world to the highest bidder.

And governments wonder why the general public doesn't trust them.

'Plane Hacker' Roberts: I put a network sniffer on my truck to see what it was sharing. Holy crap!

Sproggit Silver badge

Insurance Black Boxes and the GDPR

I am not a lawyer.

It is possible - just possible - that the inclusion and use of black boxes [such as those fitted in cars by manufacturers] may fail various tests within the GDPR.

Firstly, if it could be shown that the vehicle can continue to function without having to "phone home" large amounts of data, then provisions around the "lawful basis for processing" might come to bear.

Secondly, it is likely that the processing being performed would fail the "transparency" provisions.

Third, I'm not aware of any vehicle manufacturer [this is not true of insurance companies, as a previous post notes] which allows the owner of a vehicle to "opt out" of the data collection.

As others have stated, a significant part of the basis for determining whether or not this data slurping is legal will pivot around vehicle ownership. If you are a company car driver or your vehicle is part of a lease fleet, you are almost certainly out of luck. However, the same is likely to be true if you are buying on any form of credit or hire purchase deal, at least until the vehicle is fully paid for and entirely yours.

But this last scenario brings in another question. Suppose the dealer from whom you buy a vehicle on credit decides to fit extra electronics [i.e. tracking] to the vehicle in case you abscond with it. What happens when you make your final payment? Does that tracker get removed? Can you demand it?

This is going to be a very murky world of conflicting legal opinions until sufficient case law has been hammered out to make sense of it. Even then, I just can't see this going well for the private motorist that doesn't want to be spied upon. The temptations [for manufacturers and governments] are simply too great.

We need to talk about mathematical backdoors in encryption algorithms

Sproggit Silver badge

A Matter Of Perspective

One of the things that is all too easy to overlook when considering "safe" cryptographic algorithms from unsafe ones is that, fundamentally, this can simply be a matter of perspective.

I recall the anecdote from the development of the 3DES algorithm. Triple-DES, or 3DES, is a block cipher, meaning that it takes messages, "chunks" them into fixed-lengths blocks, then encrypts the payload.

When the algorithms were being developed, a shortlist [I think it was a set of four] were provided to the NSA for review and comment. After a relatively brief interval, the response came back, "You can use these three, but not this one..." The submitters were baffled: they had tried their best and honestly felt that each of the submitted candidates were as good as the rest.

*Years* later - having been given the enormously helpful clue from the NSA that there might be something suspect with #4, a flaw was found.

This anecdote is relevant here because it shows that what even a well-practiced security researcher can think of as robustly secure can yield to the level of scrutiny that the likes of NSA and GCHQ can bring to bear. This isn't to say that in many [most] cases that extrinsic, peripheral or side-channel data won't be instrumental to a successful crack, only that 99.999% of us [and I include myself in that category] simply can't comprehend the resources and abilities that defence agencies can bring to bear if they so choose.

My 2 cents: work on the basis that everything you exchange cryptographically can be read with relative ease and you won't be too far wrong.

Linux kernel hardeners Grsecurity sue open source's Bruce Perens

Sproggit Silver badge

Re: Seems fine to me

I think I sort-of agree with you. If I understand Bruce's argument, what he is saying is that the GRSecurity patches simply cannot run without the Linux Kernel. Therefore, if GRSecurity apply restrictions to their software, then the moment their software is linked to a kernel, those restrictions apply to the kernel too [because post-link, the software is inextricably tied together].

So Bruce's argument is that whether they realise it or not, GRSecurity's restrictions are being de-facto applied to the kernel, whether GRSecurity realise or not.

Having read through the materials, it looks as though GRSecurity are arguing that their restrictions apply to their code only, but Bruce is saying, "That's not technically possible, because of the way that your code works..."

But then, I'm neither a kernel programmer nor a lawyer, so you likely shouldn't pay much attention to me !!!

Watch: SpaceX Dragon capsule breathes fire during crucial hover test

Sproggit Silver badge

It Makes Sense Though...

If you think about the challenge of deceleration from a purely "basic physics" perspective (i.e. conservation of momentum), then the heavier the capsule, the more energy it will take to decelerate it, using

F=ma

So by ejecting the heatshield before the decelerative burn, you are basically going to get a greater velocity change [through the deceleration] for the same energy [fuel] cost.

Linus Torvalds lashes devs who 'screw all the rules and processes' and send him 'crap'

Sproggit Silver badge

Bingo!

I regret that I have only one up-vote to offer you.

But you're *so* right...

SYSTEMD = Screwed Your Machine 'Til Everything's Maliciously Destroyed.

2009 IBM: Teleworking will save the WORLD! 2017 IBM: Get back to the office or else

Sproggit Silver badge

It's Like The Tide...

... sometimes it is rising, other times it is falling - it remains motionless for very little time indeed.

There are all sorts of reasons that a company might move towards or away from home working. Of all of them], however, the most likely is simply that a new executive has come along and, wanting to make an impression with their seniors, has elected to instigate a new working practice...

I've watched a single IT Organisation, over the course of 20 years, adopt:-

1. A Product-Centric View

2. A Customer-Centric View

3. A Process-Centric View

4. Global Management and Reporting

5. Local Management and Reporting

6. Matrix Reporting

Without exception, each change aligned with new senior management. Each change took on average two years to implement. Each change was announced less than 6 months after "Mission Accomplished" was declared on the previous process [an act which accompanied the departure of the sponsoring executive].

In most cases the declared 'victory' was an outright lie.

People who have not worked for a company the size of IBM might fail to grasp how employees can become institutionalised, or how fiefdoms develop, how little "Cottage Industries" will pop up all over the place when a service previously provided centrally is eliminated due to "cost savings", only to have an executive admonish the supervisors who "just got on with it" and promptly stand up a central function, usually populated by upstart wannabes who want the promotion more than they have the ability to do the job right....

This is office politics, plain and simple. The declarations and claims being made, that black is the new white, up is the new down and in is the new out is just a load of fluff.

Nothing to see here, el Reg. These are not the improvements you are looking for... Move along, move along...

Ex-FBI man spills on why hackers are winning the security game

Sproggit Silver badge

Bunkum

If it is possible to ignore the atrocious grammatical errors in this piece (el Reg, if you allow your journalists to post articles without being proof-read, then shame on you), then the underlying premise of this article misses the point...

There are several reasons why institutions continue to be vulnerable to hackers, but these are typically:

1. The institution does not understand the actual threats they face. Try and explain to them that the Severity of a Threat = Probability of Occurence x Impact of an Event and you will get a puzzled expression in response...

2. Business Executives undermine security best practices. Have a developer ask a business sponsor, "Would you like me to implement this new feature you have asked for, or would you like me to fix these 5 vulnerabilities?" and too many times the answer will be to request the new feature...

3. Institutions pander to the egos of "key developers" and/or have a cape-and-boots mentality when it comes to fixing issues. Go round any large IT shop and look at the diversity of technologies and architecture in use and you will quickly realize that this stems not from mergers but from arrogant developers or architects insisting on using the latest whizz-bang technology on their project. This is "resume architecture" - if it will look good on your resume, put it in the architecture requirements of your next project. Allowing this to happen will generate a heterogenous technology infrastructure that allows bugs to lurk unseen for years. Then, when thing go wrong, the same organization rewards the person who dons the cape and boots and swoops in to the rescue (when others were floundering) when they should be punishing the same person for failing to document a project properly in the first place...

You get the point...

Over the last 20 years I have spent much of my career being parachuted in to Organisations immediately after a major incident. - and 9 times out of 10 the root cause is idiocy....

1. Ignorance of Threats

2. Executives putting personal agendas ahead of common sense

3. Failing to patch known issues in a timely manner

4. Allowing the unqualified to purchase security toys, I mean tools

5. Needlessly complex infrastructure

6. Lack of Testing

7. You get the picture...

None of these issues are new. We've all seen them. Yet they keep biting Organisations where it hurts - and what's worse, unscrupulous snake oil merchants.... sorry, IT Security Product Vendors, will continue to peddle their snake oil, sorry, security tools, to ignorant middle management.

Ubuntu Linux daddy Mark Shuttleworth: Carrots for Unity 8?

Sproggit Silver badge

Agreed

It was the combination of the enforced switch to Unity and then Shuttleworth's decision to start selling your local search terms to Amazon that drove me away from what had always been a solid distro. 12.04 was my last ubuntu system and whilst it was good, I don't miss it.

IMHO the single biggest mistake that Shuttleworth made was forcing Unity on people before it was ready. I am sure that his reasons were benign - i.e. getting more people to test the code - but it was not ready for GA release and should never have been allowed to be the initial desktop. Especially as the ability to add an extra desktop and then select which at log-in time is so trivially easy...

However, what disturbs me is the way that Canonical seem to have unilaterally disregarded all other work in this space, thrown all their toys out the pram, and not attempted to collaborate with other projects in this space. As a previous poster has pointed out, it's not like there has been a shortage to choose from. It's clear that the motivator was to get a single interface across multiple platforms, come hell or high water...

My only question would be: what were the numbers of people either 1) asking for this; or 2) likely to actually use it? I suspect very few - and that this was, in effect, a vanity project sponsored largely by Mark's undeniably deep pockets. Well, I won't knock that - he's doing what he wants with his cash...

Can't help wonder, though... what could Canonical have turned to if they had listened to users? For a start I'd like to see someone offer us a viable alternative to systemd... Tried that with Mint 18.0 on my system - endless issues with hardware, resulting in a wipe and re-install of the bulletproof Mint 17.3...

China gives America its underwater drone back – with a warning

Sproggit Silver badge

Re: Lying so-and-so's - Historical Precedents

In 1982, the United Nations Convention on the Law of the Sea established the "12-Mile Limit" as the maximum extent of territorial waters. See here:-

https://en.wikipedia.org/wiki/Territorial_waters

Whilst this ostensibly looks to be like a round of posturing between China and her neighbours - perhaps an attempt to set up some form of enforceable "exclusion zone" around the Chinese mainland, this is almost certainly not the case. It is much more likely that China know or suspect that area of ocean floor to contain some form of mineral wealth which China believes can be extracted, either now or in the short-medium term future.

In considering this it is worth comparing the strategies adopted by both China and the US when it comes to securing access to resources [energy, minerals, food, ec] around the world. Over the last few years China has moved to cement numerous deals across Africa and South America; building partnerships, making purchases - even manipulating markets [such as dumping cheap steel across Europe to kill off the European steel industry] - where it believes it appropriate to do so.

The United States has taken a different approach; it has adopted a two-headed strategy that comprises control of financial markets and on the introduction of wide-reaching trade deals. The trade deals in particular, are deceptively powerful - for example the way that they impose things like acceptance of Software Patents, or giving the right to [US] companies to sue other governments if those entities issue laws that would harm the profits of US corporations.

What is unusual about the events unfolding in the South China Sea is that no proxies are involved; these are moves undertaken directly by the super-powers. Whilst Saudi Arabia and Iran have been fighting proxy wars in the Middle East for decades, it looks as though the US and China have moved on to something a little more direct.

We live in interesting times, in the original sense of the phrase.

If only our British 4G were as good as, um, Albania's... UK.gov's telco tech report

Sproggit Silver badge

Maybe Incentives Would Work?

For as long as I can remember, we [largely the peoples of most western, democratic countries] have been told that "market forces" and "commercial competition" are the best, most effective and efficient means of driving up standards and driving down costs.

Yet here is another example of a spectacular failure in this regard. There could be many causes : inept regulator, collusion, corruption, a cartel of major providers, etc, etc. Frankly, it doesn't matter what it is.

What matters is that the controls, safeguards and processes intended to protect consumers are clearly not working. That's bad enough, but even worse, nobody in authority is doing anything about it. Where is Ofcom through all this?

When the 5G spectrum comes up for auction, we can anticipate that all existing providers will bid for a slice of the service, because they want to grab the profits on offer from the big metropolitan hubs such as London, Manchester, Birmingham, Liverpool, Southampton and so on. But they won't be interested in outlying regions with fewer clients. This is what the Regulator is supposed to be dealing with - to protect those of us who live in rural areas so that the big corporations don't cherry-pick the profits and leave everyone else. Buses, supermarkets, wired broadband, mobile phones.

So what we need - what we have every right to expect - is for OfCom to refuse to grant 5G licenses to any provider that doesn't meet basic minimum criteria for coverage and quality for the existing services.

Oh, wait. That's too sensible. Sorry, forgot.

Citizens Advice slams 'unfair' broadband compensation scheme

Sproggit Silver badge

If Only OfCom Did What They Were Paid For...

Sorry for taking us a little bit off topic, but the issue here isn't just compensation when parts of the nation's communications infrastructure fall down in a dysfunctional tangle [although that's frustrating enough].

Another one of the issues concerns their misleading malpractice when it comes to handling line speeds. We've all seen the advertisements offering speeds of "up to" 45Mb/s or "up to" 75Mb/s and so on, only to end up with actual line speeds that are 1) nothing like as good; or 2) prove to be unreliable...

So how about OfCom introduce a new and simple rule that says: "If a telco wants to charge a unit price for a 45Mb/s service, but can only offer a slower speed, then the maximum price they are allowed to charge has to be pinned to the (percentage) ratio of the actual speed to the claimed speed."

Or to put it in simple terms: If a telco offered you a 45Mb/s service for say £20/month, but then only managed to provide half the speed [22.5Mb/s] then the maximum they can charge you for the service is £10/month.

One of the reasons that this would be a good idea would be that it would give the telco companies the necessary incentive to deal with degrading and/or poor quality lines, because the slower the modem speed at the client, the lower the income for the telco...

Ultimately, the reason most of us get such shoddy service from the telco companies is because the regulator lets them get away with it.

Virgin Media costs balloon by MEEELLIONS in wake of Brexit

Sproggit Silver badge

Not Entirely Fair...

Yes, the value of Sterling dropped in the wake of the referendum result in June.

However,

1. The U.K. has not even triggered Article 50, let alone left the EU, so half your statement is wrong. If you had said, "due to sentiment" you would be closer to the truth.

2. Most of the post-referendum movement in Sterling (all...) has come from currency speculation. On Black Wednesday, when Norman Lamont pulled the UK out of the Exchange Rate Mechanism, American Investor George Soros made over $1 Billion by shorting the Pound. In June, many people, including Soros, tried to repeat the trick. The drop in Sterling has been caused by speculators, plain and simple.

I have ZERO interest in the Brexit decision either way, but I do think it is important that we're clear on these points...

A quarter of banks' data breaches are down to lost phones and laptops

Sproggit Silver badge
FAIL

Conflated Issues

You're mixing up your stories in an attempt to make this sound more relevant than it is...

For example, you quote the 2014 JPMorgan breach, which was the result of a hack of servers and nothing whatsoever to do with phones or laptops.

The same will likely be true of most, if not all, US companies. This is due to a Californian "Data Breach Reporting Law" that requires any institution that experiences the loss of non-encrypted data relating to clients to notify those clients - a requirement that now applies across the US. As a result of that one piece of legislation, most US banks [i.e., read : "ALL"] instigated processes to ensure that EVERY company-owned mobile asset [laptop, Blackberry, etc, etc] met the minimum encryption requirements, so that the loss of an item explicitly *didn't* trigger data breach reporting requirements.

That being the case, how could your article be based on any solid facts - given that the law explicitly excuses organisations from the need to go public with that data?

Banking system SWIFT was anything but on security, ex-boss claims

Sproggit Silver badge

Bunkum

This is some aspirational PR fluff from a former SWIFT employee who left their role as CEO 9 years ago. A lot happens in 9 years...

It used to be that connections to SWIFT were only granted to major banks, via dedicated leased lines and wrapped in security. Now, SWIFT themselves will give direct access to large companies, using a VPN solution and Microsoft Windows based software...

SWIFT were greedily eyeing the income that banks were making from handling high-value international trade payments between large companies and figured they wanted some of that for themselves, so they tried to cut the banks out of the loop and go direct.

Oh, and the CEO thinks that there were security issues connecting "smaller banks" ???

Yeah, right!!!!!!!!

Why do I get the impression that there's a dirty little story waiting in the wings to come out, and this is a pre-emptive PR strike?

McCain: Come to my encryption hearing. Tim Cook: No, I'm good. McCain: I hate you, I hate you, I hate you

Sproggit Silver badge

Re: Theatre. Nothing more.

McCain is stupid, no doubt about that. But even he is not so stupid as to risk offending one of the leading CEO's of Silicon Valley. Had McCain decided to "bully" Tim Cook into showing up, that would have been enough to unite all the Tech CEO's against the Republicans.

That's a lot of lobbying money and campaign contributions that would have walked out the door, right there.

The GOP would never have let McCain be so stupid.

Watch as SpaceX's latest Falcon rocket burns then crashes

Sproggit Silver badge

Scale of Expectation

The thing that I can't help remembering is that we have barely recovered from "Shit! That dude just put a satellite into space and then *landed the first stage in one piece*!!!" As if that wasn't enough, then we got, "Incredible! Now he's landed on a floating, ocean platform!"

The thing about SpaceX is that unlike, say, Blue Origin, they are willing to fail publicly, fail early and fail often. I remember when they lost a first stage on an earlier flight and their telemetry showed that they had actually run out of hydraulic fluid (because the rocket systems doesn't recycle the stuff). Musk fixed that with a bigger tank for hydraulic oil for future flights... Key thing being, they learn every time...

As SpaceX become more successful, so we seem to be ramping up our expectations of perfection for each launch. Isn't that a little unfair? SpaceX have delivered more innovation in the last couple of years than the likes of the US, Russian, and other space programs managed in the last two *decades*... What really impresses is their rate of learning.

For sure they will be much more conservative when it comes to manned flight, but the simple fact is that NASA has made literally hundreds of launches yet it didn't even *occur* to them to try what SpaceX have done and have made work... You have to wonder what Mush could achieve if given the same budget that NASA spent on the Shuttle orbiters...

Microsoft planning blockchain-as-a-service for Azure apps

Sproggit Silver badge

Re: Just wondering

The falsification conditions come up as a result of the way that blockchain works. Basically, as the name suggests, this is a public ledger with the use of mutual digital signatures to agree transactions. The problem comes in the way that the blocks themselves are managed. I am going to simplify, largely because although I read through it in detail, that was a while ago and I am not confident of my ability to relate the key points accurately.

When you have large numbers of disparate parties all attempting to append a transaction to the same block in a chain, you are going to get scenarios where there are atomic failures at the transaction level. For example, suppose there is one free slot in a block and two or more parties try and use it. Only one will succeed and the others will fail. The entire blockchain is designed to handle this using a mechanism analogous to the 2-stage commit of XA-comliant systems... However, it does this, at least in part, by allowing splitting of blockchains and downstream conflict resolution of scenarios such as the one I described above.

But what happens if you and I have a transaction thrown out and then, we it's time to re-submit, I decline? This is [as I understood it from the read-through] an extremely narrow scenario that is virtually impossible to predict in advance. When all the potential conflicts and block splits are resolved and confirmed into the chain, then a transaction is deemed "guaranteed". However, there exists a narrow window of time between when the transaction is written to the block and when it is fully committed, in which another user/transaction source could challenge/trump that commit and force a do-over.

I think that's the "almost impervious to falsification" bit, if I understand it correctly...

For what it's worth, people are predicting that we need to change the underlying architecture of Bitcoin because the collision scenario I describe will only get more prevalent as more people use it. There appears to be something of a tussle underway in the BC community on this very point...

Get outta here, officer, you don't need a warrant to track people by their phones – appeals court

Sproggit Silver badge

What About Privilege?

Does anyone happen to know if the ruling is a blanket statement or narrow in effect? Specifically, if the ruling were applied as it is written in this article, then the en banc review just found that client-attorney privilege is not protected from a warrantless search by a duly authorised law enforcement officer.

This is one of those relatively infrequent events where a ruling that could be used to set case law can, on the face of things, look to upset other, established, legal principles.

Given that appeals rulings are considered powerful arguments in case law - i.e. they are illustrations that one legal team can use to influence a court if they think the ruling favours their point of view - it is critical that the scope of the ruling is appropriately defined. Even if a complete overturn of the ruling is unlikely, don't be surprised to see another appeal here. If the ruling is written as loosely as the article hints, well, that would be bad.

Apple bans benign iOS spyware detection, security info app

Sproggit Silver badge

Quite Simple Really

Without this application running on your iOS device, it would be possible for Apple to run whatever they want on your handset without your knowledge.

We've seen a number of unsubstantiated reports over the years that odd things happen to existing Apple handsets when new models are released. I'm not saying that there is any truth to the stories, but they are absolutely out there. Now *if* there were any truth to those rumours, the application as written would be able to provide concrete evidence of a handset's performance being "tweaked", because it would show which processes were taking up CPU cycles and/or memory...

SpaceX adds Mars haulage to its price list

Sproggit Silver badge

Practicalities

Thinking about the successful First Stage landings that we've seen from SpaceX so far (3), it's obvious that Elon Musk is pushing his domestic program to learn enough to be able to safely land the Red Dragon on Mars.

Now, you *could* do all sorts with that, including carry payloads for the likes of NASA and other agencies, such as rovers and the like. At the moment I do not see much in the way of commercial demand for landing payloads there, but would love to be proven wrong.

Where this gets interesting, however, will be the work done in preparation for a human landing. We have already seen how SpaceX uses "spare capacity" to push their design envelope and experiment with new technology. You can bet that if anyone wants to send a partial payload to Mars, then SpaceX will take the order and pack every gram of spare capacity with their own experimental gear. Even if the rockets carry nothing more than spare materials or tools then it will be worthwhile.

The true genius of SpaceX and Musk has been the way they have got their current customers to pay for their R&D in such an efficient way. Don't expect that to stop any time soon.

Experian Audience Engine knows almost as much about you as Google

Sproggit Silver badge

Is This Legal Under The DPA?

Maybe it has changed, but I thought that when the UK Data Protection Act was passed in 1998, one of the provisions introduced was something that basically said, "Data gathered and used for one purpose cannot then be re-used for a different purpose without the permission of the data subject..."

In other words, Experian might be able to harvest your data to determine if you are credit worthy, but that does not give them the right to sell that data for marketing purposes without your explicit permission...

I may be wrong - can anyone here clarify please?

Stop resetting your passwords, says UK govt's spy network

Sproggit Silver badge

Re: Too Many bad Movies

With specific reference to your comments regarding defense against brute force attacks... Maximum attempt limits are a great way to allow an attacker to perform a denial of service attack against the your legitimate users. And to those who are reading this and thinking that they would simply include an ever-increasing retry delay to thwart automation of this attack: remember that likely 90% of existing authentication platforms out there simply don't have that functionality... So good luck with adopting that as protection for ooh, say, your platform administration accounts...

SpaceX's Musk: We'll reuse today's Falcon 9 rocket within 2 months

Sproggit Silver badge

Capture Mechanisms

I guess the hardest part about the application of a capture mechanism is going to be the need for safety. {I don't know, but I am assuming that "Of Course I Still Love You" has no human crew at the point of capture.}

That being the case, perhaps Musk can adopt some technology from his "other" company. Tesla have already demonstrated the "self-attaching charger snake" - i.e. that robotic unit for your garage so that you can get out of your Model S at your front door, only for the car to park itself and attach the charger without help...

Now, with a few examples of that, strengthened and suitably scaled up in size, there has to be a way that Tesla could mount a selection of those around the edge of the landing platform in such a way that they can be swung in to place.

In the descent phase, the 1st stage rocket pops out some small flaps at the upper edge [where it separates from the second stage] that act as drags to keep the motor oriented and descending "rockets pointing down". The same mechanism that is used to pop open those flaps might be able to pop out and reveal some anchor points for robotic, self-attaching anchors.

And the cool part would be that all the complex and heavy tech for that could be mounted on the drone recovery ship, thus not adding to the gross take-off-weight of the Falcon...

Important not to loose sight of the achievement, I guess. In 30 years NASA came up with capsule splashdowns and a dead-stick orbiter return. in 30 *lauches* SpaceX are dropping a rocket motor the size of the Statue of Liberty onto a ship in the middle of a force 8-9 gale in the ocean... Impressive

FBI: Er, no, we won't reveal how we unmask and torpedo Tor pedos

Sproggit Silver badge

This Is Where It Gets Interesting...

That's an interesting point you raise. Are law enforcement officers permitted to commit other felonies whilst in pursuit of a larger crime?

I am sure there are a stack of different applicable scenarios, case law and situations, but at one end you might argue entrapment. The FBI will counter with the idea that they simply "sat and watched" whilst visitors to the site broke the law - however, if they had to break the law themselves to gain access to the site server, then does that make their evidence inadmissible in court?

It's interesting to note the patterns here, though. Law enforcement is rightly very concerned about crime in the digital domain [we should be grateful for that] but at the same time the test cases they bring to Court [i.e. the San Bernardino phone case against Apple] are clearly being carefully selected not for their severity but for their applicability as "test cases". The really interesting thing is that "public opinion" seems to matter as much as the remedy that they seek...

As the saying goes: "The road to hell is paved with good intentions"

Mud sticks: Microsoft, Windows 10 and reputational damage

Sproggit Silver badge

"It's the Economics, Stupid... "

No disrespect, Andrew, but the issues with W10 go far, far, deeper than interface design. As I see it, there are three major problems:-

1. Users Have Become the Product

With W10, Microsoft elected to get on the "free product" bandwagon and turn their user base into their product, "selling" their community to advertisers and market research analysts. Selling your users down the river is not a good way to make a popular product.

2. Leasing To Extremes

Rather than charge users a one-off fee for the purchase of their OS, Microsoft aim to make money through a range of subscriptions, such as charging people to disable advertising in the previously "free" desktop games. using this model I expect people to end up paying far, far more for their OS than they would for a one-off purchase, because the payments could be levied for years. For example, the "annual fee" model for disabling advertisements in the "free" games is such that in 2 years Microsoft will recoup more revenue than they would for charging a hardware vendor the [typical] $15-$25 license fee for the OS. So users will end up paying *more* in cash terms for a "free" product.

3. Windows is no Longer an OS

Anyone who has taken a basic CS course would quote you the function of an Operating System as: "an abstraction from the hardware, task scheduling, memory management and resource allocation" and precious little else. Microsoft seem intent on fooling around with the "OS" in attempts to compete with i.e. GNU/Linux, but the net result is that the result is actually *less* effective than it would be if they just thought of it as an OS...

I'm sure that the UI is relevant to the perception of less technically astute users, but the bottom line is that MS have lost the plot with W10. I can only hope that the world wakes up to this sooner rather than later, and that we can have a Windows 11, which would be Windows 7 with a tidy up and the latest DirectX please...

GCHQ: Crypto's great, we're your mate, don't be like that and hate

Sproggit Silver badge

What's Good For The Goose

<sarcasm>I am encouraged to see the Head of GCHQ proposes that because *some* criminals use encryption to attempt to conceal their intentions [despite the amount of publicity these actions are gaining, despite the fact that Osama Bin Laden was sufficiently careful to not even have a phone line in his compound and despite the fact that there is more than enough evidence to show that the meta-data alone - i.e. the list of who sends messages to whom] ... that we should therefore simply give up our privacy and permit the state to eavesdrop. This distinction ["Because some bad people ... then we must..."] can be usefully applied elsewhere, and I await with baited breath the following proclamations from both sides of the Atlantic:-

1. Because some guns are used to kill people, *all* privately held firearms will immediately be declared illegal and must be destroyed.

2. Because some motor vehicles are used by joy-riders and speeders in ways that result in the deaths of innocent by-standers, *all* motor vehicles will immediately be declared illegal and crushed.

3. Because some Members of Parliament have been caught fiddling their expenses, all second homes will be banned, to be replaced by the conversion of spare loft space in Whitehall buildings into hotel-style rooms that can be booked in advance, with meals served at Westminster...

What's that you say? My additional examples simply won't work? Too extreme? Driven by hysteria and hyperbole? Exactly my point... </sarcasm>

Page: