Posts by Lee D

Stuff like sophisticated government spyware is scary and all – but don't forget, a single .wmv file can pwn you via VLC

"This vulnerability could be triggered by inserting specially crafted headers which are not correctly counted by the xiph_CountHeadersfunction. As a result, the total number of bytes that could be written is larger than expected, overflowing previously allocated buffers," Semmle notes in its disclosure.

"As a result, the total number of bytes that could be written is larger than expected, overflowing previously allocated buffers. In this case, the vulnerability risk is also increased due to the large amount of bytes that can be overwritten, and the possibility that it can also be turned into an OOB read."

It's worse than we thought! I think that quote overflowed into the next paragraph!

Four more years! Four more years! Svelte Linux desktop Xfce gets first big update since 2015

People forget that a desktop manager should be completely invisible.

You buy an OS to run programs on. You don't buy it to coo at the pretty sliding animations, wow at the alpha-fading of the windows, and be astonished at the "take over everything you want to do" uncloseable windows.

A desktop manager should be functional and utilitarian.

I would argue that we haven't seen a really decent one since the days of Windows Program Manager, and even that's only allowed because *at the time* it was amazingly functional.

Friends, it's fine. Don't worry about randomers listening to your Skype convos. Microsoft has tweaked an FAQ a bit

Re: Old Codger

Same as network security:

Encrypt everything.

But don't let people sniff the entire network (or BGP route it through their country) anyway.

Google learned that lesson the hard way with their intra-data-centre communications being sniffed by certain agencies.

Privacy is not about "did someone find it out". That's secrecy.

Privacy is about "did someone actually have the right to be listening indiscriminately to everything".

Stuffing your MacBook Pro in a ziplock bag before a flight ain't gonna cut it, say Feds

If a truck catches fire, likely there will be zero casualties. A mess, a traffic jam, lots of lost stock, but even the driver is unlikely to perish.

If a plane catches fire in mid-air, 300 lives are seriously and immediately at risk, not to mention whatever it hits on the ground.

While US ban hit Huawei and inventory overload clipped Apple, Samsung quietly stole smartphone market share back in Q2

Meanwhile, despite owning a Samsung laptop, two Samsung smartphones (old ones, though), and a Samsung TV - all independently and based on their merits rather than because of the name - I am now instead looking at a Nokia 2.2.

Removable battery. Removable microSD card. Headphone socket. Dual-SIM versions. 4G. Doesn't have 47 cameras. Latest and clean Android. GPS, GLONASS and Baidou, ~£100.

Bit of a time-saver: LibreOffice emits 6.3 with new features, loading and UI boosts

Re: Fourier transform?

Spectrum plots.

Anything that relies on plucking out frequencies from the data.

Even the most basic financial data will show up annual / monthly / weekly / daily spending patterns with the right Fourier transform.

Re: 32 bit removal

32-bit is dead, give it up.

The last 32-bit only x86 chips were the Atoms in 2010. Those machine are pathetic for anything vaguely modern, even when they were first released.

Sense the trend - 32-bit is dying across the board and has been for over a decade. Sure, you can do word-processing on an old DOS machine if you like. But when it breaks, you're gonna have replaced it with a 64-bit-capable machine unless it's literally not needed anything in the last 10 years.

To be honest, if people were after cheap, low-maintenance word-processor, I'd say buy a Chromebook. Offline editing, cloud-synced, simple-office-interface, automatic-saving.

Honestly... give it up. Even "old" 32-bit iPads are useless now - half the apps won't work.

Equifax to world+dog: If we give you this $700m, can you pleeeeease stop suing us about that mega-hack thing?

Only with explicit (not implied) consent, for a reasonable period, only for that legitimate business function, never to be shared with anyone else without additional, optional and specific consent.

Credit reference agencies literally are the only organisation apart from the government to have the last 20 years of my addresses, not to mention pushing that information to organisations that I may well not consent to, not to mention providing little to no reasonable method to correct errors, and also collect far too much information than that necessary for the purpose.

They're gonna be the "big" test of GDPR as soon as all the early test cases build confidence to take them down. My own bank can't hold the information they do, for as long as they do, and I'm a paying customer of theirs - I never consent to Equifax holding or collating that information, seemingly into perpetuity.

I'll let you off.

When you tell me how your core business is compatible with GDPR.

Rust in peace: Memory bugs in C and C++ code cause security issues so Microsoft is considering alternatives once again

Those unsafe bits, by definition, can interfere with all the guarantees of the safe bits.

And they'll be a LOT of them.

Re: Explain this to me, please

You can have all the memory safety guarantees in the world.

The second that you are able to poke around in / peek at a memory location under your control ("dereferencing a pointer"), then all those safety guarantees go out the window. Because now I can - accidentally or not - overwrite the size of a variable, or write data past its data's upper bound, or make it leak into other nearby memory areas, or access an area that I shouldn't and - if anything is watching at all - trigger a memory access violation (e.g. a null pointer deference).

And in OS terms, that's like saying that your bank is secure, so long as nobody ever want to gets inside. You can't interface with hardware (which will present itself at arbitrary addresses that you need to dereference from, say, the PCI discovery structures), you can't write drivers, and you hit massive performance problems because you end up having to pass information around *everywhere* rather than just refer people to it.

Rust has an "unsafe" mode / command / keyword for exactly this. The second you use it, all bets are off (it's "official" and they know you have to use it, which is why it exists, but they literally say that you have to flag it as unsafe because then YOU have to check your code is right, not the compiler, and if it's wrong, that's not Rust's problem, and they can't stop you interfering with the other "safe" Rust code at that point!).

If it was easy to write an OS kernel, filesystem, hardware device driver, etc. without dereferencing pointers and trusting/interpreting the data therein, then we would have moved on from C before the UNIX era finished, let alone now.

For applications, sure. If they use sensible formats and do everything right they may never need to use an "unsafe" function. But the bits that actually make your computer work are dereferencing third-party pointers that are just handed to them all the time. Every time you see a C-style (cast). That wouldn't work. Every time you receive nothing more than a memory location from hardware and need to use it by pretending/assuming it's something else (e.g. DMA accesses, PCI hardware discovery, framebuffer locations, etc.). That wouldn't work.

Guess where most of all the problems come, for someone writing an OS, especially if it includes third-party hardware support by other-people's drivers?

Did you know, for instance, that 3DFX drivers for Windows 95, etc. literally allowed DMA of the entire memory range of the machine? So by installing the driver for your graphics card, someone writing a game that runs as even a lowly unprivileged user could have queried the graphics driver in such a way that it allows complete unrestricted, unmonitored access to every byte of the computer's memory. Nobody noticed until years later (mostly because looking at driver code is hard, purely because of the safety you need to reimplement everywhere that would normally be in the compiler but with holes poked for what you need to do).

And the second you start using "unsafe" functions, you are actually able to break all the guarantees of "safe" functions throughout the rest of the program.

If memory safety was easy, Java would be secure.

That's fine. Use Rust.

And make sure you *never*, not even once, use an "unsafe" function in it.

Otherwise, you're just recreating C code poorly.

Now, how much of your code can be done? I imagine all of Office should be fine. But Windows, without unsafe Rust functions? Good luck!

The second you are into "dereferencing a raw pointer", memory safety of the whole shebang is at risk. Unfortunately, that's an inherently common requirement in operating systems, drivers, hardware interfaces of any kind, etc. and used greatly for performance tweaks too.

It's not that you couldn't do the same in any C variant either, whether by coding style, explicit compilation checks, or whatever. It works out the same.

As soon as you have to poke memory that you don't know the origin of, and trust what's there, and hope you got the address / size correct, and then interpret the data in that location in some fashion, you're in trouble. And, unfortunately, that's a inherent part of every OS.

Microsoft demos end-to-end voting verification system ElectionGuard, code will be on GitHub

Re: There's always paper

Difficulties for blind people, postal votes (the entire military), when a polling station has to close, massive problems with queues at some if there's a problem, etc. etc. etc.

It's a stupid system if it requires, in 2019, people to turn up, in person, at a SINGLE designated polling station (others are just further hassle) within a small time period.

The infrastructure around a vote is expensive and actually used as reasons not to have them (e.g. if we could just flick a switch and have a "no-Brexit vote" now, there is no excuse not to. But if it costs millions and has to be prepared months in advance, they can just say "Oh, we can't possibly do that!").

Voting on paper is open to just as many attacks... how does the polling officer inform the central government of their voting outcome? How do you know that didn't get changed along the way, the guy at the other end "misread", etc. Same thing, just slightly further down the line.

Now imagine an official government gateway page, just visit it, verify your identity, vote. Any time. Any day. Anywhere on the planet. Right up to the deadline. On one, ten, a million different things that you feel are important to you. With verifiable results. And "paper votes" basically becoming the "postal vote" of the next century... you only do that for particular reasons.

Now you know the results of the vote instantly. No "counting" required. You could literally put it in between "Someone attacked us" and "Should we go to war", it could be that simple and quick. In fact, you could know the results of the poll *at any time* you liked... anonymously, but you could tell that it was 52-48 and then went to 51-49, etc. in real-time.

Done properly, there's no reason *not* to have online voting, like there's no reason not to have online car tax discs, online checking of your state pension, online benefit application, etc. Collecting millions of bits of paper and counting them is literal dark-ages stuff in comparison. You're not saving anything, you're not defeating anything. You're just spending lots of money to do it slowly and poorly because "we've always done it like that".

Amadeus! Amadeus! Pwn me Amadeus! Airline check-in bug may have exposed all y'all boarding passes to spies

That's because your queries are unbounded by the user executing them.

If you have even a resemblance of proper security, Customer A - no matter what they query of the database, could only ever have access enough to query records of Customer A and nobody else. Changing the magic number would just error.

However, I bet what happens is that Customer A authenticates to the web session. That plants a cookie that lets them query bookings. Then the script that actually returns a boarding pass is executed as a database user with at minimum read rights to the *entire* database of boarding passes.

And I bet their "fix" is to just check inside that script that Customer A is asking for Customer A's boarding pass. *NOT* a proper row-level security that stops them even being *able* to see anyone else's information, no matter what script, portal, compromise or whatever other action is performed by that authenticated user.

We really just don't do security properly *anywhere*.

And if you say "That's an expensive operation"? Then that is why the database query for that shouldn't be direct against the main database with *everyone's* data but to an intermediary server. That is literally programmed as the only thing with full database access. And which refuses - point blank refuses - to return anything other than a rowset filtered to the authenticated user. Then the database is just being polled from (and therefore only needs to be accessed by) one machine and can cache the full results, but the intermediary (which is only allowed to talk to the web machines and the main database) is literally just doing nothing but filtering all results to those that the user that it's being accessed as should see.

Changing an ID in a URL is a classic security mistake. Not because of missing a line of code that should be checking. Because it's indicative of a complete design catastrophe in terms of security.

Least privilege principle. The web servers get nothing. The user authenticates to the web server. The web server passes on that authentication to the query server. The query server checks the authentication and queries the database. Now the database may well contain other people's results (if the query is particularly fecking awful!). But then the query server removes anything that the user doesn't have row-level permissions to see, returns that to the web server, who returns that to the user.

The web server has no access to the database.

The web server has no access to the authentication database.

The authentication server has no access to the web server or the database.

The database has no access to the web server.

The "query" server acts as a blind intermediary. If you request the wrong details, the authentication fails for the rows you are after and the query server baulks. If the query used is changed and accidentally returns an off-by-one record, or the entire database, the query server baulks or filters to only that stuff that you should be able to see anyway. If the web server is hacked entirely, it gets no access to the database except what it can see of live, running queries for limited users (and thus compromises only *their* account information at worst, not the entire database).

And then you go full, proper "I am a commercial enterprise with millions of pounds of business" and you put a firewall, a reverse proxy, an IDS and layers of VLANs over the whole thing to stop that happening anyway.

And you can literally keep your entire customer database, on one huge system, locked away from everyone, with one cable coming out, going to one computer / rack / whatever, which is the *only* way to query the database unless you're literally standing in that room with administrator privileges. One path to audit. One path to log. One path to monitor.

This doesn't take a genius. But if I'm able to just change an ID in a web query, that means the web servers are running scripts that are querying the main database directly, and returning whatever dross it pumps their way, and then pushing that straight to the user's screen *without* at any point bothering to check they own it, or in any way limiting one user's access to another user's information. An "if real_user == intended_user" at that point is *NOT* security.

2019 set to be the worst year yet for smartphone market as lack of worthy upgrades dents demand

I dunno.

The Nokia 2.2 looked alright to me.

Removable battery

Headphone socket

microSD slot.

Plain Android

GPS/Glonass/Baidou

~£100

To be honest, if I'm gonna buy a new phone, it's going to be something like that.

But, yeah, 5G capability would be nice, even if I don't put it on a 5G SIM for years to come.

Oh look. Vodafone has extended its ultrafast 5G network to deliver... Wi-Fi?

Re: WTTW

Before fibre ever gets to your premises, they'll be a much more expensive fibre to a nearby cell tower. I guarantee it.

Re: WTTW

Same.

For nearly two years now, and now I have a proper definition of unlimited data on a proper tethering contract, I can't tell the difference, to be honest.

I also pop the little soap-bar-sized box into my laptop bag occasionally and don't have to rely on pub wifi or airport wifi or foreign cafe wifi either. Hell, I don't even inconvenience my friends by needing to jump on their guest Wifi. Even my car can pick up the Wifi from it, if I want. I actually had Internet speeds in Spain last summer that my hosts didn't even have.

I've also used SIP phones over it, VPNs, all kinds... it just works.

I do have an IoT SIM in my car GPS tracker but it literally costs £25 a year and then a fixed price per text (which is rare and means either I've lost the car or someone has stolen it) with a guarantee that they won't terminate the account for low use because of the annual charge. I'll be doing the same for my house alarm too. And they are all different networks, which is my "backup".

But Wifi To The Windowsill is a very apt name. I just happened to put it onto a Draytek to offer it out to the network and get much better 5GHz Wifi coverage, but apart from that, it's the same idea.

Re: Data cap

There's a reason that I deliberately held off on all the "unlimited" data packages until recently.

I use 4G as my only Internet connection, via a little Huawei box that powers my whole home network.

Up until this year, you could never get to the bottom of their fair-use and they all excluded tethering (for reasons I can't fathom - 1Gb is 1Gb whether it's on a phone or Wifi, no? And all phones offer hotspotting).

This year, Smarty (a Three reseller) and then - ironically later - Three clarified their terms. "Unlimited" now means 1000Gb, tethering absolutely 100% allowed, according to Smarty, for instance. 1000Gb is big enough for the foreseeable future for me, I'd have to do 10 times my normal traffic to hit that. I signed up immediately (again, ironically, moving away from Three themselves who couldn't be bothered to offer me that guarantee at that point!). And it's on a monthly rolling contract so I can always switch again if necessary.

So now I feel "safe" having a 4G running my whole network, letting all my Steam games download, watching stuff on Amazon Prime all day long, etc.

I will move to 5G when and if someone does the same for 5G. Available in my area. Monthly rolling contract. Better speeds than 4G. And at least 1000Gb of untethered data available before they play any games with my speeds or try to charge me.

For reference, 1000Gb (1Tb) a month is a constant 3Mbit per second... it doesn't sound a lot when you say it like that... but if you expect me to move to 5G, then I can easily see that you'd want more than that or that you could burn through that quite quickly. I think I would want an increase proportional to my actual speed - if 5G really is 10 times faster than 4G, in my own real-world testing, then I'm going to want 10Tb of data before I touch it.

Brit consumers still holding off on buying new PCs until that Brexit thing is over and done with

That's neither here nor there.

Don't try to run Windows on Linux or vice versa in an era where everyone's computer has virtualisation instructions in their processors, Hyper-V built into Windows, VMWare available for less than the cost of a Windows licence, and GPU-V passthrough. And VMWare lets you do the old "Linux windows inside a Windows session" / vice-versa tricks so you don't even know that you're virtualising and can use the desktop environment of choice to run everything.

But if you need to stay on Windows (which most people don't), then you don't get a choice. Most people, however, have a choice and are taking it in preference to a whole new machine or even revamping their old. And when you do need to game, a Windows gaming machine is dirt cheap now compared to what they used to be. Unless you're talking 4K VR, your machine can likely run almost anything if it has anything vaguely resembling a discrete graphics card in it.

No consumer is going to install Linux on their working Windows machine, because they never even installed *Windows* on their Windows machine. It was all done for them, and they wouldn't stand a chance of getting UEFI booting off a CD working as an average consumer. Power users, obviously, already know this. Casual users, it's just not an option. Wine is so far from being an option that it's almost as laughable as telling them to use ReactOS.

I speak as someone who's been on Slackware since the 90's, helped make a single-floppy Linux distro, had licences for Crossover Office for god-knows-how-long and still runs 50% Linux servers in my workplace.

Nobody is going to consider a OS unless it's pre-packaged like Android, iOS or Windows. Chromebooks have merged into the Android ground now, and nobody even realises they are Linux underneath. But you have a clear split - people who need games buying Windows desktops (but more likely sticking better graphics cards / processors into their existing desktops), and people who just need "the Internet" and are buying Chromebooks and entirely other devices.

Both are killing the desktop PC market, and harming the laptop market. And I can't say I blame them.

PCs do what they've always done.

An average PC in a shop is more than suitable for the vast majority of people.

Specialist buyers are niche and even then, you don't need to go mad to get decent hardware.

Chromebooks do 90% of what the average person uses their PC for. Especially if you use Google Docs / Office Online, etc.

Also, a Chromebook costs £150, a laptop of any value starts around £300 and goes up quick.

Things like Acer Chromebook Tabs - combining Android tablet and Chromebook in one device - basically mean you have "full" Chrome on a tablet, capable of doing that 90% of the work, plus play all the casual games off the Play Store, for half the price of an iPad.

I will soon be in the market for a new laptop if I can't repair mine adequately (on its second battery, second PSU, and third keyboard, just through sheer volume of use for absolutely everything). According to what I see... a basic "gaming" (not really) laptop will outclass that machine two-fold in almost all respects. And yet that old laptop still runs all 1000 of my Steam games more than adequately.

And desktop PCs are dying outside of business compared to laptops. Nobody wants a chunky thing stuck in the corner any more.

Why do I need a new machine? If I need a new machine, why would I spend a lot of money? If I bought a new machine, why would I go with Windows?

I know *my* answers to those questions don't meld with 99% of the population, but that's what they are asking themselves. And Chromebooks are inheriting that stupid inference of "It's a Chromebook so it can't get viruses", which has never been true of any platform whatsoever, are cheap, have stupendous battery life, and are good enough to do anything you really need to do on them (I've issued them to hundreds of kids, who use them for everything from video editing, to audio/MIDI sequencing, to their primary word-processor, not to mention browsing their entire curricular content - even Pearson are stopping producing textbooks any more).

Boris Johnson's promise of full fibre in the UK by 2025 is pie in the sky

Re: unusable water cannon for the police, later sold for scrap at a £300,000 loss.

"The home secretary, Theresa May, has rejected an attempt by Boris Johnson to deploy water cannon on the streets of London and refused to authorise their use by any police force in England and Wales.

May heaped further humiliation on the London mayor by telling him that the three 25-year-old German water cannon, which he authorised to be bought last year by the Metropolitan police, have no fewer than 67 faults that need to be dealt with before they can be used."

Don't buy stuff that isn't currently authorised, without checking that it *will* be authorised.

And this kit was old German refurb (read: The Germans are selling it because they don't want it either) with a number of faults.

The prime reason though was endangering "policing by consent". I can't say that I disagree on that matter.

Patch now before you get your NAS kicked: Iomega storage boxes leave millions of files open to the internet

STOP OPENING PORTS TO THINGS THAT DON'T NEED PORTS OPEN!

Seriously, nothing to do with the firmware or whatever... what the hell is a NAS with those kinds of documents doing handling raw packets from the Internet?

I *BET* this is a UPnP thing too... where the box just says "Hey, open all these ports and point them at me" and people's stupid networks just obey blindly without any notification.

Firewalls are supposed to work BOTH WAYS people. Not letting in anyone who shouldn't be in, not letting anything talk out that shouldn't be out, and NOT blindly doing so automatically or operated by someone who just cuts holes in the damn thing unthinkingly "to make everything work".

An analogy I use... every port-forward is like drilling a hole in your marble worktop, or punching a hole through your house's outer wall. Sure, you have to do so occasionally. Of course it's necessary for some parts to work (e.g. taps). But you don't go drilling more and more and more holes just because it makes it easier for the electrician, and you don't make the holes any larger than necessary and, when you're done with that hole, you fill it back in.

I have less ports forwarded (never just open, but forwarded to another machine on an enclosed VLAN) than almost anyone else in the same industry as me, and yet I offer far more services on-site than anyone else in the same position.

Unless you are running, deliberately running, a server on a well-known port, you do not open (incoming) ports. And you disable UPnP on any gateway device immediately upon receipt (clients can request UPnP all day long from their UPnP services if they like, but it's the gateway that actually acts upon them).

And all "servers" should be treated as such - updates, security, authentication, least-privilege, auditing, logging, and where possible proxying between them and the outside world too. (I once get marked down in a security audit involving an external penetration test because they were unable to query my webservers directly as they all showed up as a Squid/Apache reverse proxy. "Obviously" that stopped them being able to look for version strings and query vulnerability to ridiculous URL constructions like "../../../.." etc. so they marked me down... despite the fact that that's *precisely* why that's in place)

Galileo, Galileo, Galileo, where to go? Navigation satellite signals flip from degraded to full TITSUP* over span of four days

When a tiny regex is capable of taking down a huge chunk of the world's websites (mainly because someone turned off the CPU-limits on queries, I believe!), or a small BGP announcement capable of rerouting vast portions of the Internet through Russia or China, or one timing station capable of taking down an entire global satellite network for days at a time...

I don't think we're learning those lessons. This is kind of my point. We are highlighting the sheer fragility of these things that we're basing our daily existence on, where a slip of a key results in downtime for billions of people. There's no way that we're then in any way learning if they keep happening (e.g. Cloudflare has gone down a few times, BGP outages are still happening all over), and that's not even when someone with actual hostile intent is *trying* to do something.

We're seriously too vulnerable for this kind of thing to be possible and not be immediately rolled back to some kind of "fallback" state from 10 minutes before it all goes titsup.

The precursor to the weapons is going to be completely crippling the Internet to prevent assistance / warning, not to mention that that could well be the method of attack itself (e.g. SCADA controls like we did to Iran?)... The bombs you can't stop. But if they are able to stop you retaliating in any significant fashion because a) you don't know and b) they can use the same attacks against your systems so you can't retaliate at all, then it's not nuclear winter you need be afraid of. It's someone literally walking into your country, annexing it, and nobody being any the wiser until the digital dust settles by which time it's too late.

A suspicious mind would notice lots of very odd happenings in the world of tech at the moment.

Cloudflare worldwide downtime.

Galileo knocked offline.

New York blackouts.

All, while not unprecedented, certainly unusual, and all happening in little brief window in 2019. Even Google GSuite threw a wobbly not long ago and all its services were out for much of the world.

A suspicious mind would say... oh look... cybersecurity... someone gently probing to see the extent they can cause hassle, should they decide to. All "explained" of course, all "internal" causes (but who's to say that the best way to do these things isn't to do them from the inside or make them look like that's where they came from?).

In a world where the US is snubbing China, cosying up to Russia, and pushing away Europe, who's to say what's actually happening.

If nothing else, it should make us think... if three things can all be caused by a slight glitch in the IT... what could a hostile nation state actually achieve if it wanted to?

Good luck deleting someone's private info from a trained neural network – it's likely to bork the whole thing

Unfortunately, you generally have no way of knowing how its been trained, even if you trained it.

If you train by, say, genetic algorithms - it's quite possible that there's a mirror of your data in the trained network and it flags "success" as "John Smith was a success and this guy's data also looks like the John Smith data which I have taken upon myself to copy inside me".

Maybe not intentionally but that's the problem - you have no idea what it's training itself on, what changes that makes to itself (could be a statistic, could be wholesale copying of the input data), or how to untrain / delete that part.

Good luck proving in a court of law that the thing *doesn't* contain John Smith's personal information, especially if you've been copying it around your entire company... whoops! So Mr John Smith's address has been visible inside the trained neural net and you've given that to millions of people as part of your amazing AI product? Oh dear!

These things really are as unreliable, untrainable, uncontrollable and as stupid as they sound.

It's happening, tech contractors: UK.gov is pushing IR35 off-payroll rules to private sector in Finance Bill

Re: The simple answer ...

IR35 isn't about whether you ARE an employee.

It's about whether you're PRETENDING not to be an employee but actually are.

As such, it's not enforced anything. It's proper taxation for the category that you fraudulently claimed not to be finally being applied to you.

And a client waiver will do nothing. That's like getting a waiver from your employer that you don't have to pay tax. It doesn't work like that.

If the nature of your work encompasses you under this tax, because it's changed and you've accepted that, or it was always like that from the outset, then you're liable for the appropriate tax. The taxman isn't going to care one jot about some letter that you agreed between you (that mutually benefits you both at the detriment of the tax man). They'll just find you guilty of fraud too, having signed a letter that clearly said you weren't covered by IR35 when they have determined in a court that you actually were.

Be an employee, or be a contractor. It's really not that hard.

You're either an employee. Or you're not. If you are caught in the middle it means you're working *as* an employee, for a sole employer, for an extended length of time, and get all the benefits of that, while also trying to not pay the tax that you would have to if you were an employee. And you do this by pretending that you're contracting round when actually you're working for one place, at one time, for - say - one year, and just don't want to be an "employee".

IR35 should have caught up with you years ago, for sure you've had plenty of warning that it was happening.

Work as a contractor, without employee benefits or restrictions, or become an employee and pay your taxes.

If you're working "as a contractor" and this hurts you - get employed by the client, or raise your prices.

Remember Stuxnet? You'll endure its hated-by-critics sequel if you don't patch your holey Siemens industrial kit

That's okay, we all learned to put industrial controls on a managed and controlled and isolated and monitored internal network, with no direct access to the Internet, via firewalls and proxies and whatever else necessary to ensure they stay isolated from everything else and, where possible, even each other after the last thing like this.

Right?

RTFM: Wireless Broadband Alliance squeezes out 40-page ode to the joy of Wi-Fi 6

Wifi operates entirely on the principle of a shared medium anyway.

No one client is going to get that 2.5Gbit/s, and if they did, they'd be better off with a cable anyway.

You have to go some to max out a wifi point, even of today's technology. And if you are, then pretty much you're using the wrong medium anyway.

Wifi is for casual, low-bandwidth, spiky-connections-acceptable use. Anything else needs to be wired.

Though you might "get away" with it for years, the second you start adding more stuff on wifi near the existing wifi (not even using it, but just trying to interfere/negotiate with it), your max speed will drop anyway.

I stream TV over my very busy Wifi at home quite happily, while gaming, downloading, browsing and all my junk is connected. But my work desk is wired for several very good reasons. Even though I'm the IT guy and I literally have a bunch of very expensive Wifi points to hand and one actually in the room above my desk.

Ethernet for "real work". Wifi for "casual". Yes, I can connect 150+ iPads, Chromebooks, etc. to the access point I use, and it works decently enough for all the ones that my team can physically use simultaneously (i.e. one per person). But you can kill the point with just one huge download unless you prioritise and limit traffic appropriately. I can kill wifi site-wide if there are big updates to push to all the wireless clients (averaging 30-40 clients per AP). I wouldn't ever use Wifi to do huge downloads, copy files, sync network drives, etc.

Our wifi points are Gigabit. If they max out, they max out. I can't guarantee you a signal, a speed, or any reliability on them. You may well *get* good service in those respects out of them, but I will not guarantee it. Especially when you decide to sit 600 people in a place with a handful of access points and then tell them all to "download this video and watch it". Game over. But if you did that site-wide via a Skype call to all their wired desktops, even across sites, over the local network... not a problem in the slightest. I wouldn't even flinch and I'd guarantee that for you.

Re: Wi-Fi 6 represents the end of the idea of wiring desks for Ethernet

The sorts of access points that can contain that - not only do they need (multi-)gigabit wiring to themselves, but they also have to mesh together with their neighbours well (which means you need a lot of them) and... they are not cheap. I can pay £600 for a single AP that would cover probably a "room" full of workstations (with maybe 50-100 devices, but range and coverage is the issue, not necessarily the sheer number of devices unless they are all pumping data 24/7).

Even then, it's not just a case of buying a hundred APs and lumping them in a building, you'll end up with worse wifi than 10 more expensive managed APs, properly sited.

Add on centralised/cloud management (a must, really, if you guys have any kind of MDM) and it suddenly becomes a lot more expensive than handing your electrician a 305m roll of Cat6 (about £50 worth) and saying "can you put that in the walls for us". Nobody deals in 100Mb any more, either.

If you have a hundred users on Wifi over two offices in a major city center - you're paying for decent, most likely meshed, managed wifi, probably Ubiquity, Meraki or similar. If you have blanket coverage and not just "the desk areas", then they're paying even more. And they had to pay someone to wire those points in with Cat6, too, or they'd be useless - plus PoE (either switches, or decent injectors with lots of power points around the place to power them up) and decent switches on the back-end to run them all properly.

By contrast I could probably pay a guy to wire an entire floor with double-Cat6 sockets to every desk for much less than even the points cost, let alone the controller and necessary PoE switches.

They've done it for the look of the thing, not to save costs. And they are able to because you don't make heavy use of the system. When you do, you're going to have a shock - involving an awfully expensive wifi upgrade. When my switches max out and can no longer supply 48, PoE powered managed ports at Gigabit each, over a fibre 10Gb backend, I might have to pay a couple of grand to swap it out for an equivalent 10Gb switch with 40Gb fibre ports and give everyone an instant free upgrade.

Fact is, your wifi wouldn't operate at all well without that exact switch sitting in a cupboard somewhere anyway... you've just bought the Wifi on top as a convenience and for the look of the thing.

Re: Wi-Fi 6 represents the end of the idea of wiring desks for Ethernet

Exactly.

A dedicated one-gig tube direct to your PC? Or a fraction-of-a-gig, time-sliced, interferable, unpredictable radio connection shared with everyone in radio range?

My rule of thumb for people who "just don't get it": Wifi is *at least* 20 times slower than a cable. It's that simple. I'm sure you can demo a really fast connection in a greenfield environment, but in the real world you're sharing it with everyone's mobile phone, tablet, etc. not to mention a huge tract of unlicensed spectrum users in the form of everything from doorbells to microwaves.

Just assume, no matter what, that Wifi is *at least* 20 times slower. It works. You have a roaming profile on your work PC that takes a minute to log in? Yeah, that's going to take 20 minutes to happen over wifi. I kid you not.

And when wifi does catch up so that even 1/20th of it is enough to run gigabit, then we'll all have 10G and 40G Ethernet connections anyway (10Gb is actually viable today, if you just have a little money to spend on it - the problem is the backend connection on the switch but if it has the processing power, you can get around that with LACP).

It's fine for casual browsing. It's fine for home use. But it's 20 times slower than a cable. It's that simple. And the more you use it, deploy it, and mix it up between old and new wifi, the worse that ratio gets.

Tesla’s Autopilot losing track of devs crashing out of 'leccy car maker

Re: I'm guessing you live somewhere without weather

You're assuming paint.

I'm assuming radio beacon and/or visual display. A laser in a cat's eye, or on a pole on the side of the road. Radio chirps will work through almost any amount of snow, and the car is *in contact* with the road. Never had a Scalextric? Put a great big sprung connector (like.. a train has!) connecting to the road... it'll clear the way and have a direct electrical connection good enough for data and power (even if it blips). Just like... a train does. There are myriad ways to achieve this and computer-vision is the VERY LAST thing you want to lay a human life on. Hell, 4G and a GPS signal on an isolated lane is more than enough. Just stop it mingling with "normal" traffic.

Snow-covered? Continue on using your front and rear sensors at a slower speed until you pick up the signal again. Just like a train does. Or a human when they can't see the road.

Re: I want some of what Musk is smoking

No, the only way it'll work is if you remove all intelligence from the system.

This is a road. There's a BIG LINE down the middle. Encoded down that line is all the information you need about the road you're on and the road ahead (in case the line fades out!). When a car deviates off the line, it stops. The "self-driving" cars literally just rely on being told EXACTLY what to do, when. And tell each other exactly what to do, and when. I am 5m ahead of you, slow down.

The drive to put "intelligence" that we don't have and can't even define into things that are not, and may never be able to be, intelligent is just stupid. What you want is artificial stupidity - computers that obey orders, perfectly, every time.

You wanna change lanes? You have to wait for a lane-change line to approach, then announce that lane-change to everyone around you, and then follow the line you're given.

Such things only work on a "dumb" road. With other "dumb" cars. And "dumb" junctions. Make life easy for the computer. I don't understand why we're deliberately trying to make life difficult for the thing we're putting in charge of ours and other's lives. Make it easy. The same way that we designed a steering wheel for humans to steer the car easily. So when a computer drives, we should make it easy for the computer.

The obsession with putting this junk on the roads with real humans is the single largest downfall of it. It's ridiculous. And then you find that the systems we have made "dumb" generally "just work". Everything from automated train and tram lines, to production factories, to TVs that just play content rather than try to come preloaded with apps and voice recognition and network connections that can get viruses.

I am a *massive* IT guy, I program, I studied computing at university, I was hooked from a young age on these machines. And I would not trust it thinking for itself. If I was to design *any* system it would do what it was told. Sure, that means you have to tell absolutely everything that you want it to do. But I'd rather have an obedient and dumb system than a disobedient "smart" one.

You wanna play with this stuff, do it away from the roads and away from humans and in a controlled environment where the most that can happen is you bump someone's ankle at low speed.

You wanna do something useful... dumb it down to the absolute basics. Like a washing machine with seven thousand programs on it... you just want it to wash the damn clothes. Make the car go from A to B in the simplest way possible where there's no chance of error. That means stop all this automated car junk and - at minimum - designate one lane "automated vehicles only". Stick a crash barrier between it and other people. Jam the cars into it, inches from each other's bumpers. Have them talk to each other, and blindly obey rules about what they do. And label every few hundred yards with a radio transmitter that tells them where they are, what's ahead and what they should do (stop, go, etc.), and the whole system comes to a halt in absence of such instructions.

By the way, it's called a railway.

It's a pipe-dream, ain't gonna happen.

The people who have this thing enabled on their cars are just signing a suicide pact that involves other driver's unwittingly.

Even with a "FSD certification" from a government, I'm still not gonna trust it.

Am I a luddite? No. I'm a realist. With a sense of security and what computers are actually capable of. Voice/face recognition was pathetic in the 80's, it's still pathetic now. That's because it's a *hard* problem to describe to a computer, nothing to do with the power you put behind it. Self-driving is exactly the same.

Google's new Go engine was the biggest, most radical, most humungous step forward in AI since it was invented. Going from the best machines in the world barely beating an amateur to thrashing all the masters, almost overnight. It's unbelievable, I was *so* pleased to see it, I imagined it was some amazing new way of doing things - because I studied Game Theory, Graph Theory and various computer science courses to degree level, and one of my tutors was one of the world experts at making computers play Go. But it wasn't. Little else has resulted from that. It's a very limited niche that it made a leap in and isn't translatable to more complex AI problems.

Musk just has no concept of what he's asking, and what he's selling, and what's actually possible. You'll end up, at best, with a poor AI-driven thing that'll be involved in just as many crashes but in all the "less obvious" scenarios. Sure, it won't fall asleep on a long boring straight road, but it's going to plough down a police officer who's trying to move traffic out of an obstructed lane on a motorway without any special road markings to do so.

And I've said a million times before - stop testing *on the road*. There are a billion test cases you could use to build confidence in such a system that don't risk multiple serious deaths. Have an AI-controlled bus punting around Disneyworld. Make a self-driving shopping trolley, or golf cart (how easy can you get - 18 holes on a closed off course that you can layer all kinds of signals over and minimal hazards), or fairground ride, or airport vehicle... all low-speed, less-impact tasks in controlled, closed-off areas where you can prove that it, say, never even bumped a human in three years of operation. They could have started that TEN YEARS ago and got that reputation and *then* translated it to the real road.

But no, Musk just goes "70mph on the motorway only and tell people they were wrong if they activate it anywhere else!". Idiot.

Internet imbeciles, aka British ISP lobbyists, backtrack on dubbing Mozilla a villain for DNS-over-HTTPS support

Quite... they should just shrug their shoulders and say "Here's the information you asked for. Yes, we know it's useless to you. But that's what you asked for."

As technology progresses, the very idea of "trusting" the ISP to be anything more than a shifter of encrypted packets gets more laughable... I honestly don't understand why they were ever considered anything else.

There will come a point where all Internet traffic is encrypted point-to-point and even metadata becomes next-to-useless. It's inevitable.

If someone could please get off their backside and replace email too, we'd be a damn sight closer. SMTP over TLS is *not* end-to-end encryption between sender and intended receiver and cannot be with current protocols.

Re: "However, this privacy-protecting technology has turned out to be controversial"

"Anti virus programmes" - programs under the control of a commercial third party, running with complete system privileges even when nobody is logged on, intercepting every single file access, and acting on un-decipherable instructions downloaded from the internet to decide what to do with every file access, and uploading random data to the Internet for "research purposes". AV is the biggest security hole that exists today.

If you're a security professional suggesting that AV on every machine is essential, I seriously question your credentials and/or who you're working for.

Much, much, much, much more secure to not have that crap, and implement security policies that mean arbitrary executables won't run.

Two pentesters, one glitch: Firefox browser menaced by ancient file-snaffling bug, er, feature

There is only one valid reason for a browser to be accessing the local filesystem (except its own execution) outside of its own program folder, or the users "profile" folder. And that's uploads and downloads.

file:/// protocol should be dead, killed, executed, put out of its misery. There's no reason for it. A lot of web dev tools won't ever work via file:/// anyway, and force you to run a local web server if you want to prototype them (mainly because browser DOMs now - correctly - ban such actions... I know I can't load an Emscripten / Webassembly file from the local filesystem without the browser just throwing up its arms and not executing it).

And uploads are easy to fix:

Browser believe that the user wants to request a file.

Browser executes, in a completely separate and secure context, a single program that can't be run again until the file is actually selected by the user. Said program runs in its own execution space, takes *no* data from the browser whatsoever (if I was being nice, maybe the *title* of the requested window, but you can see how even that could be scammed and you think you're uploading your photo to Facebook but actually you're uploading your photo to a malicious tab in the background!).

Said program lets user select file from local filesystems. Reads said file. Provides contents of said file to browser. (Browser could supply a buffer or, more likely, said program creates a suitably-sized buffer and returns the address of it to the browser). Said program has exactly zero requirement to access the Internet or act upon any data from the browser in any way, shape or form.

Said program terminates, signalling browser that it's done, and where it put the data.

Browser waits for that termination signal, picks up the data from the location, supplies it to whatever mechanism triggered the request (a file upload, or whatever).

Downloads are literally the same in reverse - the browser supplies the data and tells a local helper program "Ask the user where he wants this, and save it there for him".

The problem with modern browser is *not* that they can't be secured. It's that people are dumb and haven't learned the lessons of history. Isolate everything. Have minimal message-passing between contained modules. Don't let even one module get all the privileges. One module to determine users preferences. One module per tab to parse HTML and gather resources. One module per tab to render that content to a video memory area. One module to assemble that content on demand inside a UI (and the tab module doesn't even need to *know* whether it's visible or not!). One module to do file accesses for uploads. One for downloads. And don't let even a single tab be able to control/interface/message/even detect the presence of - any other tab.

Break it down. Erect walls between them all. Strip permissions from everything back to the bare bones (uploads/downloads don't need to touch networking AT ALL, the UI module requests information from the settings module but never queries them directly, etc.). Then the chances of, say, a dodgy bookmark corrupting the browser's stack to provide full filesystem access to a tab on a related site, etc. are nil.

When you are designed the one, primary, major interface between a user, an OS and an untrusted third-party scripting language, you're an idiot to do it any other way at all. When a tab falls over, it falls over, and takes... nothing else with it. I can't tell you how often Chrome/Firefox browsers LOCK UP COMPLETELY because one tab goes a bit mad on the old Javascript. It just shouldn't be happening.

We should have learned this lesson by now. And especially after the "let's put the browser INSIDE the OS and let people poke all the internals!" of the Internet Explorer days.

I will happily take my browser rendering a fraction of second slower, over it ever making possible a remote compromise of my machine with just a single click from an unprivileged user.

Years late to the SMB1-killing party, Samba finally dumps the unsafe file-sharing protocol version by default

Re: Now we wait...

Your data isn't secure if you're using an entirely-broken protocol to store it.

It's not like you *can't* get your data back out, it just won't be automatic.

Anyone with a NAS that doesn't allow web-access, SMBv2+, etc. anyway is throwing their money away on useless junk and probably needs to update quite substantially anyway, before that thing dies.

You can't keep everything around for the sake of convenience "just because it used to work".

SMBv1 has been known insecure since the days of Server 2003. You need to upgrade once every 15 years or so. Or implement the well-documented "this is insecure" workarounds that are all over the internet.

Seriously, it's like whining that you can't do NetBIOS over IPX any more... get with the program if that data is of any import, and upgrade/reconfigure/replace. If it's not, then you'll tolerate loss of immediate access to that data anyway.

You wouldn't expect a car to last 15 years without maintenance, let alone some crappy Chinese cheap NAS box that doesn't support anything other than SMBv1.

Let's talk about April Fools' Day jokes. Are they ever really harmless?

I did upside-down-ternet once, and another year I grayscaled everything.

Basically, we had a global proxy anyway, so I just pointed it to another that whenever it was asked to retrieve/cache an image, it would throw it through imagemagick to turn it upside-down or whatever you wanted. Happened transparently, so it took people a little while to notice, but it was quite fun.

I've also got a batch file called "Fix <vendors> mess of a report server" on the desktop of one of the servers, that basically kills and restarts all the processes that hang up. I introduced that one to them in a technical meeting that we agree to host on our site for said vendor. 80% of the people there asked me for a copy of that script... but they never took the hint and fixed the damn thing.

And I often replace the executable from any program that's going to be obsolete with one of my own (usually just a quick MinGW thing). Quite literally just displays "This software is going to stop working next month... stop using it and use the new version instead", with a link to the new version (but also runs the old version just in case there is a problem).

if a > 0 then

function1;

elseif a < 0 then

function2;

elseif a == 0 then

function3;

else

MsgBox('Go hit Edward in the head');

Please tell me he wasn't doing this on a VB "Variant" or anything else that could potentially turn into a float?

UK's Openreach admits 50k premises on 'gigabit-capable' FTTP network can't get gigabit speeds

I will happily delay those "billions" to ensure you have minimum 3G, but also 4G, in the entire country. Also minimum 25Mbps fixed broadband in the same.

Pushing gigabit *poorly* with shoddy equipment into a tiny percentage of already-well-served homes isn't helping the rest of the country get decent speeds.

Last year I was quoted a speed of 3Mbps on ADSL, "up to" 10Mbps on VDSL, in a *large* town inside the M25.

By all means, make all new provision as fast as you can and with capacity to spare for the future. But how about we fix the people who can't use basic Internet services *first*, then worry about the people who can afford a new-build getting gigabit...

Openreach needs to snap that BT umbilical cord, warns Ofcom

To be honest, I run entire sites off a 100Mb leased line that do traffic like nobody's business 24 hours a day. You'd be hard pushed to care about the top-download speed more than the latency, DNS lookup time, etc. Usually the top-download speed makes little difference to web browsing as your browser is being asked to fetch a hundred pages/images per tab from all over the web before it can draw anything on the screen. It's the session connection setup/teardown and associated latency that "feels" slow, not the actual download speed.

You only need more if you download lots of static huge files (e.g. downloading Gbytes of stuff all the time), want a better upload (definitely better to be on a symmetric connection for anything that goes up, and *absolutely* for hosting anything on-site), or you are literally maxing out the connection for most of the days (most people/places aren't, I promise you).

Sure, I'll take a free upgrade to 1 Gbit/s, but I wouldn't pay for it until it was the bottleneck. It rarely is, especially if you bother to put in any kind of content caching, proxying (DNS/HTTP), firewalling, QoS, etc.

I once promised to triple a school's "speedtest" result once. It was literally a "job interview dare". They were moaning about how the line was constantly jammed up and slow and speed tests were showing pitiful numbers. I was allowed a cursory peek at the router. The line speed was fast, but I could see the entirely unmanaged network behind it, repeatedly asking for the same things over and over and over again. I bet them that I could improve it, giving specific targets. They employed me. Day 1, Job 1: Prove yourself. Eek!

I changed the DNS lookup to a local machine instead of every machine trying to get out to the ISP (the router was just passing on the ISP's DNS), put in a transparent caching HTTP proxy on the main line (to catch all the common page accesses) and set up WSUS local Windows Update caching and it dropped to 10% usage of the line. Their speed test results went from "pathetic" to "the full line speed" (give or take) because it wasn't competing with loads of junk any more. Did the same again when they started buying IP phones... 6 phones were struggling to keep calls going, breaking up, cutting out, etc. QoS the network and they had 50+ phones of the same models, no problem, no breakup, no upgrades required.

Even at home, it matters much more what you're sending/receiving/expecting of the connection than anything to do with its headline speed. QoS your TCP SYN/ACK (if possible) packets, implement a global DNS proxy (you can prioritise that too so it gets first-pick of the Internet connection to resolve new websites), stick in a caching proxy even if it does nothing else and is "optional" (i.e. not enforced by Windows, browsers, etc. so you can turn it off it it gives you gip). Prioritise your gaming ports too, you'll be amazed how much lag is caused by your UDP "non-urgent" packets being held up by the girlfriend browsing Facebook. She won't notice a 10ms lag, you will.

Then most things are going over your (presumably Gigabit) local network, with delays around 0.01 - 0.1ms, while the stuff you need to go out to the Internet fresh for is - at worst - as bad as having nothing at all the first time you do them, but all the small, urgent packets, connection initiations and multiple repeated lookups are cached locally or prioritised over bulk traffic.

If you have the option (e.g. Draytek router) Airtime Fair Sharing is also good... it basically shuts up noisy wireless devices on your network so they don't steal all the airtime from devices trying to do stuff. Less disconnections, faster wifi speeds and much better latency.

Most internet connections are akin to a room full of people all yelling at full volume to people in another room Making the door between them bigger isn't going to help much, because they're all still shouting and yelling and jostling and getting in each others way. Much better is to *organise* the communication, centralise parts of it that are repeated ("You want to know the time? Go ask John on this side, no need to yell all the way other to the person standing by the clock in the other room... he asks them for you, then he can tell everyone on this side"), cut out unnecessary communication entirely, and ensure that when someone *does* need to communicate urgently, they can do so without vying for place, multiple retransmissions, etc.

Re: 4G router

Same.

I bought the antenna too.

It didn't make a huge difference in top speed (because that's limited by what they want to give me, really) but it made the connection much more stable and predictable.

Re: Mobile is faster

I pay £25 for unlimited data on a 4G SIM with explicit tethering allowance of 1000Gb / month.

It's faster than all the broadband I was offered when I moved into my BT-provision-only flat. I didn't even bother to activate the phone line. It would literally cost more to activate a dead line and get it up to scratch than it would to pay for a year of 4G. And the line is dead-dead, as in nothing, not even a message.

The speed is fine, the latency is fine (I game over it all the time), and BT could only promise me "up to 10Mb" if I went with ADSL2, and VDSL wasn't available.

It's cheaper to use a mobile telecoms network to connect to the Internet, run SIP over it, and tie it into my network as the primary gateway than it is to faff around with fixed-line stuff. That's a bad sign.

And I'm sitting here with a decent router with ADSL/VDSL already built into it.

Cloudflare gave everyone a 30-minute break from a chunk of the internet yesterday: Here's how they did it

Re: This is an important lesson in the testability of regular expressions

Whereas at the moment, the attackers can only DoS their entire infrastructure with bad source data on a poorly-written regex. So much better!

You write the regex so that it's written properly. So that it doesn't matter what data it's given, it can resolve it within a set time. If it can't do that, then you can' t use it anyway as it will introduce *so much* latency into the system that it turns into a DoS and becomes useless.

You're confusing "source data" (hacker controlled) with "regex expression" (Cloudflare controlled). If the regex can't deal with the source data in time, it should alert. There's a clue in that word... alert.

If it alerts on every damn page you go on that has a bit of Javascript, it's useless anyway but at least it didn't bring half the globe down with it.

And then realise that maybe, just maybe, regex hunting is no better or different to AV signatures - which also exhibit this same problem.

If a malicious attacker can control the data in the page to the point that they can make your regexs timeout, then they can do a lot worse anyway. Hell, "give up" and return an error in that instance. You'll still have *much less* impact than taking down your entire CDN because of a multitude of over-running regexs from a handful of sites. You'll just have a handful of sites that don't work, rather than an entire international company service.

Re: This is an important lesson in the testability of regular expressions

Seems to me like what they need is a limit or timeout on how long regex's can take - alerting and terminating if they go over.

You don't need fancy tech. What you need is not to swamp 100% CPU on huge multicore devices when you could have just said "Has this regex taken more than 10ms to execute? Then kill it and tell the admin so we don't fall over globally".

Metropolitan Police's facial recognition tech not only crap, but also of dubious legality – report

Re: It's in its infancy, but it will improve

The "AI" (pfft) has proven itself to be far more biased and has much more trouble picking out features on less-contrasting skin tones (i.e. darker ones with no lighter features, as opposed to lighter one which universally have darker features in places).

Re: It's in its infancy, but it will improve

Apart from the smartphone, same.

(No, Google, I don't want to use your "enhanced accuracy" location either, thanks. I'm quite happy with "to the nearest metre or so" plain old GPS, thanks.)

Finally in the UK: Apollo 11 lands... in a cinema near you

Re: Amazing...

"Being different" doesn't mean you're right. It's a common misconception, borne of the belief that all those people who were "different" and "successful" means that the two are somehow related. Correlation rather than causation, and all that.

Unfortunately, more often than not, it means you're wrong and/or just don't understand enough to discuss it on any sensible level.

Every single moon-landing conspiracy nut I've ever spoken to (and there are a few of you, I'm afraid) has a poor grasp of physics, a terrible reliance on "implying things from video footage", and a sheer lack of understanding that they could be wrong too... the usual problem is that I get halfway through explaining why one thing they believe is utter horsecrud, only to be presented with a "Aha! BUT..." mid-sentence about something completely else.

It takes a million times more effort to debunk a nonsense theory than it does to make one up. I hereby claim that gravity is a new magnetism that applies to all objects including light, not curvature in space-time. Prove me wrong. It took Einstein most of his life to do so, and if *you* can't, then I'm assuming I must be right all along, because you're obviously not smart enough to debunk it, right?

And... though I know it's just going to end in Aha! BUT!....

The "moon rock" isn't, wasn't, never was, it didn't come from the moon, the one that *did* couldn't have weighed as much as that (they brought back 1oz samples, that was 3oz). The stuff is literally explained on the Wikipedia page, with citations: https://en.wikipedia.org/wiki/Netherlands_lunar_sample_displays

Some guy who has nothing to do with the Apollo program gave them a thing, told them it was Moon rock, they "phoned NASA" years ago who said it was "possible" but have never examined it, they thought that was good enough and put it on display. Human error/fraud, nothing to do with NASA/Apollo/Buzz/Neil whatsoever, at all, in any way, shape or form. It doesn't prove that "there is no such thing as Moon rock on Earth because we've never been to the Moon", it only hints - at best - that museum curators are idiots, or that sometimes people nick stuff that's valuable and replace it with junk because nobody ever bothers to check, or that old people get confused. It's also a tiny *speck* of rock, but well done for blowing it out of all proportion.

Anything about flags moving is just so Meh by now, surely. The easiest debunk for those (which again takes a million times more effort than to keep making up nonsense), is that it's actually quite hard to make movement in even an atmosphere that will move a flag from that distance just by walking/jumping past it.

As a lot of debunking of this stuff shows; Try it. Put a flag out in a sealed room on a still day. Measure a whole raft of lines on the floor. Jump past it like the astronaut does. See how close you have to be to make it move. You can literally debunk 95% of all the conspiracy nonsense by just trying it yourself... all the sun-angle bull, flags moving, taking photos, etc. etc.

And, let me tell you, if you throw a thousand theories and *ONE* is plausible, your reputation is destroyed so badly already that nobody will listen. If you posit one theory, take it to its conclusion, test, prove, debunk yourself, recreate independently, etc. then people will beat a path to your door. Bandwagon-jumping on things that are obvious nonsense without even the simple precept of "just try it yourself" just makes you look a fool. Tell me... which way does water drain down a plughole? All the nonsense in the world is solved in ten seconds by *trying* it, using the simple equipment of your daily ablutions and some *basic* science (i.e. hypothesise beforehand, set up, experiment, test, repeat, confirm, determine contributory factors, repeat, test, isolate, confirm, publish).

The problem, of course, is that estimating *any* distance from a single, flat 2D video is almost impossible. It's the "UFO sighting" problem all over again. Don't even get me started on the number of people not using original footage, inferring detail from JPEG/MPEG artifacts, measuring distances by counting pixels and then jumping to conclusions, etc. It's the "sun angle is all wrong" nonsense all over again.

No. No no no. You're wrong. Copying in more people who agree with you doesn't make you right. Even a Dr agreeing with you doesn't make you right (they're usually Dr in very dubious fields and of dubious professional reputation like the ECat guys). You have an answer for everything that just doesn't add up.

If it wouldn't add up in a court of law, you're honestly just wasting your life away looking for things that aren't there. You can find *all* kinds of things that aren't there if you look hard enough and long enough and are convinced enough.

What you can't do is, in any way, prove that the Moon landings are fake or didn't happen.

Think of it like this:

- You score minus one point for every nonsense theory you've ever backed that turns out to be nonsense. Every minor incident like this.

- You score zero points for any theory that's unproven or subjective.

- You score one point for every one that remains is confirmed true by reliable sources (note: YouTube, Wikipedia etc. are *not* reliable sources, though they might be convenient for troll-bashing).

If your lifetime score is zero or negative, you're not someone to listen to.

If your lifetime score is positive, then maybe you can be listened to.

In my experience, the reason every conspiracy theorist has *so many* theories is not that they are reinforcing their case in one area, but because when "okay, maybe I was wrong but... " happens, then they are shielded by a thousand others that "may be right". It's the shotgun method.

That's not how reputation works.

Reputation works because, for countless scientists over decades, their work has proven to be true even when it looked like nonsense and was incredibly difficult to understand and predicted radical flaws in the entirety of science that prompted revelations, testing, and investigation and were found to be true. Every nonsense that they got categorically wrong, they lose reputation for. Those people in negative reputation are not famous, not listened to, and continue to spout nonsense (David Icke, the ECat people, etc.) no matter what their qualification. Those people who get even into positive scores are heeded and respected. It's an extremely hard thing to do, to provide something new that nobody has ever seen before and which is proven correct... that's why PhD's take so long and are so hard to earn, and can be revoked in a trice.

I also know someone with multiple PhDs and several degrees who believes some absolute nonsense. He might know what he's doing in certain areas, but in all others he would be laughed at for asserting an incorrect notion.

Guess what? NASA is, was, and still will be full of PhDs. What you have is not "conspiracy theory"-itis. It's "anti-meritocracy". You want to be better than a room-ful of PhDs because you've probably not got one (nor do I, by the way, I've just worked among those people long enough to know that I can't grasp the kinds of things they learn for enjoyment as a side-track to their actual main work).

Unfortunately, your reputation, being associated with the nonsense you present, is already in the negative. It's just that bad. To realise how bad it is, you have to have some sense of these things. It's hard to know you're being stupid if you are starting from the base of "I'm stupid".

People like you will always exist. But at no point is anyone ever going to go "Oh, look, the Moon landings WERE fake..." and get that as an accepted theory. It just isn't going to happen. The weight of evidence is *so* far the other way that you can't even understand how much nonsense it would be to claim otherwise.

If you want to be taken seriously, work on making the score positive. Not parroting bad and debunked arguments about blurry photos, tiny scraps of unoriginal footage, and completely poor understanding of simple physics.

This major internet routing blunder took A WEEK to fix. Why so long? It was IPv6 – and no one really noticed

Re: What transition?

"6 thumbs up & 4 thumbs down" - Irony.