Posts by cbars

We need to talk about mathematical backdoors in encryption algorithms

National products

So what does the UK use? I'd like to know what to recommend instead of AES.

Edit: found it, it's AES

https://www.ncsc.gov.uk/guidance/tls-external-facing-services#profiles

Ha

Argy-bargy Argies barge into Starbucks Wi-Fi with alt-coin discharges

Re: I still don't understand

a downvote? Thanks for that, rather than explaining what I'm missing!

I still don't understand

How this 'makes money'. I understand generating crypto currency. I understand trading crypto currency for real world cash in order to trade without taxation/fees internationally.

I don't understand how the intrinsic value of the 'currency' is able to increase, it's not linked to anything... Adverts generate money through some theoretical link between seeing them and giving the real world company that paid for the advert some of your money, as far as I can tell these currencies are just another big bubble waiting to pop

Clearly, I should have thought harder about this and got in on the con earlier...

UK.gov told: Your frantic farming of pupils' data is getting a little creepy

Re: Get formal permission or just drop it!

They trust themselves, and that's what matters.

Unfortunately, that is also literally all that counts

What's that fresh, zesty fragrance? Oh, Linux Mint 18.3 has landed

Re: Software Manager

"one of"

it's journalistic laziness, c.f. the deliberately misleading "up to"

Twitter's fight to kill Uncle Sam's censorship of spying numbers edges closer to victory

Re: This is not democracy

I don't think it's knee jerk... There is a reason all their children 'pledge allegiance to the flag'. (1)

I'd go fucking mental if children in this country (UK) were forced to pledge allegiance to anything. Dawkins makes a great argument for this about religion, they're too young to know WTF is going on and make a judgement; they're evolutionarily programmed to believe whatever you tell them.

(1) In a piece totally off topic and with my own projected moral code:

This helps get them to act predictably. You want predictable people when they can all carry guns...

The End of Abandondroid? Treble might rescue Google from OTA Hell

Great

"much like how Microsoft Windows can run on nearly any computer hardware"

Let's make a linux derivative, slowly close the source for all the useful bits (G Play) and then copy Windows

+1

Uber says 2.7 MEEELLION(ish) UK users affected by hack

Somewhere in Cali HQ in 2016:

"That looks odd..."

"Ummmm.... Bugger! Emergency Release!"

.... a year later

"Patch issued, post incident analysis complete, let's tell people about it."

"About what? I'm busy with this flying car concept mock-up"

Why does no one want to invest in full fibre broadband, wails UK.gov

Re: on line rental

Think the point was that at the moment it goes to BT. If other companies stick in Fibre, no need to pay BT. If the cost of maintaining Fibre is lower (better cladding, underground, whatever) then that is further argument for BT to NOT put it in in place of existing lines.

But yea, line rental is also overpriced unless those engineers are on an amazing salary.

From Vega with love: Pegasus interstellar asteroid's next stop

0.5 rpm?

At what radius?

I have not checked your maths, but your reference to sci-fi leads me to believe you are saying that is the threshold - apologies if you've taken the trouble to work that out for the object; the BBC article said yesterday that they have not been able to work out the exact dimensions.

It's been a while but I'm pretty sure we need to multiply the radius from the centre of mass to give you the force (for a constant period). The same number of rotations per minute translate to higher forces for long objects :)

Anonymized location-tracking data proves anything but: Apps squeal on you like crazy

Re: Don't worry

Cheers Tom 38!

Graham Cobb:

I actually approve of the law, and I'm glad there are laws that make burglary illegal, but I will still take steps to secure my home. It's not the law abiding people/companies I'm worried about!

My point was that if the data exists, and is available, we're fucked either way. The kind of people I'm thinking about are the scam artists that can use this data to fool people into handing over more information by identifying them (yes, illegally).

Your points stand, about research and insurance (what was that NHS eData thingy....?) and the like, but really we also want people to stop storing all this shit and definitely not to sell it around as if it's safe to do so without revealing intimate details of the subjects.

Lots of points on this one, too many for my flippant forum comments, if I bump into you in a pub I'll be happy to natter on for hours and not solve anything. Speaking of, it's Friday :)

Don't worry

UK Gov has made it illegal to de-anonymise (re-identify) data in the new Data Protection Bill (part 6, 162)

So we're all safe and privacy is assured :)

So all you need to do is mark your data dumps "this is anonymous data" and put the real names/device IDs into a separate file linked with a 'random' number so no human could ever join the dots - and you're good to go. The law will protect us!

Fear not, driverless car devs, UK.gov won't force you to write Trolley Problem solutions

Re: "an old lady pushing a shopping trolley, and a cyclist - which one do you hit?"

Stupid question.

I didn't have to answer it, and better yet I didn't have to prove which I'd choose, when I got a drivers license. I could freeze up and panic, I could loose control trying to hit 'the least worst option' and hit all of them.

Just say, if you can't avoid a collision with all that whizzy sensory data and predictive analysis and IoT shit then just brake and reduce the damage done.

They don't have to be perfect machines, they just have to be, on average, safer than meatbags.

Sure, Face ID is neat, but it cannot replace a good old fashioned passcode

Re: "So how do you solve the problems of people..."

This is probably what people said when front door locks were invented.

"But I have to remember this stupid key thing and fiddle around whenever I want to get into my house? That's too hard/inconvenient, I'm used to just popping the latch or opening the gate without all this messing about"

I can quite happily say no to any member of my family without repercussions, I'm sorry to hear that's not universal. You can offer advice, if its ignored then I refer you to my previous comment: it's somebody else's problem.

Re: "So how do you solve the problems of people..."

How do you solve the problem of people who forget/neglect to lock their doors and windows? Void the insurance?

How do you solve the problem of people who leave their wads of cash on a car seat while it's parked near a pedestrianised area? You don't/same as above

You can create security technology to help people, you can create it cheap enough for the majority of people to afford; but at some point, it really is someone else's problem.

Seldom used 'i' mangled by baffling autocorrect bug in Apple's iOS 11

easy explanation

The neutral net responsible for auto correct was trained on data including responses to the new iPhone X release, and people's responses to the asking price

"Would you pay a grand for this?"

"Would I A□?@#$!"

For fanbois only? Face ID is turning punters off picking up an iPhone X

Biometrics

Just because the phone knows *I* am there, doesn't mean it knows *I want* my phone to unlock.

My face, my fingerprint, my DNA just identify me, they are my username, MY VOICE IS NOT MY FUCKING PASSWORD

Something you have and... nope, that's all you need.

Health quango: Booze 'evidence' not Puritan enough, do us another

standard gov behaviour

We need a justification for this idea. Let's ask the experts!

Wait, that's not useful, that isn't what we want.

Let's just say what we want, and imply its come from the experts. Bonus points, we can blame them when it goes south.

Hey, new idea!....

Updating Things: IETF bods suggest standard

Re: Seems sensible

I've upvoted you, as I agree that products should be 'fit for purpose', but the idea that a device must stop working even if not provably non-functional is not one I relish. If I want a TV which is only used in conjunction with some other device and is never connected to the internet, then I don't want it to randomly fail because the number of clock cycles has gone past some arbitrary limit (of course most implementations would only trigger failure via an internet connection, but still). For example my local pub has a TV used solely to display the CCTV image from the end of a skittle alley, it's been there for a decade.

I'd prefer that if there was a kill switch, it only killed the 'smart' stuff. I could then activate that as soon as I unbox the thing!

Seems sensible

Unfortunately I don't think the problem is caused by a lack of technical standards for deploying security fixes, it's caused by the fact that the functionality provided by IoT devices - to the manufacturers - is simply a means to an end. Once they have the money, it's time to come up with another round of functionality to get more money, and charging for firmware updates will always bring in less money than charging for a new physical device so it becomes 'unsupported'.

This means we need legislation to say that if a security vulnerability affects X number of consumers in a market with a severity Y, a firmware update must be produced and the manufacturer can charge up to Z% of the original purchase price to supply it (for devices which are a certain number of years old - otherwise it must be free). Trying to get a politician to come up with anything so detailed would require expert involvement, unfortunately my definition of an expert, and a politicians definition is likely to differ by a non trivial margin.

Still, good job on the draft :)

Holy DUHK! Boffins name bug that could crack crypto wide open

Re: Trump's writing about technology apparently?

So, before I buy something I need to have a full understanding of every design feature so I can perform a risk analysis?

One: burden!

Two: doesn't feel like I'm going to be able to do this without the source code and tool chain, 48 PhDs and a lot of time

Three: When products degrade due to wear and tear, I expect them to break in a safe manner. I don't expect my fridge to burn down my house and this is precisely why we have legal requirements for their safety. (Yes, these change over time but we still have product recalls as an option. I don't see why the cost should be borne by me except rolled up into the original purchase price)

We need legal requirements which dictate what is and what isn't a safe device. But it's the internet so it's confusing and normal rules don't seem to be adequate.

No: government approved does not equal safe, but there are existing standards bodies that span borders and something similar needs to be in place and enforced........ IMO, maybe I'm just lazy and cheap

Re: Trump's writing about technology apparently?

hmm. while I appreciate your argument, I have many devices (hello TV, hello 'tablet', hello most consumer electronics) which are out of support, and have not been patched. Businesses are usually the same and simply play "hide the weak thing under the blanket of the external firewall".

Just because it was patched 3 years ago doesn't mean there are not hundreds of thousands of devices sitting around unpatched. There have been lots of botnets rolling printers and security cameras into their midst for exactly this reason.

Unfortunately the reality is that sysadmins don't buy all the gear, and it doesn't all get patched, so I think a fairer comparison would be an article like "there could be a problem with cars getting stuck in the tunnel because they run out of fuel as the fuel gauge is incorrect" < and your response is: well, everybody knows to fill up with fuel so this should never happen, and the new cars have a fixed fuel gauge and everybody should update their fuel gauges as soon as new ones are available.

So yes, you're right. But it's worth the article to get the word out to any of us who do have these devices and the ability to do anything about it. It's certainly not on par with Trump's - ahem - political commentary

Ghost in Musk's machines: Software bugs' autonomous joy ride

Easy fix

Train the NN during the mormon cricket migrations in Idaho, that'll squash a few hundred thousand of the bugs

Patch alert! Easy-to-exploit flaw in Linux kernel rated 'high risk'

Re: Dear fanboys of any OS

no Kermit vuln would be exploited by anyone other than an Animal! Just keep a Sam Eagle eye out and hold out your patch Beaker before Crazy Harry takes it to Penguins.

If Windows is Gonzo win the OS war then I for one will jump off Clifford. Bobo Bear with me for a second, I can hear Miss Piggy automating some virtual machines now with the Swedish Chef - ha, what about Puppet?

Flame wars, keep away from the non fire retardant entertainment systems, Statler and Waldorf would laugh at such a pointless and vapid argument

'Alexa, play Charlie Bit My Finger.' I can't do that, Dave. No, really

Internet of Silos

I don't understand why anyone wants these data slurping spy machines. The best feature I've been shown is the echo thing hearing you even while music plays and you speak normally - but isn't that worse!? Every film-goer knows that you can avoid people spying on you by playing some background music - nope....

The big boys won't play nice, and you can buy a shiny that gets shunned by another big player and becomes a big waste of space and money.

Big deal? No.

Dyson to build electric car that doesn't suck

I'd trust the build quality

Lots of comments on the cost... People said they'd never spend £1000 on a telephone.

Times change, Dyson has a good reputation in the UK, and after Brexit we'll need to actually build stuff when the banks head to Paris.

Former UK.gov IT man and Python king's guide to neural networks

Well...

I'd never heard of him, thanks for the article, seems like a decent chap.

I'm impressed he's advised government with 'sensible' advice and managed to get away without being fired!

Fruit flies' brains at work: Decision-making? They use their eyes

if i could fly

I'd consistently head toward the bar, myself

Korea extends factory automation tax break, is accused of levying 'robot taxes' anyway

What about taxes levied on your death? Or for using a public highway (council tax etc)?

You're not exchanging anything there (at the point of taxation, as you're not on the flipping highway). Tax is used to collect money to achieve a goal. We don't want to see all employees relegated to benefits with only 1% or less of society with any disposable income.

So, tax the robots - I'm with Bill.

VW engineer sent to the clink for three years for emissions-busting code

Re: rigged system

I don't.

Also, it's cheque :)

FYI: Web ad fraud looks really bad. Like, really, really bad. Bigly bad

Well.... El Reg's claim of "millions of people who view the ads on our site" is pretty fantastic given that a greater proportion of people viewing this site will be using ad-blockers than in the general web-populace.

It's a bit to do with ad-blockers, because if all the normies are blocking them, then you tend towards 100% bots ;)

I'd say most people only block the annoying ones, of course. For now. I'm quite happy for El Reg et al to serve a couple of non-intrusive ads per article

QEMU qontemplates qleanup of old qode

Re: Oh no, not again...

Disagree

It's more interesting this way, and its good to keep a bit of silly behaviour around as an adult, prevents you going mad.

We all deserve a break. Pack your bags. Four Earth-like worlds found around nearby Tau Ceti

Re: Ummmm

Goodness me they're moving quickly! In the three hours since you posted that Voyager1 has moved out to 138AU!

Either that or we're playing the quote-random-numbers game ;)

https://www.jpl.nasa.gov/voyager/mission/status/

To be fair 40 vs 138 c.f. 794000 (a number I have not checked) is about equal

If we're in a simulation, someone hit it with a hammer, please: Milky Way spews up to 100 MEELLLION black holes

the probability of observing such a collision is high, they're saying, because such masses are common. If they were rare, it stands to reason it would take a longer time to detect them as they'd have happened less often (and you might need a more sensitive detector to get the really old ones which are very 'far away')

Bullock said. "We were able to work out how many big black holes should exist, and it ended up being in the millions – way more than I anticipated."

Dems fightin' words! FCC's net neutrality murder plot torn apart

Huzzah

One of the things the American's got right was the whole 'free speech' protection. Net neutrality just says one person(/application)'s information is no more important than another's. I don't really understand why the parallel is not observed over the pond.

Also see article 19 of the UDHR

Granted, not directly comparable, but I'd say the underlying moral principles are the same. What do I know.

DJI drones: 'Cyber vulnerabilities' prompt blanket US Army ban

Make America great again

Got that syncing feeling? Cloud's client-side email problem

Algorithms to the rescue

Surely we just need to wait for a better algorithm?

For the 'tidy up' scenario:

Build an index of folders and their contents, and hashes of both, check the index against existing folders to detect "moves" done outside of the main sync program, obviously follow up matches with more detailed comparisons before assuming they're the same. If a folder contains the same number of files with the same names/updated dates, with some statistically significant proportion of matched hashes, you're free to assume that's a rename operation and don't bother re-syncing

For the whole office sync example:

Copy microsoft and designate a local proxy which does all the syncing, clients sync to that instead of the mothership

An aside on the Google sync on Mac example:

Software has bugs - this is a problem with cloud sync applications specifically??

Brace yourselves, Virgin Media prices are going up AGAIN, people

Re: Is this to fund upgrades so they can fix the horrific congestion?

@werdsmith

Nope you're not, I use that for my parents house (designated tech support), but BT does jump about and I'm occasionally forgetful - I do prefer a static address. I'm not running anything commercial so can't justify the expense of a proper DNS set up (and I'm too lazy to do it myself)

Re: Virgin Static IP

Aye Vince, that's true. But I never had to reconfigure my dns records so for all intents and purposes it was static for me.

I love a pedant though so have an upvote :)

Re: Is this to fund upgrades so they can fix the horrific congestion?

I had virgin as a student, and in a couple of house shares in London. It was always awful in the evenings and weekends - which, shockingly, is when a lot of people want it. Their customer service was terrible, and when I averaged out the speeds vs. what I was paying, it was quite expensive for the market. YMMV

I use ZEN. They hire the copper/fibre off BT, but I get a fixed IP (same as Virgin), consistent speeds (never seen it drop below 40Mbps of the maximum down (or below 18 up), and the customer service is second to none. Used that in two addresses and have never had an issue. You have to pay a fair wad, but not as much as this guy: http://www.bbc.co.uk/news/uk-wales-mid-wales-40745533

I highly recommend it. I prefer a stable connection over 'up to' promises every time.

UK waves £45m cheque, charges scientists with battery tech boffinry

Re: So where would that leave developing a sugar solution fuel cell?

"we still have no idea how to deal with the long-lived radioactive waste fission reactors produce"

Sure we do!

Bury it.

I'm serious, that works. The planet it massive and we can keep it away from ourselves, who cares about a few worms 2 miles underground? The damage we do to ecosystems globally by not using carbon neutral generation is on such a vast scale that I find the 'oh no, nuclear waste' argument ludicrous.

O2 admits to throttling network bandwidth for EU data roamers

The Glastonbury thing will be because the festivals set up their own masts. When you dial 999 at Glastonbury you get directed to a dedicated call centre on site so they can get to you. It's not much good dispatching an Ambulance from a little village for someone passed out next to Main stage.

Truckfest was probably using the same kit/company and Google's metadata hadn't updated that the Mast Ids had moved (probably more people at Glasto weighting the algorithms)

That is just a guess :)

Let's harden Internet crypto so quantum computers can't crack it

Re: @ Technical Ben ... @ Mark 65 Possible deadly flaw - compromised software

Mr Gumby...

You've suggested that you can produce randomness by using a random file. A portion of which randomly selected using two - other random numbers, then hashing the result to use as your key.

So... using a random number of random length, and then applying a function to reduce the randomness... as a source of randomness?

Despite the fact that I fail to see how your magic random numbers (the three of them) are produced.; your system fails to address how to communicate such a (weakened) key without eavesdropping. That's the point, and you're just saying words, then suggesting security - by - obscurity as a defence.

I don't like the number of posts you've made, especially because they're all (edit: removed expletive) gibberish. Learn university level maths (and what rhetorical tautology is), research basic cryptography, then read this article again. Then go read the (edit: again, sorry) RFC, then go read the publicly available research papers and come back and specifically explain yourself.

UK spookhaus GCHQ can crack end-to-end encryption, claims Australian A-G

Re: Confirmed endpoint breaks

Good point, but it isn't the default setting. You're prompted on first run; on Android anyway

Ransomware-slinging support scammers hire local cash mule in Oz

Re: Fraudulently set up a company

I have to politely disagree there mate. That is exactly what Limited companies are for.

If you set up a company to sell IT equipment, and it's ticking over nicely - to the extent that you don't need to input more than a few days a year - then you may find twiddling your thumbs a little boring.

Now let's say, you think to yourself "I don't think I can grow that anymore, diminishing returns and all that, but I reckon there is another market I can pursue in cleaning peoples houses."...

Why jeopardise the payments/deliveries to the suppliers/customers of the IT equipment company by taking on additional risk that is nothing to do with that revenue stream?

Set up another business! Then if a cleaner goes berserk and steals millions of pounds of someone else's property/kills someone/whatever - to the extent that your business insurance will not cover the damages, the cleaning company is rightly responsible - but not the IT equipment company. (<you can see I have no idea what companies a liable for, but I think the point stands)

There are infinitesimally small risks that something horrendous might happen in one line of business that destroys it (and larger risks, obviously). Limited companies exist for that reason, perfectly legally and perfectly logically.

The fact that you are responsible for two things does not make those two things responsible for each other. For example, if the EU decided (and was able) to fine Google 100,000 times it's annual revenue because of it's practises in the EU - the American/Global business would have to fold completely so that the EU is paid. That's a nice money extraction mechanism, but I think limited risk is more sensible.

p.s. I don't own/operate any businesses :)

Judge used personal email to send out details of sensitive case

Re: A digital watch?

When AI can work out what that comment was supposed to mean - actually work it out, not look it up - it'll be ready to be a child. Probably then needs a couple of years to giggle until it can be trusted to drive cars around.

Off topic but I was just reading another article about AI, apologies

Zero accidents, all of your data – what The Reg learnt at Bosch's autonomous car bash

1) My car can read speed signs already. I'm pretty sure it's actually doing it, as it's triggered by physically passing them - and they are sometimes not in sync with what the GPS thinks is the limit. If you're going to cover the car in cameras, you don't need ground control telling you what is in front of you.

2) How would reporting icy road conditions *not* leak geolocation info about your car. You can bet it won't be able to phone it in without the correct car authorisation/identification number.

For these to be useful, they need to be able to drive when the modem breaks/I wrap it in tinfoil/squirrels get in. Yes it needs over the air updates, but those should not be done while it's in motion - and I should be able to choose when (within reason) and where it talks to the mothership. Unless it's been in an accident - piss off and let me get on with my secret midnight snack runs.

FREE wildcard HTTPS certs from Let's Encrypt for every Reg reader*

Re: Oh, I wish it was just as simple as that

#1) Get certs (either generate your own CSR or use default LetsEncrypt cert)

#2) modify the apache configuration files and your server hosts file: add hostname (example.com) to /etc/hosts and /etc/apache2/sites-available/default-ssl

#3) Put your certs in the right place (according to your Apache config, but really makes sense to put them with the rest of them

(sudo) cp mypubliccertificate.crt /etc/ssl/certs;

(sudo) cp myprivatekey.pem /etc/ssl/private;

#4) Make some changes to your server to lock it down, in apache conf:

SSLProtocol -All +TLSv1.2

SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA

SSLCompression off

#in default-SSL:

add ServerName

point to new certs in /etc/ssl (SSLCertificateFile and SSLCertificateKeyFile )

If you get stuck anywhere, RTFM: http://httpd.apache.org/docs/2.4/ssl/

Things are not that simple because we're talking about obfuscating messages using large prime numbers so somewhere someone needs to put the effort in. If you don't want to do it yourself, pay for hosting and tick the box that says HTTPS :)

Create a user called '0day', get bonus root privs – thanks, Systemd!

Arghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

Fucking Poettering.

That is all.

Tesla, GitHub, tech bro VCs... Silicon Valley sexism row explodes as more women go public

It is human nature to keep track of debts owed to you - (my personal belief to explain this) in a tribal society it would help you regain resources you 'lose' by 'charity'.

It is ignorance and arrogance to equate financial investment/career progression/general business influence given to/used on behalf of an individual as a debt - and it is ludicrous in the extreme to assume that it can be repaid by sexual reciprocation.

These men are socially and morally retarded. I say that as a man. I say that as a human.

Edit: I mean retarded in the proper sense, not as a derogatory slur