Posts by ecarlseen

Version 252 of systemd, as expected, locks down the Linux boot process

Systemd is the windows-ification of Linux

Linux has traditionally stayed mostly true to the UNIX ethos of having lots of small, preferably interchangeable, tools do specific things extremely well as opposed to one giant blob of code that everything has to rely on. Systemd goes 180º against that ethos. In many ways it's just as bad as a BLOB - a giant tangle of garbage code that you are more or less forced to put up with if you want to deal with a commercially-suportable distribution (sorry, people, this is important for a lot of businesses even if it's just a useless security blanky for upper management).

The world was promised 'cloud magic'. So much for that fairy tale

Not always true.

I was skeptical of cloud infrastructure from day one because in my entire career I had never and have never seen anything close to the hard sell behind the cloud.

We all know what this was about: companies forcing customers into recurring revenue models even though they're no longer adding much (or any, or even negative) value to their products so that they can maintain their P/E ratios and stock prices.

That being said, there are many companies that can benefit substantially by moving their infrastructure to the cloud. These are the companies whose CIOs and Vice Presidents of IT are so thoroughly inept and run such bloated, inefficient trash fires of departments that moving literally anything further outside of there sphere of influence can save lots of money.

Removing an obsolete AMD fix makes Linux kernel 6 quicker

Re: The older the OS...

OK, I'm going deep nerdcore on you:

GeoWorks Ensemble, a little-remembered Windows 3 competitor with core functionality written in hand-optimized assembly language. It ran reasonably-well on 8086 machines in 640K and smoking fast on an 80286 with 2MB. Great multi-tasking, and I never saw a crash on it that couldn't be traced to a bad memory chip.

They never released and SDK, therefore nobody could write apps for it, and it died in obscurity. But it was seriously sweet for what it was.

AMD's Ryzen V3000 goes head to head with Intel's embedded chips on power, oomph

Synology has been transitioning to AMD embedded CPUs for their midrange NAS devices. Not surprising after the massive problems they had with defective Celerons.

SpaceX Starship booster in flames after unexpected ignition

The event occurred at 4:20 PM, so this may just have been another very expensive troll by Elon Musk.

What to do about inherent security flaws in critical infrastructure?

Many of these protocols run in air-gapped environments which limits the utility of many of these exploits to requiring somebody to be physically on-site in environments full of deadly hazards. If necessary, all of these protocols can be wrapped in infrastructure that secures them all the way down to at the wire level. Also keep in mind that simplicity can be a physical security / safety feature. If a connection between two devices suffers an authentication failure and that failure, say, causes an explosion at a chemical plant, was the addition of authentication to a system that could only be exploited at the wire level by cutting into conduits really a smart trade-off?

BOFH: Something's consuming 40% of UPS capacity – and it's coming from the beancounters' office

I have literally seen some of this happen.

Floor heaters plugged into the red "backup power" plugs? Been there, done that.

Attackers exploit Spring4Shell flaw to let loose the Mirai botnet

FFS am I literally the only person who puts /tmp on a seprate volume and mounts it with noexec set?

Android's Messages, Dialer apps quietly sent text, call info to Google

Why not just let people flag and report spam?

Is the easy and obvious solution that difficult?

China thrilled it captured already-leaked NSA cyber-weapon

Every country does this. Every country whines about it.

What's worse than nation-states not being able to keep their cyberweapons under control?

The endess self-righteous pearl-clutching over other contries doing it (especially here in the US).

Selling the bizarre fantasy that this will ever stop being a thing.

Pretending that solutions other than better security exist.

Samsung shipped '100 million' phones with flawed encryption

Re: But...

Apple is excellent about patching (and strictly prohibits third-party app bundling on any hardware they sell) and Samsung has gotten much better about patching as well. This is mostly a problem with the smaller vendors.

Fujitsu confirms end date for mainframe and Unix systems

The Cloud does not replace a mainframe.

As mentioned before, organizations use mainframes for applications that cannot ever go down, ever, for any reason. Mainframes usually deliver somewhere close to their 99.999% uptime guarantees in the real, messy world that we actually live in. It's far from unheard of for them to have zero downtime over the course a year. How many other systems offer that kind of uptime anywhere outside of their marketing materials?

I mean, there's in article in El Reg today about how many vendors lie through their teeth about their uptime metrics, and everyone with experience is nodding along as they read.

https://www.theregister.com/2022/02/24/cloud_service_status_pages_fail/

In fairness, not many applications really require five 9s of availability, but for those that do a mainframe is still a very respectable option.

Ubiquiti dev charged with knocking $4bn off firm's value after insider threat spree

Re: Either way, this is an indictment of Ubiquiti

Customers (and Ubiquiti, for that matter) had no way of knowing the difference and had to react accordingly. "No significant damage was done" only if you assume this costs nothing.

We must deal with information that we are given. We then evaluate the credibility vs. the costs / benefits of reacting. In this case, the most reasonable response was to react as if the information was true.

The problem is that Ubiquiti made themselves custodians of data whose security was absolutely vital and wound up in a position (due to decisions they made) where they could not determine the security of that data.

In fairness, this is an extremely difficult problem to tackle well. But if a company is making that commitment on a large scale, then they need to be able to deliver on that commitment. Ubiquiti failed catestrophically.

Either way, this is an indictment of Ubiquiti

Even if all of these allegations are true, I'm not sure if this makes Ubiquiti come out looking better or worse. If one person can cause this much infrastructure-level damage, what does it say about their infrastructure security architecture and overall commitment to security?

One of the reasons I've been sharply critical about the mass-centralization of vital data is that it increases the value of a security breach to obscene levels. Even if an inside threat isn't inherently malicious, what about blackmail, extortion, etc.? There are many parts of the world where grabbing somebody's family and cutting off parts until compliance is reached is not exactly out of the question. I would never blame that person for complying. And if the value of a large-scale breach of, say, Google or Microsoft's cloud-hosted workspaces is in the hundreds of millions or even billions of dollars / Euros / pounds, how do you even defend against some group with the budget and discipline to make a serious, no-holds-barred attempt at that? With the current state of international relations, can we even rule out governments (including the "civilized Western" ones) if they're not in it for profit, just creating mass damage?

Our industry has had many bad experiences caused by the technological equivelants of biological monoculture, and instead of learning from these it seems to be betting harder and harder on this.

Even before information technology, there was an adage about putting all of your eggs in one basket.

Ecommerce platforms (cough, Magento) need patching before Black Friday, warns UK's National Cyber Security Centre

Magento updates are a mess

One of the big reasons people don't update Magento as much as they should is that the update process is a complete trash fire. Since Adobe took over the updates have been of the quality we expect from the people who brought us Flash. For example, a recent security patch in the 2.3 release train cut out compatibility with PHP 7.2, and if you have critical third-party modules that don't like PHP 7.3 or 7.4 yet then tough luck. For complex sites it can take several weeks or months of re-development work to fix this, and to have it dumped on you without any notification is just sloppy.

Cisco thinks you're happy to wait ages for new kit, then pay premium prices

Re: cancellations are down

Exactly this. We were Cisco fanatics for years because they had the cool features we wanted and more importantly they delivered the closest thing you could get to a guarantee of no unscheduled downtime.

Neither of these is the case anymore. The features in question have long since been commoditized, and Cisco reliability is nowhere close to what it once was. In fact, we're seeing much better reliability from products that cost less than 1/10 as much - because they have far simpler software stacks based on mostly on generic Linux functionality that's stable, tested, and mature. I'm fine with that if it gives us the features and performance that we need. And I'm delighted with spending less money for better uptime.

This was a problem before the lockdowns

I do most of my work in the SMB space ($10s to $100s of $Ms in revenue) and we've had lead-time issues with Cisco for years. Granted, these were "weeks and months" not "months and quarters." But still. I get that companies don't want to have inventory on the books, but Cisco has been taking JIT to such a ridiculous extreme that any disruption was going to be painful and a huge disruption has created absurdity.

Let's just call this what it is: a company deliberately shifting its inventory management risks (and associated costs) onto its customers.

Yes, carrying inventory costs them money - it ties up capital and capital has cost. But inavailability costs their customers far more. It is perfectly clear where Cisco's priorities lie, and they are not with their customers.

I started moving my customers away from Cisco a while ago because of the costs of project delays, along with their noticeable decrease and ongoing decline in software quality over the last decade or so.

Perhaps other customers and consultants should consider the same.

Google's Pixel 6 fingerprint reader is rubbish because of 'enhanced security algorithms'

How is this even a thing in 2021?

Meanwhile, my iPhone builds a 3D model of my face and compares it in near real time.

Google experiments with user-choice-defying Android search box

Re: Ban the Blob

I have this crazy solution for this called: “I don’t use any Google products [well, except for compatibility testing] and I help others to not use any Google products either.” Nobody forces anyone to use their shit.

Oh ffs El Reg, shill for Google much?

The one itsy bitsy witsy little difference being that Apple’s implementation *forces* all apps to respect the user’s browser preferences, which is a huge plus for user privacy. And which is the complete and total opposite of what Google is doing.

Of course, in The Register this is not worth mentioning. The comparison is made without context. The article just spews the Google propaganda response, almost making you wonder if the author’s real intent is to say “Yes, Google is doing something terrible, but so is everyone else” when nothing could be further from the truth. Even the mention of Microsoft’s annoying behavior with Edge doesn’t really compare in any meaningful way.

VMware shreds planned support for 'cheese grater' Mac Pro

It would indeed be nice and it was confusing at first but now the reason is obvious. With the planned transition to Apple Silicon they probably didn't want to validate another CPU architecture and deal with the differences instruction sets and other CPU-specific features, optimizations, bug workarounds, etc. for two or three years of products.

Report details how Airbus pilots saved the day when all three flight computers failed on landing

Re: Hit the brakes hard?

Have to be awake to do that afaik.

My saying...

"Never trust a computer completely for anything too important."

Microsoft abandons semi-annual releases for Windows Server

Re: More pincer movements for Azure

The funny thing is that the relative instability and forced pace of change with Office365 is undermining Microsoft's biggest lock-in: people being unwilling to switch to an unfamiliar office suite. Now that there are alternatives for Word and Excel that are reasonably feature-compatible and Outlook is no longer as "must have" as it used to be, there just isn't as much of a reason to care about Windows outside of vertical market systems that aren't cross-platform or web-based. I'm finding myself using Windows server less and less, and Windows desktop almost not at all.

Few enterprises want continuous release

Outside of certain, relatively narrow cases, the concept of continuous release software is an absolute dumpster fire. What most businesses want and need is stability and control. Every change is both an expense and a risk, and most changes being pushed incur this without adding value.

Iranian state-backed hackers posed as flirty Scouser called Marcy to target workers in defence and aerospace

Re: Retaliation

Are you saying that the UK Cyber Defence Force would dare imply that gender is binary?!??

Samsung commits to 5 years of Android updates... for its enterprise smartphone users at least

Re: 5 years from when ?

Yeah, but that's every tech vendor on the planet.

Cisco names Micron as supplier of SSDs that make Nexus and Firepower kit snooze

On the plus side, we can't buy this kit anyway.

Cisco has been problematically committed to JIT inventory for years now, leading to unnacceptable supply delays. Right now with the current supply chain messes, lead time on Firepower gear is over four months. So, in a sense, the problem has resolved itself.

'Millions' of Dell PCs will grant malware, rogue users admin-level access if asked nicely

This is “we don’t care” level of competence.

Like the Intel vPro remote management bug the other year that would accept a null string instead of a password, this is Dell saying “we just don’t care about security.” This never could have passed any meaningful code review or internal red teaming.

Samsung stops providing security updates to the Galaxy S8 at grand old age of four years

"For an Android"

No one dare speak of the other major mobile device vendor that is currently providing updates on even their low-end devices for 5-6 years past introduction and 2-3 years past end-of-sale, without anyone having to make a fuss about it. (note to butthurt downvoters: your tears are delicious).

Michael Collins, once the world's 'loneliest man,' is dead. If that name means little or nothing to you, read this

If that name means little or nothing to you...

... just hand in your geek card now and start reading TMZ instead.

Best of FRANDs: Judge allows Apple retrial following $506m patent infringement ruling

Ah, the Eastern District of Texas Federal Courts - Friends to Patent Trolls.

The courts in this district have essentially created a "business" of being extremely litigant-friendly in IP disputes. By encouraging patent trolls to file there, they need more judges, more staff, etc. It's very shady, and anything decided there should be viewed through that lens (and these are federal courts, so don't blame it on Texas - they have no say in the matter).

Zorin OS 16 beta claims largest built-in app library 'of any open source desktop ever'

Wine and Crossover are nowhere near ready for prime time.

I love the idea of both, and both can be of great use to hobbyists and enthusiasts. But as a mainstream mechanism for running Windows apps in Linux? No freaking way. I know how to troubleshoot issues with these systems, and even I simply lack the patience. Someone without the background knowledge would just be frustrated beyond all belief. At the end of the day, it's easier to run Windows as a VM if there are Windows apps that you simply can't get away from (or Windows on bare metal / dual boot for gaming).

That being said, for users who simply need a consistent look-and-feel and aren't hopelessly married to apps like Outlook and Visio (for example), this looks like an interesting project. Ironically enough, Microsoft's constant monkeying with their app UX has made transitions to alternatives like LibreOffice much more palatable. But promising or even suggesting Windows compatibility will likely backfire horribly in the market they're trying to enter.

Asahi Linux devs merge effort to run Linux on Apple M1 silicon into kernel

Relax already

I don’t know if the results need to be integrated into the official kernel, but reverse-engineering bleeding-edge hardware enough to make Linux even semi-functional is a cool project that builds and exercises all kinds of worthwhile skills. I’ll probably never do anything with it, but I have tons of respect to this team for their work.

W3C Technical Architecture Group slaps down Google's proposal to treat multiple domains as same origin

Re: the W3C Technical Architecture Group (TAG)

I currently have a 4:1 upvote:downvote ratio, which I think is healthy. If I'm not getting blasted with downvotes on occasion then I'm probably not contributing anything interesting to the discussion. If people can't detect irony, sarcasm, or satire then... oh well. Their tears taste sweet to me.

And, yes, I already know which groups of people might upvote this and which groups of people might downvote this. Whatever.

Vegas, baby! A Register reader gambles his software will beat the manual system

As someone who lives in Vegas, you might want to be a bit more specific about what a "T&A system" is. The first guess would not be the correct guess.

Outsourced techie gets 2-year sentence after trashing system of former client: 1,200 Office 365 accounts zapped

No excuse for the criminal... or the company

So many companies assume that because their systems are cloud-based that they don't need separate backups. This should have been a straigthforward restore operation - still very damaging and deeply inconvenient, but not a half-a-million-dollar problem. Also left unanswered is how the criminal was able to get access to delete these accounts. With 2FA required for admins, the most likely explanation is that the client or contracting company was sloppy with access control. This is extremely common with outsourced IT work - lots of password sharing with few controls and audit trails, and passwords aren't changed even when a disgruntled employee leaves. I strongly doubt that it was some sort of "sophisticated attack."

Micron: We're pulling the plug on 3D XPoint. Anyone in the market for a Utah chip factory?

Unmentiond in the article...

XPoint never even came remotely close to predicted speed, latency, or write endurance.

Netflix reveals massive migration to new mix of microservices, asynchronous workflows and serverless functions

Huh. I wonder if they had ever just considered producing and licensing less crappy content. Could have saved money all over the place.

After spending $45bn on 5G licences, Verizon tells customers to turn off 5G to save battery life

Re: High battery usage

iPhone 12 models have a mode that auto-selects 5G only when it's available and won't significantly impact battery life, and reverts to LTE the rest of the time.

Re: What they need in cellular settings

"What they need in cellular settings is a toggle between 'best speed', 'best signal' and 'least power use'."

The iPhone 12 has this.

You can set it to use 5G only when the signal is strong enough to avoid meaningful excess battery drain (Settings -> Cellular -> (phone number) -> Voice & Data -> 5G On / 5G Auto / LTE), and there is also a setting it to control more- or less-aggressive cellular bandwidth consumption when 5G is available to improve streaming quality (Settings -> Cellular -> (phone number) -> Data Mode -> Allow More Data on 5G / Standard / Low Data Mode).

Splunk junks 'hanging' processes, suggests you don't 'hit' a key: More peaceful words now preferred in docs

These changes are plusplusgood.

Synology to enforce use of validated disks in enterprise NAS boxes. And guess what? Only its own disks exceed 4TB

In Synology's defense, we see a whole lot of stupid in this area.

I'm not personally thrilled about this change, but I can see why it makes sense. We've sold and maintained a ton of Synology units. In the ones we don't spec or sell, people will just throw the cheapest garbage hard drive they can in them with literally no regard whatsoever for fitness of purpose. This has become more and more important as higher recording densities have pushed manufacturers into producing more and more specialized firmware to optimize performance for specific tasks (standalone, general-purpose RAID, drives that mostly do sequential writes for things like DVRs, write-once/read-rarely applications, etc). The wrong drive will run relatively poorly and will likely fail early, and who is the customer going to blame? Themselves, for choosing the wrong drive? Guess again.

We'll see how well Synology handles this. Their branded SSDs are a decent value for what they are, and if they follow the same practices with HDDs then I'm ok (not thrilled, but just ok) with this unless supply constraints start interfering with rollouts.

Chip fab Intel said to be using better chip fab TSMC to make 5nm Core i3 processors, 20% of its non-CPU parts

Re: Single point of failure

TSMC is building a leading-edge fab in the U.S. so there will be some geographic diversity if China and Taiwan start fighting. Other than that there’s Samsung. GloFo seems to have dropped out of the bleeding-edge fab race.

TSMC yes. Leading nodes, no.

That Intel will be using TSMC to fab CPUs is not exactly a secret anymore. But why would they give a rival fab looking for an interim solution wafer starts on their leading nodes when their loyal and long-term customers are willing, able, and eager to fill that capacity? Intel is begging for scraps and that’s what they’ll get.

To plug gap left by CentOS, Red Hat amends RHEL dev subscription to allow up to 16 systems in production

Can't put the toothpaste back in the tube.

Announcing LTS for CentOS was a huge commitment that influenced a lot of behavior (including ours). To back out on it creates a significant reputation hit, but one that could have been managed if done in a halfway intelligent manner. To back out without notice for organizations to change their behavior is the reputational equivalent of dropping a thermonuclear bomb on themselves. It's complete annihilation. There is no coming back from this. RHEL is dead to us, because they have rendered their commitments have been rendered meaningless.

Taiwan’s silicon titan TSMC says three-nanometre tech is on track for 2021 debut and a 2022 flood of kit

“...and other effects”

Other effects like Intel hiring a bunch of drunk frat jocks to do their process engineering.

Geekbench stats show Apple Silicon MacBook Air trouncing pricey 16-inch MacBook Pro

Unsurprising results

Apple's A-series CPUs have been knocking on Intel's laptop performance door for a few years now, and that was from a position of dealing with the thermal and power constraints of a cell phone form factor. That they are blowing Intel away in a laptop should be expected. Let's start at the beginning - Apple's CPU team was recruited / purchased from companies specializing in highly-optimized CPUs. They got the right people. Their CPUs are now effectively two process nodes ahead of Intel (TSMC 5nm vs. Intel 14+++++++++++nm for their volume parts, which is most comparable to TSMC 10nm). They also have a simpler instruction set to optimize for, no 32-bit backwards compatibility issues, and they can hyper-optimize for one OS. Not to knock Apple - this is amazing work - but it's the amazing work we've been expecting when a company gets the best people and gives them a gigantic pile of money to work with.

With so many cloud services dependent on it, Azure Active Directory has become a single point of failure for Microsoft

Not all downtime is equal.

With private cloud services, we balance the risk of maintenance operations agains the impact against business operations and schedule accordingly. The impact of a massive system failure at 2AM local time on a Sunday morning is not the same as 10AM on Monday morning. This does not mean nothing ever goes wrong, but it means that we tilt the odds as far as we can in our favor and for the most part it works out very well.

With public cloud services, every site is servicing customers in every time zone and maintenance operations are performed at any time of the day or night (relative to us) with precisely zero consideration of specific customer impact and there is precisely nothing you can do about this.