Posts by Rabbi

iPhone 5: the fab slab to grab

Try Targus Atmosphere

I've been using a Targus Atmosphere TNT007EU for about 5 years. So good I just bought another off eBay, plus 5 more for other colleagues. You can currently find them for £17.

The description says 15.4" - don't be fooled. My regular laptop is an old 17.1" HP model - full widescreen and not very thin. The case regularly carries the laptop, loads of papers, large assortment of cables, 2 CD wallets, 4 LTO backup tapes and an external DVD drive. There is room in the proper laptop compartment for 2 laptops or maybe 3 if they're thin - and dividers to keep them separate.

The rear compartment expands - it has an all-around zip that allows it to be made larger. Even without doing that I have carried my lunch in there. The pictures show it expanded and holding a printer and that is certainly possible.

The strap is wide and compfortable, although the one time I carried 3 laptops, I wasn't sure I could trust the stitching and metal attachments, so I used the handles - which are also quite good.

Emotional baggage

Try Targus Atmosphere

I've been using a Targus Atmosphere TNT007EU for about 5 years. So good I just bought another off eBay, plus 5 more for other colleagues. You can currently find them for £17.

The description says 15.4" - don't be fooled. My regular laptop is an old 17.1" HP model - full widescreen and not very thin. The case regularly carries the laptop, loads of papers, large assortment of cables, 2 CD wallets, 4 LTO backup tapes and an external DVD drive. There is room in the proper laptop compartment for 2 laptops or maybe 3 if they're thin - and dividers to keep them separate.

The rear compartment expands - it has an all-around zip that allows it to be made larger. Even without doing that I have carried my lunch in there. The pictures show it expanded and holding a printer and that is certainly possible.

The strap is wide and compfortable, although the one time I carried 3 laptops, I wasn't sure I could trust the stitching and metal attachments, so I used the handles - which are also quite good.

LOHAN to brew thermite for hot ignition action

How about plugging the igniter itself?

I've got no experience here so I could be talking from my nether regions but . . .

If the problem is dissipation of the igniter flame, how abot putting a "plug" directly over the igniter. Presumably it's shaped like some sort of rod in contact with the fuel. Could you perhaps put a lump of something directly on top of the igniter?

Obviously the low-temperature is a consideration on what you use. I'm thinking something like silicone sealant, clay or even araldite. Whatever you use, all it has to do is confine the flame against the fuel long enough for the fuel to ignite. It will then presumably get burnt away. I'm assuming that the remains of the plug are not a massive concern given that there is presumably debris left in the combustion chamber from the igniter anyway?

Pipex 'silence' condemned punters' emails to spam blackhole

Some servers may still be blocked.

We were a Nildram customer - swallowed up in the same chain that ended in the bowels (and you know what you find in bowels) of TalkTalk.

We first had some emails bounced on 8th May. I contacted TalktTalk the same day: I provided them with all the information as to why emails were being blocked, including the website where they could see that the IP address was being blocked AND EXACTLY WHY it was blocked. It took me nearly an hour to explain it all to them and I still don't think the idiot understood or believed me. I just took a guess and started sending email (successfully) via smtp.tiscali.co.uk instead of smtp.mildram.co.uk.

On 19th May I got an email from TalkTalk. Pathetic: "it's not our fault", "a 3rd party has blacklisted us", "they are refusing to de-list our servers". They gave me another SMTP server to use which I ignored. Note that this response is after your article says the blocks were lifted.

After reading the article I phoned TalkTalk again. Another moron who doesn't recognise my account number, doesn't recognise the reference number on the email I was send and doesn't understand the problem fully. This moron informs me that "75% of the IP range is now unblocked, 25% is still blocked". Once again, this "isn't our fault" and "they blocked us for no reason". I would black-list TalkTalk - and the reason's got nothing to do with spam!

So, a couple of possible corrections to the article. Blocking certainly started on 8th may or earlier. By 19th May (according to TalkTalk) the problem had not been resolved. Today (again according to the morons) the problem is STILL not entirely resolved.

Actually I believe the last bit. Until a nuke is dropped on TalkTalk HQ, the problem never will be solved.

What is SpaceX Dragon's secret cargo?

It won't be spam

"Spam in a can" has already been to space - that's how early Mercury astronauts were described, due to being passengers in largely-automated capsules.

Plus, Space-X want to get some real humans up there soon. I'm sure they don't want us thinking about spam in a can then.

Survey: Most TV viewers surf while they watch

The wonders of DVR

I surf whilst watching too - but that doesn't make me miss the adverts because I never watch them!

Thanks to Windows Media Center, I record almost everything I watch - even if I'm going to watch it that night. As long as I start watching 10 minutes after the programme actualy starts, I step forward through all the adverts (9 x 30 second jumps for the "average" UK ad break).

And, of course, if I want to look up something prompted by the programme, I hit pause.

Windows 7 service pack to land this month

See this month's Windows Updates . . .

. . . they included 2 patches for Windows 7 that are required before installing SP1.

Presumably issues were discovered after the service pack "hit manufacturers" and they are waiting for Automatic Updates to spread the fixes before they consider RTM.

Windows users ambushed by attack on fresh IE flaw

Group Policy Fix

I remember having to work hard the first time to set up a method of setting killbits with group policy. Then I found the following article:

http://msinfluentials.com/blogs/jesper/archive/2006/09/29/Set-KillBit-on-Arbitrary-ActiveX-Controls-with-Group-Policy.aspx

As soon as I had the CLASSID, it took 5 minutes to add it to group policy and protect 100+ computers.

I just hope this helps anyone else wondering how to deal with it!

Boffins boil down witch-repelling brew

Witchfinder General's Security Advisory

We have reports of active attacks against WG witch bottles. They are being stolen by practitioners of Voodoo and the hair and fingernails contained therein are being used in directed Voodoo attacks.

There is currently no patch available for this issue. As a workaround, users are advised to bury their witch bottles as deeply as possible.

Windows patching abysmal, and getting worse

Very misleading . . .

. . . although I'm not sure whether it's Secunia of El Reg mis-quoting.

PSI scans all files - whether software is installed or not. For example - I have multiple MS Office 2000 problems because I have a folder containing the installation source. I upgraded to Office 2003 some time ago, but that folder is good for half a dozen "unpatched" warnings.

PSI also highlights several programs that are "end-of-life" but don't have any known security issues - simply later versions available.

Having said that, I still think the program is excellent, as long as you have the experience to evaluate the warnings. Does anyone remember BigFix? I think MS do a great job of patching Windows (shame they have to though!). It's about time we had another service that can do a reasonable job of looking at a wide range of other companys' software.

Daily Mail hacks get emergency bird flu jabs

Is this ANYTHING to do with BIRD flu?!

Am I the only one who's noticed?

Lester doesn't give a link for the original article. But nothing he quotes from it says anything about BIRD flu.

Whether or not there is a real risk of a HUMAN influenza pandemic right now, I couldn't say. If The Daily Mail think there is, they might well get their people Tamiflu shots.

The NHS routinely offer flu jabs to vulnerable groups every winter, yet I don't recall this triggering a spate of hysteria about bird flu.

US retailers start pushing $20 Ubuntu

It's not a complete install package . . .

For the first time in quite a while, this update is NOT a complete re-installation of Adobe Reader. It's just a 2.2MB msi installer (for Windows at least) package.

This is a good deal better for sysadmins - I can deploy to 100 computers spread over 6 sites without anyone moaning about the download/install time!

Street View spycar prowls Inverness

You are in breach of . . .

. . . something, certainly. You are showing the Google-car's number-plate! Not only that, you show the number plates of the other cars around it! Suppose one of those people was actually supposed to be somewhere else at the time - they're exposed now.

If Google say they're going to blur the number plates (and faces), shouldn't El Reg?

AVG disguises fake traffic as IE6

You can't block IE6

@Martin Owens - My company uses a legacy application that works through the browser - and won't work properly with IE7. IE6 is still supported software and our patches are all up-to-date. I'm not saying we're not unusual, but IE6 is not so bad that it should be "banned".

And generally speaking, I'm not impressed with AVG8 (I use it on my personal PCs, not work). It IS turning into Norton - bloated, toolbar, unwanted Yahoo search integration, obtrusive notifications. I've disabled LinkScanner - and have to put up with the notification icon that constantly tells me there's a problem.

My solution? I'm going back to AVG 7.5 and recommending it to all the people who ask me. I still have the installer on a USB key and it looks like updates - at least - are still available on the AVG website. Certainly my kids' PC is still running 7.5 quite happily.

If/when AVG sort their act out, I'll start using/recommending their product again - unless someone else has won my vote by then!

Adobe update foils Reader and Acrobat exploits

It's not a complete install package . . .

For the first time in quite a while, this update is NOT a complete re-installation of Adobe Reader. It's just a 2.2MB msi installer (for Windows at least) package.

This is a good deal better for sysadmins - I can deploy to 100 computers spread over 6 sites without anyone moaning about the download/install time!

Ofcom pulls plug on wholesale broadband regulation

@Jolly - LLU Providers

Have a look at samknows.com.

3 clicks and I now know that there are 8 LLU operators listed at my exchange, whilst the average for the 149 exchanges in the London area is 10.48.

Straw launches inquiry into Muslim MP bugging case

Why the security services shouldn't bug politicians . . .

. . . because they are controlled by the government. If they bug politicians, the information then goes to people who are effectively "in competition" with the person under surveillance.

If MI5 report a security indiscretion by David Cameron to the government, they could use that information against the Tories. On the other hand, if it's a Labour minister, they can choose to ignore it.

In Spycatcher, Peter Wright refers to controversy about Harold Wilson, where MI5 were either being used for political ends, or may have been pursuing them themselves.

Of course, there's no spying ban because the politicians are "clean" - it's more likely that the Security Services couldn't handle the amount of dirt they'd find if they investigated them all!

Camouflaged code threatens security apps

@BitTwister

"nearly infinite"

Well, you're right, there can only be an infinite number of file inputs if infinite file length is possible which, of course, it isn't. The point is that the number of FEASIBLY possible file inputs might as well be infinite.

If, for example, you consider ONLY files of 4MB in size. There are 2^25 possible such files. A 128-bit hash has 2^7 possible values. Therefore, on average, each hash value can be derived from 2^18 different files.

As John Stag kindly pointed out, we can already provide security that is theoretically impossible to crack by brute-force methods. The problems arise when weaknesses in the security algorithms make it possible to bypass these theoretical limits and find a solution more directly.

Winword.exe on my system is over 12MB in size. I'm pretty sure a decent (?) piece of malware could be written that would be a fraction of that size. If I then had some way to populate the other 11Mb with junk such that the MD5 (or whatever) hash of the whole file matched the original Winword.exe hash, it would pass a hash-based check.

Without actually being able to prove it, I am pretty well positive that there would be many different versions of my file that could be made to match the original MD5 hash. Whether it could AT THE SAME TIME match an SHA-1 hash, and/or an SHA-2 hash etc, would be a question for a REAL cryptographer!

EVERY hash function produces collisions

"SHA-1 is also known to produce collisions . . ."

Since the output of the hash function is a fixed number of bits, whilst the possible file inputs are nearly infinite, every hash function will produce collisions.

The weaknesses stem from tricks to FIND collisions. If I compute the hash for word.exe, AND I can produce a malware file then add some bytes so that it produces the same hash, I then have a file that can bypass hash-based whitelisting.

Having said that, I would agree with those above who suggest using 2 different hash functions on the same file. I'm not a cryptographer either, but I can't see why that wouldn't work.

In fact, I think this should be done anyway. Just because we think one method is secure now, there's nothing to say that it won't be circumvented tomorrow, either by ingenuity or increase in raw computing power. If a hash can be quickly calculated, do 3 different hashes anyway.

If PK encryption can be done with 1000-bit keys in a "reasonable" time now, then do so - never mind that we don't think even 128-bit keys can yet be easily broken. (Those are "for example" figures - I don't know how the state of the art is nowadays!). After all, how long will it be before botnets are decrypting confidential information between spam floods?

Windows random number generator is so not random

Before commenting . . .

. . . read "Not Easy". Thank's Francis - an excellent analysis of the situation.

I might disagree that "a perfect random stream is indeed incompressible". A short, random stream may, entirely by chance, contain a sequence of bits that is susceptible to some form of compression, allowing the stream to be compressed somewhat. However, the larger the stream, the less chance of this being possible. And, as you point out, common compression routines rely on the expected nature of the input stream - compressing "random" data has little effect, pseudo- or otherwise.

As far as using the time as a random seed (@wobbly1 and @Matware), using -ti on the Pet WAS good practice - because (AFAIR) the PET, like most early computers, didn't have a real-time clock. The time counter on old machines generally counted ticks since system power-up. If this counted in milliseconds then, after just over a minute, the least-significant 16 bits of this number would provide a reasonably good random seed.

For "Modern" PCs, you could subtract the boot time from the real time and again take the least-significant portion. Knowing what time the generator had been seeded would then be useless without knowing when the system was last booted.

No deterministic machine can produce a truly random number. All computers user pseudo-random number algorithms. Indeed, this is often relied on: seeding the RNG can be used as a development tool (reproduce a "random" input stream that causes progem problems) or as in the example of Sean O'Connor, to consistently re-produce "random" maps.

Pseudo-RNGs are quite acceptable - as long as you know their limitations and the seed is well-chosen and protected. That's why being a good programmer is not just about coding. You need a good grounding in maths (particularly statistics & probability) so you at least know where the traps lie!

Google petrol pumps debut next month

Google-rage debuts the day after

Given how impatient and pushy drivers can be when queueing for the pumps already, imagine what will happen when drivers can stand there and surf!

I give it a week before we get reports of an impatient motorist shunting another car away from the pump because the driver is standing there trying to work Google Maps after he has filled up and paid.

QuickTime update fixes code-execution holes

How to uninstall Quicktime from Windows . . .

It's not only Macs where it's difficult to uninstall Quicktime. On Windows it doesn't provide an uninstall link and does not appear in Add/Remove programs.

I would like to share this tip that I found in the Tech Support Guy forums:. Check to see if there's a file "uninstall.log" in the c:\windows\system32\quicktime folder. If there is, run the following command:

c:\windows\unvise32qt.exe c:\windows\system32\quicktime\uninstall.log

I run a network of nearly 100 business PCs. At least half of them came with QT installed or have had it added by users. Since the proliferation of QT vulnerabilites I have used this command to remove QT wherever I find it. It has worked every time. I ignore the dire warnings and "Remove Everything" - no problems yet!

3,000 chickens paralyse central Scotland

Thou shalt not use the word "mobe"!

And that includes "mobe-captured". Shame on you, Lester.

http://www.theregister.co.uk/2005/09/09/mobe_poll_result/

Interpol launches worldwide hunt for abuse pics man

Actually a pretty good job

If you rotate pixels about a central point, the chances of a rotated pixel being moved to the exact location of another pixel are extremely small - unless the rotation is by a multiple of 90 degrees.

Once the pixels are rotated, they then have to be "averaged" - a pixel of the final image may contain contributions from up to 9 rotated pixels. You can see that the effect is more marked nearer the centre of the image - because there are fewer pixels to contain the information at tighter radii.

The left eye has survived so well because it's a circular feature at the centre of rotation. The face also looks quite clear because a large circular ring around the eye is mostly skin tone - distortion is visible but the human mind's ability to directly identify faces and facial features makes it relatively unimportant. The "swirler" would have been better advised to choose a different, asymmetrical point of rotation.

This sort of image manipulation is seriously lossy. As such I am very impressed at the amount of detail that has been recovered. I just tried swirling and unswirling a picture of my son - with much the same results.

Microsoft dispels rumors of stealth Windows updates

Over-reaction?

From what your article said, these "stealth" updates only occur if Automatic Updates is turned on in some form.

Even though AU may be set only to notify you of available updates, it is still turned on - and it is updating itself to work better. If AU is off and you visit Windows Update, this process is far more obvious - you have to install an update to WU before you can check for Windows Updates.

Microsoft's only fault here IS lack of transparency. When you turn on AU, it should be made clear to you that AU may update itself regardless of whether other updates run automatically. Either that, or it should ask the user explicitly before updating itself. They've created enough trouble already with things like WGAN - they REALLY should know better by now!

Nowadays, few people can be unaware of Automatic Updates. You KNOW it connects to Microsoft and downloads data. Far from complaining that this is virus-like activity, you should be grateful - if hackers found a way to compromise AU, this automatic updating is excatly the way Microsoft would try to close the hole.

@Ken Hagan

Nobody is "cut off" from WU. If you turn on AU, it will update itself to the latest version, then you can get updates. If you visit the Windows/Microsoft update site, you will be asked to update the software, then you can scan for updates.

Microsoft serves light fare on Patch Tuesday

Reason for Skype problems?

I run 3 Windows 2003 Servers and 1 Windows 2000 Server on our network. For each of them, last month's patches required a reboot - and all 4 failed to reboot successfully.

The W2K server hung during shutdown. After an hour of trying everything (including rebooting via Dell OpenManage) I was forced to power-cycle the machine.

One of the W2K3 servers rebooted - but had to be rebooted again before it would work. The other 2 had to be manually rebooted when the WUPD reboot failed to actually reboot.

Maybe THIS was Skype's problem? Multiple servers locked up on reboot.

Taser creates electric shotgun

Would the BOFH use it?

I'd think Simon would prefer the personal touch of the direct application of a cattle prod.

The shockwave might be useful though, set up over the inside of the computer room door.