Posts by Warm Braw

IETF protects privacy and helps net neutrality with DNS over HTTPS

Re: @the d-rat (non e-mouse)

It's pretty difficult to scale anything if you can't trust your ISP - and moving the "scaling" functions (such as caching and load balancing) away from the supplier you're paying to provide them to a provider who can only get their income from elsewhere is not necessarily in your long term interests.

There's plenty of opportunity for mischief if a malicious site I happen to visit also provides the DNS translation of the various domains linked from the same page - or can potentially influence the translation of domain names of sites I have yet to visit.

So what happened with the patent judge and the Euro Patent Office?

Re: How has he survived?

He's French - they're not going to relinquish the prestige of office regardless of the consequences. The same reason the European Parliament troops off to Strasbourg periodically against the wishes of almost everyone concerned.

Sloppy coding + huge PSD2 changes = Lots of late nights for banking devs next year

Microsoft’s .NET, Java

I'm immensely suspicious of this.

I've been writing code since Fortran was in capitals and my experience suggests that the "managed" languages (like the .NET lanaguages and Java) are significantly less problematic - no buffer overflows (unless you use P/Invoke or JNI) and higher immunity to things like SQL injection (if you use the platform features like EF).

I have, however, been on the "other end" of automated software analysis which does tend to throw up a higher proportion of issues with the managed language environments - the ability to do more static checking means that there are more "errors", though they are usually things like "should you have sealed Class X?" rather than actual potential runtime problems.

There's a big difference between "we sell a software tool that says most of the errors are here" and those errors actually being significant, or being comparable with errors elsewhere.

Do you suffer from the shame of 'Scroll Jank'? Help is at your fingertips

Re: Scroll Jank?

Obligatory.

Elon Musk finally admits Tesla is building its own custom AI chips

Re: So...

I think he's got the hollowed-out-mountain thing to try first...

Florida Man… pockets Uber cash to keep quiet about data breach

Better ... than a bunch of people out of work?

I'm afraid that argument is wearing a bit thin, having been used in the context of asbestos and cigarette manufacturing, coal mining, arms deals, ...

And in this case, we as consumers of hi-tech goods and services have been overpaying consistenly so that the providers of those goods and services could subsequently use the excess profits to subsidise the operation of a wholly dysfunctional and unsustainable taxi company that destroyed jobs at sustainable and established taxi companies.

It's a struggle to see a moral imperative in there...

NiceHash diced up by hackers, thousands of Bitcoin pilfered

Re: Mugs game

There are more fundamental reasons to avoid them. Law of unintended consequences...

Google pushed update that broke managed Chromebooks' Wi-Fi

How will the kids learn?

Learning about the fallibility of technology would seem to be a valuable lesson in itself.

Get ready for laptop-tab-smartphone threesomes from Microsoft, Lenovo, HP, Asus, Qualcomm

You overpay

And you keep overpaying. That's the point.

Mailsploit: It's 2017, and you can spoof the 'from' in email to fool filters

More depressingly...

... it's 2017 and "non-ASCII Text" is somehow still considered the exception.

You're SAP-ing my will to live: Licensing debate lumbers on as ERP giant tries to rebuild trust

There's no reason for them to defect to the competition

The (limited) number of SAP installations I've encountered depended on third-party expertise to wrangle SAP into an unsteady alignment with their business processes. It's quite hard to "defect" if you've already effectively lost control of your enterprise IT to a parasitic ecosystem.

Damian Green: Not only my workstation – mystery pr0n all over Parliamentary PCs

in any other job...

Not everyone is a wage slave - you're hardly likely to fire yourself for moral misdemeanours if you're self-employed, for example. MPs are not employed by anyone and haven't agreed to any rules about their conduct (with the implicit exception of the arcane twaddle in Erskine May).

More to the point, why should anyone be fired for having porn on their office computer? It's not necessarily more time-wasting than shopping on Amazon or posting pictures of the staff Xmas lunch on Facebook.

And, indeed, why is the web cache not encrypted by a one-time session-specific key so that jobsworth "forensic experts" have something more constructive to do with their time than poking their holier-than-thou fingers into the dark recesses of their fellow men. It's not as if we were all still using 1200 baud modems.

The plucky local Mom 'n’ Pop phone maker faces death

In Malaysia, India or China...

... it may be true. Personally, I doubt it as consumers will have less need to flaunt their wealth when it is more commonplace, but we'll see.

However, I would have thought the opposite is likely true in the "anglo-saxon" economies where real wages are going down for many people.

Uber says 2.7 MEEELLION(ish) UK users affected by hack

Still waiting for technical reports ...

Given the amount of time Uber have been sitting on this, you wonder what their security people have been doing in the mean time.

Oh, hang on...

Which, along with their decision to pay off the hackers, does make you wonder about their relationship with the black hats. And, indeed, whether any other information was leaked that perhaps Uber wouldn't want to admit to having in their possession. Though in view of the impeccable integrity of the company's staff from the board room down, I'm surely just being paranoid.

Facebook, Google, IBM, Red Hat give GPL code scofflaws 60 days to behave – or else

Re: Translation please

I think it means you get incur the ire of Red Hat, Facebook, Google or IBM (the great Redface Bloogle?), who probably weren't going to come after you anyway, you get an extra 60 days to frame their lawyer's letter.

For the people who are going to come after you, possibly in the pursuit of compensation rather than compliance, it doesn't really mean a lot. Damn those German submarines...

Munich council finds €49.3m for Windows 10 embrace

Re: Doomed from the Start??

How about Open Document, AKA ISO/IEC 26300? The one that Open Office and LibreOffice use by default.

It's an international standard, it has a test suite and it doesn't grandfather in a whole lot of undocumented proprietary binary formats from previous versions of Microsoft Office.

There will always be incompatibility issues with different implementations - look at web browsers - but having more than one implementation helps weed out specification errors and ambiguities and drives innovation. The problem with one implementation dominating is that it is, de facto, the standard and other suites have to follow its lead even if changes are made solely to thwart competition.

Re: Doomed from the Start??

According to an earlier report the principal complaint was a lack of compatibility between the odt document format used in OpenOffice and software used by external organisations. The proposed mitigation was that Munich had been hoping to ease some of these problems by moving all its OpenOffice users to LibreOffice and by funding updates to LibreOffice that improve interoperability with Microsoft's Office suite.

So, it seems the main issue is that Linux doesn't run Microsoft Office - they have plenty of Windows machines for other Windows-only applications. Regardless of whether or not Munich uses Linux or Windows, it seems unsatisfactory that there is a de facto monopoly of office software that neither public administrations nor their suppliers can escape. I would have thought that the answer was for public administrations to mandate, as part of their procurement process, that all of their external communications should be in non-proprietary formats and that might encourage their suppliers to pressurise Microsoft to deliver the tools they need to win contracts.

UK spy court ruled immune from judicial review – for now

Indeed. RIPA itself was brought in because it was feared that the previous legal basis for surveillance wouldn't stand up in the face of the Human Rights Act. Rinse and repeat...

'Data is the new oil': F-Secure man on cartels, disinformation and IoT

Vendors have not quite worked out how to monetise this data as yet

You could say the same about the waste that currently goes to landfill - it's not an argument in favour of collecting as much as we can until we work out what to do with it.

This is peak AI: Bot to guest edit Radio 4's Today programme

Re: Don't complain about the politicians

I think the problem is that there is essentially a pre-planned media agenda for the day: politicians have a set of talking points they want to get out, carefully phrased to side-step potential criticism. Equally, their opponents will have a set of refutations, carefully phrased, to avoid drawing attention to their own failures. Those politicians will only agree to appear if there is a tacit understanding that the journalists will play along with the carefully-choreographed "I put it to you" ritual. If a journalist were to ask questions that strayed too far from the day's agenda there would be noone available the next time that programme requested an interview.

It's probably time to abandon the idea that the pinnacle of journalistic achievement is to interview senior policiticans - they won't tell you anything enlightening and if they did it would merely illuminate briefly the chasms in their understanding.

Facebook notifications to reveal who saw dodgy Russian election ads

Re: Blindsided

I think, translated, it means "our salesdroids missed an opportunity"...

Samba needs two patches, unless you're happy for SMB servers to dance for evildoers

This is what happens when you let any developers write code with tools that don't provide safe methods for memory management and garbage collection. The only thing age and experience will do is reduce the number of errors - it won't eliminate them.

'Gimme Gimme Gimme' Easter egg in man breaks automated tests at 00:30

Glad to see "who is god" still kinda works.

A long time ago there was a Digital product that had a very basic debugger called "POD". If, with futile expectation, you typed "HELP" at the "POD>" prompt, you got the message:

POD HELPS THOSE WHO HELP THEMSELVES

Those were the days...

Possible cut to British F-35 order considered before Parliament

Re: Still not too late

put cats and traps on them

I suspect the rats have already left...

Uber: Hackers stole 57m passengers, drivers' info. We also bribed the thieves $100k to STFU

Re: Rotten to the core

These people need a wage to put food on the table, pay the mortgage etc

At what income does the argument "the ends justify the means" become invalid?

Phone fatigue takes hold: SIM-onlys now top UK market

Only 29%?

The last survey, back in April suggested it was already 27% and heading for 33% by the end of 2017 and would be 54% by 2021.

Seems not to be the best time for Apple to be raising the cost of entry to its walled garden - but I suppose people continued to rent their phones from BT for years after you could buy one cheaper from Argos...

Open-source defenders turn on each other in 'bizarre' trademark fight sparked by GPL fall out

What's the point of the GPL if you can't enforce it, is a more interesting question.

Although the busybox example has been heralded as a "win" for GPL, as far as I can gather there hasn't actually been a judgment (except in the case of Westinghouse which was bankrupt and did not defend itself), merely a succession of "settlements" - in other words it was cheaper to comply with the terms of the licence than to pay lawyers to pursue the case. There have been some cases in Germany, but it's very difficult to find out what actually went on.

The real problem with the GPL is that the loss suffered by the copyright owner is largely intangible: the infringer may profit from misuse but that is not money that would otherwise go to the rights owner - it would still go to the infringer provided they complied with the licence terms. Getting real damages in an actual case that made it through the judicial process would, I think, be quite difficult. And we will probably never know, because it's unlikely to be worth anyone's time or money to take a case to a legally-certain conclusion.

If the only contribution these lawyers are making is to threaten companies with legal costs fighting suits that may or may not have any merit, in the hope that people will simply settle for a quiet life, how exactly are they any better than Prenda Law?

AT&T wants to bin 100,000 routers, replace them with white boxes

Disaggregated Network Operating System

It's a short journey from "disaggregated" to "disintegrated".

ICO probes universities accused of using private data to target donation campaigns

£9,000 per year per student in student fees not enough for them?

The first time I was pursued for a donation by my former univeristy, it was for the educationally vital purpose of procuring a commemorative sundial, or possibly birdbath - the exact details have faded from my memory, like most of my undergraduate learning.

Their next communication was returned with "not known at this address" and I have been untroubled since.

Most of this alma-mater business seems to be payback to the institution concerned for putting you in proximity with the people who in future life would value your personal connection above your actual ability.

The Independent 'live streamed' space vid recorded in 2015

Re: Explanation.

young London arts graduates

I've noticed a growing amount of US English on their pages suggesting that the content is not even locally recycled. It's also not clear to me whether the Indy100 clickbait ("How garlic bread literally ruined Pete Kay's life") is there to drive traffic to the Independent, or it's the other way round...

If you're big enough, Cisco will cook you a private software SKU

There was a time when just about every large cisco customer seemed to have an "own-label" variant of IOS - and it was a nightmare to support. It's amazing how sales and marketing teams could do deals to get around the corporate pricelist and make themselves a nice commission without having to pass any of that on to the engineering teams to help deal with the significant additional cost...

DNS resolver 9.9.9.9 will check requests against IBM threat database

Re: El Reg in the crapper

No, it doesn't

Agreed. But it is a layer violation...

Some 'security people are f*cking morons' says Linus Torvalds

Re: Thank you Google Pixel Security Team, but...

break glass in case

Unfortunately, in most widely-used software projects there comes a point in which an unintended "feature" becomes a dependency for another piece of software. Further, you may not know what those other pieces of software are - and they may not know that they're relying on accidental rather than intended behaviour.

If that unintended dependency is the result of code that exposes a security flaw, then what do you do? Perhaps you could redesign the code in such a way that it's both secure and bug-compatible, but that's likely to be a major change that requires more significant testing and may break something else.

While in principle I'd be on the side of maintaining security even at the cost of breaking things, it does seem this particular instance is not necessarily the right approach: it's essentially trying to spot kernel bugs and assumes that the user process that encounters them is operating maliciously, termininating it. This doesn't seem like a great way of actually finding bugs in the kernel and risks breaking applications that are encountering them accidentally.

The bad news is that the correct way to address the problems identified is probably a much more thorough review of memory management - and who knows what that might break...

Aww: Apple won't be HomePod for Christmas

Re: Good product

Looks dank

I had to look that up on Urban Dictionary. I suppose that in itself is a sign I'm outside their target market.

I'm hanging on to a wind-up gramophone against the day it's impossible to get a music player that doesn't listen back.

DJI bug bounty NDA is 'not signable', say irate infosec researchers

Computer Fraud and Abuse Act

I'm assuming these people aren't randomly attacking drones that happen to pass by overhead but are actively trying to find bugs in the software of drones that either belong to the security researchers or which they have been given permission to investigate by their owners.

If DJI think it's a criminal offence to access a computer that belongs to you without their permission, then there's rather more to worry about than an NDA.

Internet of So Much Stuff: Don't wanna be a security id-IoT

Re: (And now for) something completely different?

There are some differences, but they're not differences in technology. They're things like:-

Scale and reach: if you can potentially turn off the electricity of millions of people or spy on the most basic details of their lives;

Retail model: consumers who have bought things expect them to work without further intervention for several years, but consumers who have not yet bought things expect something better and shinier than was available last week;

Support model: unlike businesses, consumers are not generally in the habit of employing staff to manage their technology or continuously paying support contracts.

Given that entire hospitals and manufacturing plants can already be shut down fairly easily, it's pretty clear that there needs to be different thinking when it comes to security for present systems. If we can fix that, then IoT is just an incremental change. If we can't, we can't fix the IoT problem either.

Google says broader right to be forgotten is 'serious assault' on freedom

four people were accused ... of ... some salacious activity

That's not how I read it. Although the legal summary is necessarily circumspect, there appear to be four distinct categories of personal information:

1/ A video that explicitly revealed [a] relationship ... with a person holding a public office

2/ An incidental mention of someone being public relations manager of a Scientology Church

3/ Information relating to criminal proceedings against someone

4/ Information relating to the conviction of someone for child sex offences

In the first case, the existence of the relationship might possibly be justifiable public knowledge, if relevant, though the explicit video presumably is not. I can't immediately see why the second should be suppressed. The third and fourth seem like matters of public record but if it subsequently turns out that charges have been false and malicious then there may be a case.

But that's why we need judges to decide these things and not Google.

Google aims disrupto-tronic ray at intercoms. Yes, intercoms

Re: OK Google

There's probably some startup out there called Ober recruiting an army of supposedly-self-employed waiter/butlers (to be replaced with robots when possible) to listen in for such demands and be ready to whizz around to your house on roller skates or hoverboards to comply, with the USP that it eliminates domestic tension of this kind. And, in the febrile minds of investors, somehow make money from it.

It's 2017 – and your Windows PC can be forced to run malware-stuffed Excel macros

Re: WTF?

To quote a random web page on the subject of Fortran:

Probably one of the most undesirable and most useful of the pre-Fortran 90/95 features is the COMMON block

I've yet to see a mathematical proof that useful features of programming languages are necessarily also undesirable, but experience suggests a strong correlation...

Amazon to make multiple Lord of the Rings prequel TV series

Re: Running up stairways of falling rocks

Tom of Finland

Possibly not the "lord of the rings" that Amazon are thinking of...

MPs slam HMRC's 'deeply worrying' lack of post-Brexit customs system

I presume David Davis and his fellows will vanish post-Brexit, following the route pioneered by David Cameron.

Openreach fibre plan for 10m premises coming 'before Christmas'

Re: Openreach FTTP creates a monopoly for BT

FVA is not just a VOIP solution

OK, it's a VoIP solution with a UPS. Admittedly a consumer-friendly, small, UPS, that takes 4 AA batteries, but it's just a UPS - with a lifetime of about one hour. A VoIP adapter connected to your own UPS would do the same job. Look at the Openreach fact sheet and you will see that it's simply a SIP terminal adapter.

Re: Openreach FTTP creates a monopoly for BT

can't transfer numbers from copper to FTTP

As far as I'm aware, FVA is just a VoIP solution. There's nothing to stop you getting a VoIP service from anyone and installing your own adapter box for your existing phones. You can usually port an existing landline number to a VoIP service - though you have to port it while it's still in service, it's too late once the original service has been disconnected.

Why would BT invest in fiber optics when it can continue to milk the copper cash cow?

One possibility is that a tipping point has been reached. BT has been pressured into reducing the line rental for telephone-only copper and many households have dispensed with fixed lines altogether. That essentially means their profit comes from broadband subscribers but they represent a diminishing proportion of their infrastructure. Their competitor broadband providers see the costs BT charge them for access to the local loop going up while their ability to deliver increased speeds is reaching a practical technology limit. If BT isn't going to start delivering FTTP, they'll do it themselves.

Munich council: To hell with Linux, we're going full Windows in 2020

Re: Politics is nothing to do with it.

The facts are as stated

Statements have been made, but their correlation with facts has not been demonstrated.

Even Accenture, who were brought in to review the situation - perhaps in the hope they might come up with a damning condemnation of the LiMux approach - said that most of the issues were due to management, deployment and update policies, not to the choice of software. They recommended keeping the current mix of systems - presently around 4,000 Windows systems and 20,000 running LiMux.

Other reports suggest that many of the early compatibility problems were resolved by a switch from OpenOffice to LibreOffice.

Given that representatives of different political parties in Munich have opposing views on the way forward, I'd say that politics has everything to do with it. That doesn't mean I know which side is actually right, but in the absence of agreement on them, I can claim that the statements being made cannot be taken as facts.

Stop your moaning, says maker of buggy Bluetooth sex toy

Walking through a muddy field with mud up to their ankles in wellies

Careful, you'll get me going...

Los Alamos National Lab fires up 750-node RPi cluster

That PoE means some serious Ethernet cable...

3W per blade * 150 units per blade * 5 blades in a cluster = 2250W. Or about 47A at 48V. Or around 20 standard ethernet cables using all 4 pairs at 600mA per pair (802.3bt).

I'd have thought a 13A plug would be more appropriate - or one of those washing machine outlets, since it's the US.

The day I almost pinned my tushie as a Google Maps landmark

Re: There Might Be An Upside

Zuckbook's monetising efforts

I suppose it's only a matter of time before we get Buttcoin.

Brace yourselves, fanboys. Winter is coming. And the iPhone X can't handle the cold

Re: Let's see...

how cold does it ever get at Cupertino

Having been a Mac user back in the System 6 & System 7 days, I would imagine that many of their more seasoned developers should have significant experience of devices freezing.