Posts by Doctor Syntax

Is there anything left to ask Bill Gates? (Other than gissus a million?)

Re: So he has an ASR33??

"Programming on an ASR33 will humble you very quickly. Everyone should do it once!"

Especially on the end of an acoustically coupled modem.

IBM pimps Watson out to Hilton robot for concierge duty

Maybe it would be best put to work watching the PoS terminals for signs of infection.

Microsoft has crafted a switch OS on Debian Linux. Repeat, a switch OS on Debian Linux

Re: so long Debian, it has been nice knowing you

What? Debian code is all available under a licence that permits Microsoft to use it just as readily as you do. All they (Microsoft) have to ensure is that they distribute the source as demanded. Debian are selling nothing, just being a normal open source organisation.

SQL Server for Linux: A sign of Microsoft's weakness. Sort of

Re: But, I'm guessing, not to raspbian

Informix is already available on ARM. IBM sees it as an embedded database.

Re: Yeah ...

"That's not a knock on Redmond, that's a serious question."

The two are not mutually exclusive.

Knackered Euro server turns Panasonic smart TVs into dumb TVs

I decided I'd had it with Panasonic when the drive died in the DVD box. Use a commodity component you could replace from eBay? Nope. Nowadays the drive in the Myth box does the job nicely and if it dies it'll only be a few quid.

Brits still not happy about commercial companies using their healthcare data

"I would rather say 2 things"

3. Don't shout. We have enough trouble with Bombastic Bob.

Re: No, just no.

"Councils make money flogging their (compulsory) electoral register"

Do you mean you didn't opt out?

Re: This finding has implications for thinking about whether an opt-out should be available

Forget about opt-outs. They should be thinking in terms of opt-ins.

US taxmen pull plug on anti-identity-theft system used by identity thieves

Re: Can we finnally stop re-inventing the wheel?

"Why can't the .gov wrap it's collective head around the common, off the shelf solutions to these problems?"

Whilst a 6-digit pin might not be ideal - depending on how many guesses you get - it looks as if the real problem here is having something to anchor the trust system to. If the identifier gets handed out to an impersonator it doesn't matter much whether its OAAuth, Yubikey or a single digit pin.

Solus: A welcome ground-up break from the Linux herd

Re: I'd be interested...

Have you tried Ariadne - http://www.knopper.net/knoppix-adriane/index-en.html ?

Re: Flat vs 3D vs skeumorphic

"Skeumorphic is distracting and bling... 3D only need left and top light grey line with right and bottom dark grey line to give the cue that it's something you drag or click. We don't need almost photos of real objects."

3D might only need that. Working out what to drag or click needs a bit more. It needs something to give a bit of a clue. The vast majority of users now might never have seen a real floppy disk so to them they're no longer skeumorphic but the use of icons based on them will be sufficiently ubiquitous that they're instantly recognisable as the place to click to save work. An unfamiliar application will present a steep learning curve but the presence of familiar icons and menus with familiar functions will ease that.

Whether those icons are still skeumorphic or not they're far from being a distraction, they're valuable signposts.

Re: "One thing that's less clear, is who Solus is really for."

"the old Unix everything-commingled-in-five-places dir structure"

The really old Unix structure was pretty rational although it was designed, in part, to deal with the likelihood that it would have really small disks so everything needed to boot or run single user was in a special set of directories on account of /bin might be on a separate disk and you had to get to the point where the system could mount disks. OTOH root's home directory really shouldn't have been / so adding /root was a distinct improvement.

/usr was for user's home directories. Why on Earth did somebody put bin and lib directories there? The home directories eventually moved to /u and then to /home leaving /usr sadly misnamed. /usr/spool eventually became implemented by a mess of symlinks so you'd cd into it, cd .. and come up somewhere completely different. No wonder that got replaced by /var.

Another thing that got changed was separation of roles. Consider the system binaries and libraries; they used to be owned by a user ID bin. bin could install software without needing the root password. lpadmin could manage printers without needing the root password. Then to appease the great God Convenience everything was handled by root followed eventually by the notion that this wasn't a good idea and so we had sudo to repartition the agglomerated root functions and get in the way of every admin task unless you negate it and sudo /bin/sh. And then, to re-appease the great God Convenience we have the arrangement whereby sudoers can sudo by using their own password instead of having to know a second password. In effect Unix-like systems are typically being run by local administrators just like so many Windows boxes.

So, yes, a lot of Unix has become a tangle but don't go calling it "old". To us oldies it's all newfangled tinkering.

Re: Solus stands on a few less shoulders than others

Arguably less is correct. It stands on the shoulders of the very many who put together the individual libraries and programs but not on the mighty shoulders of one of the great Debian/Red Hat/SuSE triumvirate. OK, it's getting late...

Another interface that seems to be based on "a clear desk is a sign of a clear mind" or, as I think of it "an empty desk is the sign of an empty head".

Where do you put all the documents you're working on? And, no, the "recent files" option on a file menu isn't nearly enough if you need to consult a lot of reference material. These empty desktop styles just cut out a whole mode of operation and in order to provide....well, nothing really.

What are you doing to spot a breach?

"A hospital may send data to a third party company that produces its invoices for it. How can you distinguish between a legitimate business process like that, and an illegitimate one that is sending sensitive data to bad people?"

How do you know that the legitimate third party isn't compromised? Or that it doesn't employ someone untrustworthy?

Californian tycoons stole my sharing economy, says Lily Cole

"For starters, I can't get what impossible.com does from their front pages."

I think you've hit on the problem.

FBI says NY judge went too far in ruling the FBI went too far in forcing Apple to unlock iPhone

"It also argues – as it has done in the San Bernardino case – that the request is device-specific and so does not constitute blanket approval for the FBI to break into any iPhone."

So, two quite unique but surprisingly similar cases.

I'm sure the New York office had misread the instructions. Their case was intended as the second slice of salami when they'd got the result they wanted in San Bernadino. They've given away the game plan.

What a pair of ace-holes: Crooks bug gambler's car with GPS tracker, follow him and rob him

Quis custodiet and all that.

GCHQ: Crypto's great, we're your mate, don't be like that and hate

"The level of security I want to protect the privacy of my communications with my family is high, but I don’t need or want the same level of security applied to protect a nuclear submarine’s communications, and I wouldn’t be prepared to make the necessary trade-offs."

Take this statement in conjunction with the Nat West article. It would be wrong to see such things as affecting just individuals - as in his family's communications. If you take all the Nat West users together, or all of the other individuals who might be affected by some other issue, each time you can add up what's a risk and discover that it's a sizeable chunk of the economy. Does that move it a bit closer to a nuclear submarine in terms of significance?

"That is where we will need goodwill on both sides.”

Fair enough. But that gives him a problem. He and the other agencies have lost that goodwill because they have lost the trust of the public including the tech companies. He and the others need to regain that trust. It's really the most important problem they have and I don't think they have a clue where to start. I can help them with a rather old piece of advice.

When you're in a hole, stop digging.

They need to step back, grasp what the rest of us are saying and then admit that they way they've been going about things is wrong; that for the greater good they need to accept limits. Standing up and giving lectures about how they're right is, in fact, quite wrong. They work for the public. The ethics and morals they adopt should be those the public require of them. It's not their role to try to scare the public into the attitudes they want. And, as someone said in a previous comment thread (and inexplicably got downvoted for it) questions of principle shouldn't be settled by appeals to utility.

Re: Goodwill?

"That is what I said to someone I know who works at GCHQ just after the Snowden leaks."

What was their reply? Or is that classified?

Microsoft joins Eclipse Foundation. Odd thing for a competitor to do

Re: Oh. Woo. Yay.

"Not that it'll stop the nutjobs claiming otherwise with nary a shred of proof of 'evil' intentions."

It's not so much a matter proof as a matter of leopards and spots.

NatWest tightens online banking security after hacks' 'hack' exposé

Re: Are Barclays...

"the only bank that use a card reader in the customer's hands to allow any interaction with the account?"

No, but the only time I needed to use mine it didn't work. I think it's because these things are time based and the bank is running several years slow.

Re: No NatWest Branches But Don't Use The Post Office @Richard Jones

" *Always* write your sort code and account number on the back of the cheque"

You mean so they can match it up with the one on the front?

Re: communicating with them using ALL of their registered methods

"Who reads emails that purportedly come from the bank?"

There's another side to that - by sending out spam the banks are training their customers to respond to phishing emails.

Much as I'd like to suggest firing the guilty in the marketing departments (that's probably entire departments) there are ways in which things could be improved.

My own solution to the bank email problem is to have my own domain and use that to give the banks etc their own email aliases to address any emails to me. Unless some bank employee has my email address on his BYOD - which he shouldn't - and loses it then I can reasonably rely on any email that claims to come from my bank actually having done so*.

I appreciate that not everyone wants to run their own domain. A simpler solution would be that email hosters provide each customer with a subdomain within which the customer can set up their own aliases so instead of NatWest sending emails to [e-mail] they send to [e-mail] or even better [e-mail].**

The other technical improvement would be to make PGP a core part of an extended SMTP so that if I get an email which purports to come from my bank it would be signed and my email provider's server would verify the signature with the bank's public key before accepting it.*** For good measure I might have a copy of the bank's expected key on my email client, just in case the email were to come from [e-mail].

Today's email standards and practices are rapidly becoming inadequate and need to be improved.

*In fact, this may not be correct. I have had words with more than one financial institution about their having employed digital marketing companies spammers to send out valuable marketing communications spam. If that were to happen under my current system I'd then have to change the alias and complain bitterly about the hassle. The alias might well be changed by changing bank. Maybe fire the marketing departments just to be on the safe side.

**This does, of course, rely on email providers not having their database popped by teenage skiddies using exploits older than themselves. Come to that, so does my existing arrangement but I think that, unlike other internet companies I've left behind, they're prepared to keep their security up-to-date.

***The keys would either be served from the bank's email server or the bank's DNS records would include an alternative address. And, yes, I do know that PGP can be enabled on my email client today; do you know it's not a rhism of use without most other correspondents also using it? It needs to become universal to be of use and the only way for that to happen is for it to become adopted into the standard so that non-use can be deprecated.

Why did it take a Beeb news item to get them to move?

Going on a thin client diet

"They can also still put USB sticks that they found in the car park into their thin client"

A blob of epoxy in the USB sockets should cure that.

"What actual work are people doing on tablets?"

Using them as clip-board replacements.

UK.gov will scrutinise all its Atos contracts following IT cock-up

Medical extraction?

Should've started with dentists, not GPs.

Mines the one with the stainless steel pliers in the pocket.

"Because we failed to learn from them, we made the same mistakes as everyone else."

It would help if people learned from successes.

Apple: FBI request threatens kids, electricity grid, liberty

"Though who or what they are really protecting here?"

That's an easy one. Everyone who didn't think it mattered until they ended up on the wrong end of a false accusation and find out too late that it did matter.

Re: I still think the FBI

Has gone about it in the right way to do what?

AFAICS, they've gone about it in the right way to give them the best chance to obtain a precedent that they'll then take every opportunity to extend until no meaningful safeguards are left. I doubt they give a monkey's about the content of the phone, even assuming it has anything they haven't got from the backup.

Re: "it be used only on government or Apple premises"

"The end result is that non democratic states and and crooks will gain an advantage - while those following democratic rules will be cut off from essential evidences in many crimes."

If legit software had backdoors then legitimate users would have be at risk. Criminals? There's be plenty of people, some of them competent, prepared to produce illegal software and remember this simple fact: you do not discourage people intent on breaking the law by furnishing them with more laws to break.

Re: Smartphone weaknesses

"Sim Card Cloning"

The instruction include reading the victim's SIM. If someone has your SIM to clone he has easier options to make use of it.

Re: You don't say !

"it is interesting that they've approached this issue in this way"

I think they've taken the best case they can to get a precedent from the courts. This particular case takes advantage of the fact that the phone was owned by a public body, not the user and that the user's rights don't come into it because he's dead. OTOH if that last were a significant part of the precedent then the SOP for getting a phone unlocked might include "shoot user".

AMD to fix slippery hypervisor-busting bug in its CPU microcode

Re: Learnt something new today

"AFAIK no one has ever successfully tinkered with microcode. It's a security through obscurity thing on a very large scale."

My first reaction reading this was that someone who was able to get the old firmware loaded could then trigger the exploit. But I suppose anyone with that level of access wouldn't need to worry about finding exploits to use.

Re: Learnt something new today

"It's certainly quite astonishing to see just how many files are lurking in /lib/firmware."

Including new_code.bin and new_code_fix.bin in one directory. Nice to see explicit file naming practices being followed.

Norman Conquest, King Edward, cyber pathogen and illegal gambling all emerge in Apple v FBI

It's rather trite to say that everyone should assist in the pursuit of lawbreakers etc. But we also have to remember there's supposed to be - and I'd like to think still is - a concept of presumption of innocence.

The FBI appear to have chosen the case on which to raise their demand with considerable care. There is nobody charged and very likely nobody ever to be charged as a result of this. The user of the phone, whilst neither charged nor convicted, has any outstanding human rights to be contradicted, moreover it's likely that when a coroners court sits on the murders it's likely to pronounce that he committed them. Also the phone wasn't his property, it belonged to the local government body who are agreed to the phone being hacked. So, apart from the fact that the FBI and the owners between them made a cock-up by changing the password and the dubious arguments for the phone's likely evidential value over and above any information the FBI might already have, the case for doing this is about as persuasive as it gets.

However, the precedent it would set, practically if not legally, would extend well beyond these circumstances. Even if a decision in favour of the FBI were limited to the particular circumstances I outlined above it would still be a dangerous precedent. On the one hand it would undoubtedly be just the first slice in a campaign of salami tactics to make the decision universal. On the other, if the circumstances were limited to those in which the user were dead that might be an irresistible temptation that shouldn't be on offer.

The argument's been made that those who break the law shouldn't be entitled to call on the law to protect them. That argument fails to take account of the presumption of innocence. Until proven guilty the alleged lawbreaker is as entitled to the protection of the law as anyone - it's one of the final lines of defence we all share against a false allegation. So the risk of such a precedent being widened to overrule that presumption is not a trivial one.

If we are to be called on to assist against lawbreakers we need to be able to trust those who make such calls. As things stand various agencies in both the US and the UK have forfeited a great deal of public trust. ISTM that one of the most important things now, for the FBI and for the others, is to rebuild that trust. In the circumstances, whatever new evidence might be gleaned from the phone the wisest step the FBI could take right now would be away from their request. It could be the first step towards that rebuilding.

As the FBI and their supporters have chosen to invoke the rulings of Edward I we should remember that the presumption of innocence was reintroduced into European law in his time and also that he not only reaffirmed Magna Carta, he made it part of English statute law. From Magna Carta we have the concept of due process of law. These days I fear the concept of due process is being stretched to breaking point if not beyond.

Finally I should reiterate that I spend a good many years as a forensic scientist in the midst of a terrorist campaign. I carry no brief for terrorism or any other form of criminality. I understand from my own experience the desire to investigate cases as fully as possible. But the thing I dreaded for all those years was the possibility that, however inadvertently, I might end up making a mistake that could help convict someone who was, and would know themselves to be, innocent. I wish I could see evidence of that dread in the decision makers of law enforcement agencies today.

French parliament votes to jail tech execs who refuse to decrypt data

Re: SIEG HEIL, Monsieur Hollande

From the article: "The new penalties...are opposed by the French government,"

How the FBI will lose its iPhone fight, thanks to 'West Coast Law'

Re: Ah, but that would involve *logic*

'San Bernardino DA says seized iPhone may hold “dormant cyber pathogen”'

OK, take him at his word. Better keep it locked and then destroy it.

We’re not holding biz to ransom, says pay to play ad-blocking outfit

The ad industry as presently constituted might just as well face facts. The party's over. We're just waiting fro everyone to collect their coats.

Re: Here's an idea

"That might fix it."

I'm glad you put on the joke alert. The entire chain other then the user's computer and the IP network leading to it could be outside HMG's jurisdiction. The only point at which the user's computer can realistically be defended is at the computer itself. I doubt the ISPs would be able to perform DPI on all the traffic and even if they could it would require MiM of HTTPS sites - not, of course, a problem with our beloved elReg.

Everything bad in the world can be traced to crap Wi-Fi

"Unfortunately, for the past few weeks my phone has decided that it likes the BT Fon connection better than my private home WiFi, so it always connects to it."

Back in the day when unsecured home access points weren't that unusual my laptop would manage to ignore my network and latch onto some unsecured one-bar job down the street at what felt like 10 bits per minute.

Re: Shit coding

"(PS - showing my age, aren't I?)"

No, you missed out "on a teletype".

Re: Shit Wi-Fi?

'my dead grandmother can understand the idea of "one off purchase"?'

Unfortunately your dead grandmother has more perspicacity than anyone in sales and marketing.

Re: Shit Wi-Fi?

"My email was used for contact when delivery was due for the major items."

1. Own domain.

2. Set up mail address specifically for the vendor.

3. Tear down mail address when no longer needed.

4. Occasionally give a thought to all those spams being bounced.

Ad-blockers are a Mafia-style 'protection racket' – UK's Minister of Fun

Re: Ridiculous

"The only reason why ads are everywhere, because you and people like you don't want to pay for content and services."

Citation needed.

Re: Ridiculous

"The reason why advertising is everywhere is because, on a human psychological level, advertising works. It influences people, against their own will, to make various choices"

Sort of. It works because, on a human psychological level, the advertisers can't comprehend that their monotonous advertising will piss off so many people that they lose potential customers. When you're so utterly convinced that the sun shines out of your arse rational thinking becomes impossible.

Converged PC and smartphone is the future, says Canonical's Mark Shuttleworth

Yes, I know, commenting on my own post & all that.

I use a Mint netbook for visiting libraries and archives for research. As it happens I run Informix & a selection of its tools which enables me to knock up new data-taking forms as needed. It wouldn't, however, be difficult to implement something similar with a different RDBMS tool-set.

I also carry a USB stick to which I can download images from the library's computer.

So there I am, on the one hand collecting images on the stick & on the other taking notes and at some point the two have to be brought together.

What would be ideal would be to have an arrangement where a USB lead would allow the netbook to present itself as mass storage in just the same way as the USB stick. An Android tablet would allow this but wouldn't, AFAIK, allow for a full-blown RDBMS tool-set to be installed. But if a Ubuntu tablet provided the mass-storage simulation via USB and an RDBMS then combining this with a Bluetooth keyboard would be a winner for me. OTOH maybe the same thing could run on my existing netbook.