Re: Put Windows in jail?
Liam mentions a fake virtual TPM in TFA.
Sorry, I had a reading comprehension failure there. Seems to me being able to run Win11 on old hardware would be a Big Deal for some.
601 publicly visible posts • joined 12 Aug 2014
This is well outside my area of expertise, and of almost entirely academic interest only (at least to me). I have minimal needs for Windows.
But I'm wondering if running Windows in this manner would allow one to restrict Microsoft's baser impulses? Could your machine tell Windows "hmmm, sorry, it appears updates are unavailable"? Or "we'd love to pass that telemetry back to Redmond, but the server isn't responding"?
More of a stretch : lie to the OS and say "oh, yes, this machine does satisfy the requirements for Win11".
I recently encountered a software simulation of the VT100, which the author put on a Pi inside a 3D-printed model of a VT-100 for connecting to a PiDP-8/I.
I lack either the model or the PiDP-8/I, but played around a bit with the simulator. It basically runs the original firmware ROM, and is therefore an extremely faithful simulation of the VT-100. (My main interest in it was to test out an implementation of the Curses library and to verify its VT-100 capability. Turns out I do have a fix or two to make, which didn't surprise me.)
Oh, my. Mere profanity fails me.
gcc reports
main.c: In function ‘main’:
main.c:4:1: error: case label not within a switch statement
4 | case 0: printf("hello, world!\n");
| ^~~~
main.c:6:14: warning: initialization of ‘unsigned int’ from ‘char *’ makes integer from pointer without a cast [-Wint-conversion]
6 | int x = "test";
The following code removes 'case 0:' and makes the cast explicitly to an unsigned long, and prints the result accordingly. This compiles without warnings with -Wall -Wextra -pedantic -Werror :
#include "stdio.h"
int main(void) {
printf("hello, world!\n");
unsigned long x = (unsigned long)"test";
printf("%lx\n", x);
return 0;
}
Values output for x change with each run; examples are
555adbf48012
55fce3166012
55d943d7e012
Which confirms what I thought would happen : x is set to the address of the string, and that address is randomized with ASLR with each run. x will therefore be a multiple of 0x2000 with 0x12 added to it.
The value you got, x=4202515 = 0x402013, looks as if it could be similarly close to the start of a memory page.
(Pause to check, fearing Muphry's Law has struck, but....) Hmmm... I don't see that?
Let's try m=300, n=50, so six times as many edges as nodes.
m * ln(n)^⅔ = 300 * ln(50) ^ ⅔ = 744.8 (workload with new algorithm)
n * ln(n) + m = n * ln(50) + 300 = 495.6 (workload with 'classic' algorithm)
...so with lots of edges and not many vertices, Dijkstra's algorithm comes out the winner.
Try with, say, m=100, n=50, so twice as many edges as nodes :
100 * ln(50) ^ ⅔ = 248.3
50 * ln(50) + 100 = 295.6
...so with not so many edges, the new algorithm gets the nod. (And I note that the article appears to agree with this :
the new approach claims order (m log⅔ n) which is clearly going to be less for large enough n.
Also : I see I could have figured out the limit analytically (quite easily, in fact; I'm kinda embarrassed I overlooked that...) The proposed new algorithm is an improvement for
m < 1 + n log n / ((log n) ^ 2/3 - 1)
The Fine Article says that the proposed algorithm is an improvement "for sufficiently large n". I wrote a small snippet of code to determine where the switch-over point is. Table produced by the code, for n up to 100000, is shown below.
Note that TFA also notes that there's a constant factor. We should really solve for m ln(n)^(2/3) = Const * (n ln(n) + m).
It looks, though, as if the proposed algorithm is an improvement if the number of edges is less than about 2.8 times the number of nodes. I don't think that's apt to be a particularly common case, but it's conceivable that I'm wrong about that.
n = 6 m = 23
n = 7 m = 25
n = 8 m = 27
n = 9 m = 29
n = 10 m = 31
n = 20 m = 56
n = 30 m = 81
n = 40 m = 107
n = 50 m = 132
n = 60 m = 158
n = 70 m = 184
n = 80 m = 209
n = 90 m = 235
n = 100 m = 261
n = 200 m = 520
n = 300 m = 781
n = 400 m = 1043
n = 500 m = 1306
n = 600 m = 1570
n = 700 m = 1834
n = 800 m = 2099
n = 900 m = 2364
n = 1000 m = 2630
n = 2000 m = 5305
n = 3000 m = 8001
n = 4000 m = 10711
n = 5000 m = 13432
n = 6000 m = 16161
n = 7000 m = 18897
n = 8000 m = 21639
n = 9000 m = 24386
n = 10000 m = 27138
n = 20000 m = 54842
n = 30000 m = 82766
n = 40000 m = 110832
n = 50000 m = 139004
n = 60000 m = 167260
n = 70000 m = 195586
n = 80000 m = 223972
n = 90000 m = 252410
n = 100000 m = 280894
Yes, that was exactly my point. The first few digits are easy. Then it gets sixteen times harder with each digit. Then you need a runtime exceeding the age of the universe.
Re salting : if you read the second sentence in my original post, you'll note that I assumed you somehow know both the hashing and salting scheme. I could have added that neither will generally be the case. But to assume those haven't leaked is to rely on "security through obscurity". Evaluation of cryptography usually assumes that the algorithms used are known to everybody.
Basically, to get an even vaguely plausible attack this way, you have to give the attacker every advantage. They have to know the salting/hashing scheme, and they have to be able to spray a bazillion passwords so that they can detect the actual variation in timing.
Not quite. It will tell you how much of the (salted) hash of the password you entered matches the (salted) hash of the "real" target password.
So if I know the salting/hashing method used on the server, and enter 'password1' (hashed to 0xf43a...), and then I enter 'letmein' (hased to 0x314b...), and the first returns faster than the second, I can say that the hashed password starts with 0xf.
Then I generate sixteen passwords that will hash from 0xf0... to 0xff... to get the next digit. And then sixteen more to get the third digit, and so on. The hash may be to bytes rather than to an ASCII string, so I may proceed a byte at a time rather than a digit at the time, but you get the general idea. If the hash is compared four bytes at a time (as 32-bit integers), I'll be in more trouble.
Anyway. Near the end, having carefully worked out digit by digit or byte by byte, I'll have to come up with a password that hashes to most of the target, and eventually one that hashes to the entire target (with cryptographic hashes generally chosen to make that practically impossible.)
I will also have to deal with the fact that the difference in timing due to this effect isn't going to be a heck of a lot, but differences due to network lags will be significant. So I'm looking for a very faint signal in a sea of noise.
tl;dr : can't say I'd worry about this particular attack.
Yeah, wondered about that myself. The only clue as to a meatspace location is the reference to 'Winter Storm Fern', a term I had not heard... despite being in the northeastern US and having spent more time than I'd care to think about shovelling out from it (oh, my aching back!) It's been a few years since we've had this much snow; I was astonished that we didn't lose power. But I digress.
The storm in question "caused deadly and catastrophic ice and snow impacts across a very long stretch of land, encompassing Northern Mexico to the Southern and Northeastern United States and into Canada. " So presumably, the faulty server(s) was/were in that range. Narrows things down a bit, doesn't it?
The Fine Article also gives no dates/times associated with this. The storm hit here about a week ago, and the above Wi__pædia link says "January 23 to 27". So, perhaps a nearly one-week outage?
One was where the workers at the bottom said the new system stinks and is a crock of shit. By the time it got to the CEO, the phrase was that is it very strong and promotes growth.
I believe you refer to this. (With many variants.)
In the Beginning was 'The Plan',
And then came the Assumptions,
And the Assumptions were without form,
And 'The Plan' was completely without substance,
And the Darkness was upon the face of the Workers,
And they spoke among themselves, saying
"It is a crock of shit, and it stinketh".
And the Workers went unto their Supervisors and sayeth unto them,
"It is a pail of dung and none may abide the odor thereof".
And the Supervisors went unto their Managers and sayeth,
"It is a container of excrement and it is very strong,
Such that none may abide by it".
And the Managers went unto their Directors and sayeth,
"It is a vessel of fertilizer, and none may abide its strength".
And the Directors spoke amongst themselves, saying
"It contains 'that' which aids plant growth,
and it is very strong".
And the Directors went unto the Vice Presidents, saying
"It promotes growth and is very powerful".
And the Vice Presidents went unto the President and sayeth
"This new Plan will actively promote the growth and efficiency
of this Company, and in these Areas in particular".
And the President looked upon 'The Plan',
And saw that It was good, and 'The Plan' became Policy.
I would assume that Microsoft's response is that "Office™ isn't done until Wine doesn't run (it)".
In some of my code, I've checked to see if if it was running under Wine so that it could behave differently. Usually, as in the linked example, it's because there's some bits or bobs of the Win32 API that don't work identically in Wine and "real" Windows. I'm sure that if the threat from Wine was sufficiently serious, Microsoft could fairly trivially modify their applications to break when not run on Genuine Windows®.
(I am a serious fanboy for Wine. It's saved me the effort of porting several programs to Linux or OS/X or *BSD. At most, I had to tweak them -- as above -- to duck around some limitation in Wine. And note that the above example references Wines 1.7.18 and 7.0.1; I would be surprised if many of those limitations still existed in Wine 11.)
"...Lili Screen, the product of breakthrough French research on the cause of dyslexia, adds a variable flicker to a normal-looking LCD display."
Sounds interesting. Quite a while back, I read a bit about how Comic Sans, much derided by font cognoscenti, is actually quite helpful to dyslexics. Among other things, the fact that b/d and p/q aren't exact mirror images of each other was thought to very helpful. (Other fonts, some specifically designed with dyslexia in mind, were also mentioned... although it appears opinions are mixed as to whether they actually help.)
It caused me to wonder if there might be other minor tweaks that would make text more "readable" for dyslexics. I'd not thought about adding flicker. (I'm not dyslexic myself, but my wife works at times with kids with a variety of reading issues. Some of these kids are way behind their peers academically, and probably wouldn't be if the text could just make its way from page or screen into brain.)
The Lili site linked in the Fine Article is short on details of how this works. Still, kudos to them for giving it a try.
I suppose you must have missed the story a few weeks ago about the Apple guy who fell victim to some sort of Apple gift card scam and Apple punished him for it.
I read about it in an article on this very site about four weeks back. Your post reminded me of it and caused me to me to wonder if he ever got things sorted? Turns out he's regained access to his account after truly Kafkaesque shenanigans.
The image at the top of his post, with Tim Cook saying "I am altering the terms; pray I don't alter them further", sums things up nicely.
With a modern HDD [and, I'd assume, SSD], a single overwrite of 0 over every block will erase all the data (not in a bad block)
I vaguely recall reading of "disk-erasing" software that would, say, overwrite with all zeroes, then all ones, then random patterns. I suppose one could theoretically still recover data after performing such shenanigans, but only in the sense that one can theoretically take a burnt-to-crisp piece of paper and reconstruct what was written on it.
With the significant caveat that I've never tried Sibelius or Dorico : I simply type up tunes in ABC notation using Any Text Editor®. I then run the result through abcm2ps (to produce PostScript or PDF sheet music) and/or abc2midi (for MIDI output).
ABC appears to have been originally oriented to use for traditional fiddle and folk music. I've used it quite happily outside those areas, but could believe there are better alternatives out there, especially for the more keyboard-averse.
even if you can see colours well (which I do, for some unknown reason because my father was as colourblind as they come)
I am pretty sure that most forms of colo(u)rblindness sit on the X chromosome. So, as with hemophilia, women are relatively safe from it; if one X chromosome has the problem, it'll be masked by their other X chromosome. They will be carriers, and their sons will have even odds of being colourblind.
If you're male, you didn't get your father's "bad" X chromosome (just one from your mother), and his vision doesn't enter the equation. If you're female, you are definitely a carrier (you did get your father's X chromosome, but it's masked by your mother's "good" X chromosome.)
SpaceX has some minor incentive here. But their basic approach is to make the satellites as cheaply as possible and replace them as needed (which, given the numbers involved, makes excellent sense.) They will make the calculation that a certain level of effort to avoid collisions is optimal : do less, and you lose money because satellites collide. Do more, and you aren't bringing the risk down enough to justify the effort.
They will not, however, worry about other, more expensive spacecraft that they don't own. That is an "externality", also known as "Somebody Else's Problem", and therefore invisible. Clobber a billion-dollar reconnaissance satellite or the Hubble Space Telescope, and there is no impact on the Holy Grail of SpaceX "shareholder value".
So no, the invisible hand of the market does not fix absolutely everything. Only things that affect shareholder value. Sometimes, not even that. For everything and everyone else, the invisible hand just gives you the finger.
vehicle with the least to lose in a collision has the right of way -- actually works (sort of) in Boston [Massachusetts]
Where the official driving motto is "Death Before Yielding".
(I'll be driving to Boston in a few days to pick up my daughter at the airport. Not looking forward to it...)
Yes, it is basic physics. But the result (as I see John Robson has pointed out) isn't what you expected. By your reasoning, we could (say) tap a marble with a car and have it shoot off like a bullet. Make the object smaller, and we can speed it up arbitrarily.
Coincidentally, I was recently reading Randall Munroe's book What if?, in which he mentions seeing a comment from a medical examiner about such injuries. Apparently, most people are not killed by the impact. Instead, it breaks their legs, they go over the hood and hit the windscreen with their heads, usually "starring" the windscreen. Then they go flying off the car and hit the pavement, and then are killed by head injuries when they land.
John Robson wrote "...assume an elastic collision", but then did the analysis (correctly) for an inelastic collision. From the ME's comment above, it sounds as if the momentum transfer is incomplete; the pedestrian doesn't wind up going as fast as the car. If the car is coming in at, say, 22 km/hour, and the pedestrian has a mass 10% that of the car, the result is not that the pedestrian stays on the hood with car and pedestrian going 20 km/hour. More likely, the car proceeds at about (say) 21 km/hour and the pedestrian follows at a lesser speed.
For an elastic collision, the result (for Mcar >> Mpedestrian, true whether the car is ten or a hundred times more massive than the unfortunate pedestrian) would be that the pedestrian would be thrown forward at twice the speed of the car. Perhaps if you wore a rubber suit, you could manage that.
I think you meant Earth-Sun L2. (As far as I know, only China's Queqiao-1 relay satellite is at Earth-Moon L2. Sort of; it's in a "halo orbit" circling that point.)
I've been working in orbital dynamics for about thirty years. There's no particular agreement as to whether Earth-Sun L2 (and L1) qualify as "earth orbit heavily perturbed by the sun" or "solar orbit heavily perturbed by the earth"; it's sort of a hybrid situation.
When generating orbital elements for such objects, my orbit determination software defaults to heliocentric; at JWST's distance, that's a much better fit to the actual motion (i.e., a two-body orbit based on the sun reflects the actual motion better than a two-body orbit based on the Earth... with an orbit based on the Earth-Moon barycenter falling in between.)
But I'm not wedded to that viewpoint (and you can override it in my software and insist on a geocentric orbit.) You will find other astrodynamicists who would call L1 and L2 "earth orbits".
Dunno why you got downvoted. Fish ladders here in the US at least have the reputation of having a "greenwashing" air about them.
I've just spent some time looking at the usual highly reliable source of all knowledge for information about this subject. It turns out that there are a lot of different types of fish ladders (some pretty clever solutions in there), a lot of different types of fish, and that (perhaps unsurprisingly) "fish ladders have a mixed record of effectiveness". Add in that I'd expect some dam operators to really try to preserve the fish, while others will use whatever solution is cheapest whether it works or not.
Circa 1990, the mapping company for which I then worked was looking at a contract for code to take a gridded elevation dataset and four latitude/longitude points, and determine the highest elevation within that quadrilateral. As the resident maths/algorithms guy, I started work on it. We were then told to stand down and switch to other projects.
I was relieved. I'd never written software that could kill people before (or since), and pictured myself writing a function that could result in an airplane hitting a mountain in a quadrilateral that my code had assured them had a maximum elevation of -32768 metres.
"No worse than a drunk driver" isn't good enough, and nor should it be.
I suspect Waymo, at least, is actually doing no worse than an average driver. Before you rush to downvote, consider that "better than an average driver" is not really all that high a bar. There are some pretty awful drivers out there pulling the average down.
The problem is that about 90% of drivers (rough guess) are better than average, and at least 99% of drivers think they're better than average. Even if self-driving cars reach the point where they're statistically better than having meatbags drive, there will be at least one horrifying case now and then. And that unavoidable fact may be enough to torpedo widespread acceptance.
True. When I started the company in 1992, long before the concept of "just G__gle it" existed, I didn't know about the quite Strangeloveian "original" Project Pluto.
Some years later, I read a vaguely familiar-seeming article by Arthur C. Clarke with a spoofed press release for "Project Pluto", a futuristic DoD project to turn the sun off for half an hour. (The explanation was that the US needed to investigate this because foreign powers might use the capability themselves to attack the US under cover of artificial darkness. Concerns that the sun might not start up again after the half hour were dismissed as overblown.) I think I may have read it as a wee lad and had that bouncing around in the back of my brain.
Apparently, there is a Macrosoft. Or at least, there was one; the site says it was last updated in 2005.
You do make me wonder, though. I assume if it's clear that you are intentionally trying to confuse people, you could be sued by the "real" company. If 'Micosoft' sells ice cream or plywood, I'd think you would be safer.
(The name of my business is Project Pluto. I have joked from time to time about possible issues with being sued by the notoriously litigious Walt Disney® megacorporation. But I write and sell software for astronomers and am a one-man show, too small even for Disney to get worried about.)
For those who, like me, missed the reference : here's a pretty horrifying picture of a Bergonic chair (early electroconvulsive "therapy" device).
Sometime in the early 1990s, a friend of mine purchased a CD-ROM of driver's licence/registration data from the state of Maine. Read a tag number, and you could look up the owner's name and address in the registration data. The licence data would then give you gender [0], date of birth, hair and eye color, etc.
The data fell in the category of 'public information', legally required to be available for the cost of duplication. It was a simpler time. (Though admittedly, it should have been an obviously Bad Idea even back then.)
[0] I'm not being politically correct here. Yes, the column was labelled 'sex' back then, and I started to write that it would "give you sex". Perhaps it's my dirty mind, but to me, that means something different.
it also likely means the end of The Register’s Bork column, in which we celebrate the many, many BSODs that readers have spotted in the wild over the years.
At the risk of pointing out the obvious (see icon), it seems to me that many of those articles involved relatively ancient versions of Microsoft's "OS". I think it'll take a while for the new, sanitized version to have a significant share.
Perhaps some rounding fraud took place?
It appears such can be surprisingly effective. "The attacker exploited arithmetic precision loss... to drain $128.64 million across six blockchain networks in under 30 minutes."
Not saying the buses wouldn't be potentially useful targets. Just that the routers and cell towers would be far more valuable, and would be so today, not just when invading Taiwan.
Besides, I'd say the West is already doing an excellent job distracting itself with its own problems, and I sadly expect things to get much worse before they get better. Were I China, I wouldn't see much point in murdering a country busily committing suicide.
I'd be interested to see comments from the downvoters. Pointing out that this isn't just a China problem, and that vast swathes of infrastructure could be bricked (intentionally or otherwise) from "foreign countries" (or one's own, or by "foreign countries" that have planted/figured out vulnerabilities in domestic code), seems entirely reasonable.
Truthfully, if I were running China's security apparatus, the ability to control British buses would be relatively unexciting. Surveillance over Windows machines, for example, would be much more interesting.
Errmm... well, no.
Space-Track is currently listing 1869 tracked fragments from that test. (That's what's left; many others have re-entered over the intervening 18 years.) They are at a variety of altitudes. Some got their perigees lowered enough to re-enter early on. Others have taken a while and are still in the process of "spiraling in" (not really a spiral, but close enough). There are plenty of objects at any given altitude to make it plausible (though unlikely) that the impact was the result of debris from that test.
While possible, it's "unlikely" because sadly, there's so much junk up there now that the 1869 tracked fragments, plus the doubtless many thousand too-small-to-track ones, don't raise the odds that much. But I wish China had picked a lower target. The comparable US test can be objected to for other reasons. But because it was done on an object already within the upper atmosphere, almost all of the bits and pieces decayed quickly. Two lasted longer, with the last one re-entering 20 months after the test.
Nice catch. You're right, it's entirely possible to make distinct number 1/lowercase L, and distinct number zero/uppercase o, in a 4x6 font. (And my vague recollection is that most fonts of that era were at least 5x7 anyway.)
Errrmmm... I don't think a dislike of Trump is particularly irrational. And I'm not a leftist (basically a hard-line moderate). I'm seeing my country fall apart and into the hands of a doddering lunatic. I consider that sufficient grounds to be disgruntled.
That aside, it's a pity many (most) will see that part of your post and ignore the rest. The basic points (the problems predate 2016; the US has been prying through data since at least 9/11; the only real difference is that some people are finally waking up to that fact) are quite valid.
Before 2016, I think you could say that the US recognized the value of having friends in the world, and the surveillance was not quite as thorough as it is now. You put those two things together, and non-US people are starting to recognize the value of digital sovereignty. But you are, of course, correct in saying that the problem predates Trump.