Posts by JulieM

UK.gov's smart meter cost-benefit analysis for 2019 goes big on cost, easy on the benefits

Why I have not got a "smart" meter

My existing meter uses a key which I can top up at any of several local shops, all of which are open until late.

The new "smart" meters can only be topped up at a Post Office.

I work nine hours a day, five days a week. My nearest Post Office is 25 minutes away from my workplace; it opens for business at the same time I start work, and closes before I finish. I get one hour for lunch, which leaves me ten minutes to queue up and pay -- minus any time required for shoe changing and drying off. And that 25 minute nominal figure is on a favourable day: rain, snow or temperatures above 25 degrees all add to the journey time.

Limiting my payment options is a significant downgrade, compared to the present arrangement. I'd end up losing some weight, substituting one meal a week with the best part of an hour's walking; but I'm not sure that makes up for having to trek to the Post Office in the worst the British winter can throw at me.

This image-recognition roulette is all fun and games... until it labels you a rape suspect, divorcee, or a racial slur

Obligatory Babbage Quote

"On two occasions I have been asked, Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out? I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question." -- Charles Babbage, inventor, over-running publicly-funded IT project.

Au my bog: Bloke, 66, on bail after 'solid-gold' crapper called 'America' stolen from stately home

Re: Graffiti Memories

But better that than take a chance,

Save your penny but shit your pants!

UK ISPs must block access to Nintendo Switch piracy sites, High Court rules

Re: Quantify losses...

In order for theft to have occurred, someone must have been permanently deprived of something.

Please tell me what anyone has been deprived of, when someone makes a copy of an existing game?

Bus pass or bus ass? Hackers peeved about public transport claim to have reverse engineered ticket app for free rides

Implementing Ticketing

If you can rely on both the mobile phone and the bus ticket machine having a good Internet connection at all times, it's simple enough for the ticket just to be a random number. The ticket machine validates it by querying the bus company's servers; every random number actually issued will be a key into a database, the rest of the record indicating the journey details or "already spent".

The difficulty is that you cannot rely on an Internet connection at the time of boarding -- but you equally cannot rely on the contents of the mobile phone being secure. So you have to assume that the ticket is susceptible to cloning. As long as the ticket is booked for a specific date, though, the risks are somewhat mitigated. And the thing you really want to guard against, is giving away the instructions to create any valid ticket from scratch. That's the real keys to the kingdom.

Now, there has to be an Internet connection from the phone at the time of payment; so it would be entirely possible to receive a secret token at that time. And we can assume there is a way to transfer data to and from the bus ticket machines at the bus depôt. What I would do is send all the relevant data -- time of validity, route, boarding stage, fare and so forth; i.e., all the stuff you would need to know to produce a bus ticket -- to the bus company's servers along with the payment request; and if payment is successful, I get a hash computed from all that information plus some secret, which is shared -- under the bus company's control -- by a separate channel with the ticket machines on buses. (It can be stored in RAM and erased in the event of tampering; only a bus driver can reset it). The actual ticket contains the "cleartext" and the hash which can only possibly have been calculated by the bus company, since nobody else knows the pre-shared secret.

The mobile phone just has to send the hash and the cleartext to the ticket machine somehow (over NFC, or by displaying something optically readable like a QR code). The ticket machine recalculates the hash by combining the cleartext with its own copy of the key, and indicates acceptance or otherwise.

A hacker cannot make a ticket from scratch without knowing the bus company's secret which is used to create the hash. The only places that secret is kept are the ticket machines -- which you have to assume have some physical security measures in place -- and the bus company's servers. The most you can do is clone another valid ticket. There are some measures that the bus company can take to guard against this: a ticket machine that has already seen a ticket before can refuse to accept it again, so a whole group of people can't all travel at the same time for just one person's fare. And at the end of each day, if an impossible situation is noticed (such as the same ticket being used to board two buses going in different directions, from different stops, at such times as there was no way for someone to have got off the first bus in time to catch the second) the ticket serial numbers involved can be flagged up. There isn't much you can do about ordinary one-way and return tickets being cloned, but multiple copies of a weekly or season ticket are easily spotted. Out of n tickets, at least n-1 must be forged; and the owner of the nth one is probably in on the scam.

It might well be possible, by means of a distributed effort, to determine the format of the cleartext portion of the ticket. But the intrinsic many-to-one mapping of a hash function makes it computationally expensive to brute-force the secret needed to calculate the hash.

That's just off the top of my head. I'm sure there are problems I have not thought of, and look forward to the opportunity to learn where I went wrong.

This is nothing new

The "old skool" way of getting free bus transport involved a dot-matrix printer, a purple ribbon (wound by hand into the cartridge) and the hardest part: some cunningly-written software to emulate the font used by a Wayfarer mk2 or mk3. (The printer was a skip find, with no manual, and this was in the days before Google. I had to do a bit of reverse-engineering to get a handle on the control codes. Fortunately, the Amiga happened to have a driver for a similar enough printer; so I was able to create a specially contrived image in Deluxe Paint and use the hex dump mode of another printer to see what was going down the wires.)

Every bus would display a "Know Your Ticket" poster explaining the meanings of each group of figures on the ticket (boarding stage, fare, single or return, vehicle number, route &c); making it easy to produce something that could be mistaken for a return ticket issued earlier that day at place you were going to. As for obtaining the blank paper with the bus company's logo up the middle, ends of rolls were easily scavenged from the "used tickets" bins -- or if you had access to a small and cute child, drivers would give away a full roll to encourage a future bus driver! Snap-off knife blades were easily modified to produce the correct cut pattern.

Then the local bus company made it all even easier, by accepting returns after the date of issue and even in the "wrong" direction (e.g. if you got a lift home from town, you could use your return half for another journey back into town another day). Well, it would have been churlish not to.

It all went great for our little "New Age Travel agency" -- until both the local bus companies swapped their dot-matrix ticket machines for thermal printing ones. They said officially that it was to do with Y2K, but we knew damn well that was not the full story.

About this time, another bus company in a different city (that we sometimes visited) ran a "lucky serial number" promotion. The idea was, you handed in a ticket with the winning serial number in any shop that was a Travelcard agent, and it was worth £10. There were lots of little parades of shops all around the ring road, with a Travelcard agent among most of them; and all served by a frequent bus service in each direction.

The plan would have been to print up a batch of "winning" tickets and a couple of Daysaver tickets valid for the day of the operation; then for a friend and me to catch the 11A (which went all the way around the ring road in an anticlockwise direction) and 11C (clockwise), getting off at every Travelcard agent around the route and redeeming one of the lucky tickets there; and eventually to meet up again exactly 180 degrees away from the starting point (or more probably, in the nearest pub. Clockwise is slightly further, of course, but traffic conditions and queues in shops would be the greatest confounding factor). At which point we could then head for home with the loot, in time -- maybe -- to catch our own exploits on the evening news. Or even head back into town and do a few more shops along the way, if we still had tickets left.

I still wonder just how much we could have had out of that scam, if we had only had the stones to go through with it .....

Full of beans? Sadly not as fellow cracks open tin at dinner to find just one

Fridge Light

Actually, I once devised an almost foolproof experiment to determine whether the fridge light went off or stayed on when the door was closed.

This consisted of wiring a multimeter in series with the fridge, to measure the current. If the light was going on and off, the reading should have changed as the door was opened and closed.

As I said, it was almost foolproof. The only error in the execution was leaving the meter switched to a resistance range (in which it was expecting to see just a fraction of a milliamp from its own internal battery), rather than an AC amps range.

Now, modern multimeters can supposedly laugh in the face of such abuse; but this was many years ago, and this particular instrument was decidedly not happy about having mains applied to it with only the compressor for a current-limiting resistor.

Tempted to play with that Chinese Zao app for deep-fake frolics? Don't bother if you want to keep your privacy

Re: Might be a good time to start reading those EULAs

Back in the day, when I was in charge of a little mailing list, we had the following data protection statement: "Your e-mail address will not be used for any purpose -- not even for keeping our own arses out of jail".

If someone doesn't believe in something to the extent that they are willing to go to prison for it, that should tell you something.

Google security crew sheds light on long-running super-stealthy iOS spyware operation

Re: Entire populations: State sponsored?

Need it be a nation state, though? I mean, really?

Governments are not the only entities with that kind of money anymore. There are corporations out there with spending powers that would put them safely on the World stage.

Is it really that great a leap to imagine a corporation spotting a strong enough correlation to make it worth targetting an entire ethnic group, if they caught a faint whiff of money in it? If you run the numbers, and discover that a certain group of people have a certain habit in common -- not universally, but sufficiently more so than the general population to be worthwhile -- and there is a way for you to get some of that action, wouldn't you? A corporation would justify it by saying not to do so would be a disservice to their shareholders. (Never mind the disservice they were doing to victims of the very racism being promoted by playing to the stereotype.)

Of course, if that ethnic group happens to be anything besides "European Agnostics", it is going to require extraordinary sensitivity even to report the story without inflaming tensions. The far right will claim that one particular stereotype happening to line up with observed reality in some cases proves them correct, while members of the minority in question will be understandably angry.

Actually, I can see the attraction in believing it to be a nation state responsible for this after all. Much less nasty stuff to think about .....

Dropbox would rather write code twice than try to make C++ work on both iOS and Android

Re: What the hell is C++, Java, C# and the other drivel?

That was how a lot of programming used to be done, in the days of magnetic core memory and before index registers.

Canonical adds ZFS on root as experimental install option in Ubuntu

Re: The SFC can kiss my taint...

The problem with the BSD licence is that it doesn't oblige anyone downstream to distribute Source Code. This means someone could take your BSD-licenced code, make a slight change to make it incompatible with your original, cage it up and turn it into a proprietary product.

The GPL protects against this, by saying unequivocally: Not sharing is stealing.

Alexa, can you tell me how many Chinese kids were forced into working nights to build this unit?

Exporting Misery

We quite rightly have laws in the UK which protect workers against exploitation, by restricting maximum working time, obliging employers to provide toilet and refreshment facilities and breaks for the use thereof, outlawing child labour, paying a minimum wage, guaranteeing the right to belong to a trade union and so forth.

Allowing the import of goods manufactured under conditions which would not be acceptable here subverts all this. It's saying, there are ways in which it's not OK to treat a British worker -- but it's fine to treat a Chinese worker in those same ways. How is this not racism?

Until we place a total ban on the import of any goods produced under conditions which would not be acceptable in the destination country, we are exporting misery. (And not doing our own workers any favours, if they are unemployed because everyone is buying cheap quasi-legal imports.)

Cloudflare punts far-right hate-hole 8chan off the internet after 30 slayed in US mass shootings

Re: "Rational Gun Control"

Making a gun at home is certainly possible, but not everybody has the skills necessary to do it -- and those who do, generally prefer putting those skills into practice: which is easier if you are not in prison for life, or dead.

The point you have to aim for is where *finding a way of solving a problem that does not require killing somebody* is easier, for most people, than killing people.

Our hero returns home £500 richer thanks to senior dev's appalling security hygiene

Re: Ahhh passwords...

But at least with a Mac or Linux machine, you can usually ssh in from somewhere else and then find a way to fix things.

It's a bird! It's a plane! No, it's two-dozen government surveillance balloons over America

First online, now this

Back in the days, privacy could be taken for granted. If you wanted to have a conversation with somebody and it was important not to be overheard by anyone, all you had to do was take a walk in the countryside. So there was no need to make laws about these things.

Today, an entire industry has grown up, monitoring people's behaviour online in ways that would not have been possible in a traditional context without at the very least having someone turn around to you and ask "WTF is wrong with you? Leave me alone, you creep!"

And now there is a generation of kids growing up never having known what it's like not to be under continuous surveillance. These really aren't good conditions for any efforts to pass privacy laws.

Intrusive mass surveillance is always sold as a weapon against criminals, but nobody is ever more than one government vote away from becoming a criminal. And Angry from Tunbridge Wells writes to the local paper, saying "If you have nothing to hide, you have nothing to fear" -- but he still seals the letter in an envelope.

BOFH: Oh, go on, let's flush all that legacy tech down the toilet

Re: Outsourced?

A per fundamens basis, surely?

Alibaba sketches world's 'fastest' 'open-source' RISC-V processor yet: 16 cores, 64-bit, 2.5GHz, 12nm, out-of-order exec

RISC-V

Is this the processor architecture that doesn't even have a carry flag?

How are you supposed to implement multi-word arithmetic?

As the world secures itself, so do crims: Encrypted malware on the rise, warns Sonicwall

The Fix

There is a simple fix for all these shenanigans.

We need an Operating System that is designed not to allow the execution of Native Code. (And ideally, a processor architecture where no two examples in the world even share the same instruction set, just to make really sure.)

If everything is interpretated, and therefore all code is human-readable, there is nowhere for malware to hide.

We probably also need to think about investigating whether a system that is by design Turing-incomplete enough not to support the propagation of malware can do anything useful.

Free supported Java turns up in latest SQL Server 2019 preview

Re: Paying Oracle

If you approach a typical tie-wearing spivvy salesman working for a typical corporation and tell him you have a requirement for something to crack a nut with, he's going to try to sell you a steamroller -- preferrably the most expensive one in the catalogue, because he gets paid more commission for selling you a more expensive product.

Given that you use 20% of the features 80% of the time, I'd bet a fair number of people paying for proprietary databases would be no worse off with something else. And if you're using Java alongside a database, then the chances are that most of the actual SQL is hidden away behind methods specific to your objects, which in turn are calling a generic database driver; so replacing the database server and thus the SQL dialect should be reasonably painless.

The spiv is always going to try to convince you that you can't live without special feature X that's conveniently present only in the more expensive products, even when your use case doesn't really require it. If you use a feature only rarely, it can be emulated in the application or driver layers; and the slowdown will be less noticeable because it is only happening occasionally, if not masked altogether by a serendipitous speedup elsewhere.

It's about not walking all the way to the tool shed to fetch a chisel, if there is a screwdriver to hand which is up to the job (note the emphasis; you're heading for grief, if it isn't).

Paying Oracle

If you don't want to pay Oracle for your Java, wbich is fair enough, why not use MariaDB or Postgres and not pay for your SQL either?

Operation Desert Sh!tstorm: Routine test shoots down military's top-secret internets

Re: Mirror ain't backup

If the drives are really hot-swappable, and there isn't an active swap partition on the one you pull out, such an abuse of RAID1 isn't actually a terrible way of backing up data. At least with mechanical drives, the rate determining step is getting the zeros and ones onto and off the actual ferric oxide; writing the same data onto two drives at once does not take any longer than writing to just one drive.

However, you do need to have more than just two drives, so you always have what is hopefully a spare copy of the data that hopefully is being resync'ed; just for when -- not if -- it goes Pete Tong and decides to copy the contents of the drive you just inserted over the one that was in there the whole time.

Re: Recovering after loss of power - paper bootstrap.

Shades of Del Boy's combination lock briefcases, with the combination printed on a slip of paper inside each one .....

It's so hot, UK needs to start naming heatwaves like we do when it's a bit windy – climate boffins

A Touch of British Whimsy

There is a delightful touch of something warm and whimsical about giving the weather human names.

Especially when they get downgraded -- as they invariably have by the time they reach Blighty -- to the likes of Light Breeze Hannah or Better Put a Coat On Idris .....

Just add water: Efficient Energy’s HFC-free chillers arrive in the UK

Strange units

A BTU is enough energy to make 0.454 kg. of water 5/9 of a degree hotter. A Lesser BTU is one-sixteenth of that.

Microsoft bungs a billion bucks at biz developing AI that will take our jobs 'for the benefit of all'

Not releasing GPT2

FTA: "Due to our concerns about malicious applications of the technology, we are not releasing the trained model," the company said.

As though that would stop anyone from just re-implementating the whole thing from scratch. Their programmers aren't any smarter than a million independent experimenters, who also have access to all the same training data.

Experts: No need to worry about Europe's navigation sats going dark for days. Also: What the hell is going on with those satellites?!

Re: Definitely Russian or Chinese hacking

Spare him his life from this monstrosity!

Re: Definitely Russian or Chinese hacking

Magnifico!

Literally rings our bell: Scottish eggheads snap quantum entanglement for the first time

Isn't this just like .....

Isn't this just like taking two playing cards, one red and one black; having a volunteer from the audience select one; transporting the volunteer and their card halfway across the universe; turning over the remaining card; and knowing at once the colour of the chosen card, before that information could have travelled at light speed?

How an ace-hole AI bot built by Facebook, CMU boffins whipped a table of human poker pros

Re: They might not be releasing the code, but

Right now somebody probably is working on an Open Source poker bot. And "acheivable with readily-available materials" is pretty much a given, seeing as they'll be stuck with little more than readily-available materials.

Of course, if the bots get too good then nobody will want to play against them .....

Tells

It would not be impossible for a computer to have tells of its own. Or to pick up on other players' tells, if there is any spurious information being given away in the amounts bet or the timing (for instance, always betting an amount ending in £5 with good but out-of-suit cards; or deliberately pausing before betting with a potential winning hand to avoid scaring the other players away before the pot has built up).

Congratulations!

You are their ideal customer!

Raspberry Pi supremo Eben Upton talks to The Reg about Pi PoE woes

Removing smoothing capacitors

If you removed the smoothing capacitors, wouldn't you end up with Raspberry ripple?

ReactOS 'a ripoff of the Windows Research Kernel', claims Microsoft kernel engineer

Re: Is there any reason to suppose this latest accusation is any more plausible?

Just because something's written in a different language, does not mean you can't use the same naming scheme.

NPM Inc settles union-busting complaints on third try – after CEO trolled for ordering internal mole hunt

Stuffed Moles

Given the sense of humour of the likely participants, I'm almost surprised nobody tried to send them 6.02214e+23 stuffed moles .....

This weekend you better read those ebooks you bought from Microsoft – because they'll be dead come early July

Microsoft being the good guy for once?

There really needs to be a non-ignorable story like this, in which people get hurt, just so the whole affair can stand as a bright "NEVER AGAIN" warning to all succeeding generations.

It's just possible that this stunt will be the one that finally turns people against the whole idea of DRM.

It's also interesting that Microsoft are refunding customers' money -- it's almost as if they want to make sure they don't end up creating a precedent through a court ruling that bypassing faulty DRM in order to access content that is rightfully yours but your access is being blocked by a problem with the Digital Restrictions Management is legal. (There's already precedent that if you find something that was lost or stolen after you claimed on your insurance for it, it becomes the property of the insurance company. If you've been refunded for a digital download which has been treated as lost/stolen, you were supposed to buy another with the refund money, and the bits of the broken one don't belong to you anymore.)

If I was feeling charitable towards Microsoft, I might think they were taking one for the team, and doing this to cast DRM in a bad light.

Suspected dark-web meth dealers caught by, er, 'using real address' when buying stamps

Who needs an address to buy stamps?

At what sort of post office need you give your address just to buy stamps?

ProTip: If you are running an illegal mail-order enterprise, it's best to pay for your stamps with coins (no serial numbers), not handle them or your outgoing parcels with your bare hands and definitely not moisten the adhesive with your own saliva.

Delphi RAD tool (remember that?) gets support for Linux desktop apps – again

No, thank you

There are plenty of Open Source programming languages and toolkits available natively on Linux. What do we need proprietary ones with onerous licensing requirements for?

Summer's here, where's Windows 10 19H2? For Microsoft, spring ends whenever the heck it says so stop asking

Re: Obligatory Pedant

It's reading the value of Windows each time at the beginning of the loop; and as long as this is one of those system pseudo-variables that BASIC used to use, and responds to other pseudo-variables being written, it will work.

Actually, maybe the pseudo-variables update asynchronously and the redundant pre-increment copy is a cunningly disguised clock slide ..... and a nice little trap for the unwary future maintainer!

Obligatory Pedant

That should be

IF (DateTime.Now > Spring) { WHILE (Windows != Done) ++Spring; }

You don't care what the value of Spring was before you added 1 to it. You wasted CPU cycles, and possibly memory, making a copy of the previous value of Spring; and then you went and forgot all about it. It's a good job for you that computers don't have feelings; because if they did, yours would be well and truly pissed off.

Anyway, I shouldn't be here. I've got a beam to chase .....

Idle Computer Science skills are the Devil's playthings

Virii

What is a virius?

There's a reason why my cat doesn't need two-factor authentication

Wired as superior solution

Well, the cat flap doesn't tend to move very far away from the back door; and the back door, in its turn, doesn't tend to move very far away from the kitchen. So there is no good reason for it not to be primarily mains powered. It does have a disposable 9V battery for back-up purposes. I should probably check that, actually .....

My cat's smart flap is powered from a mains adaptor; and judging by the weight, it's the old-fashioned transformer type.

We ain't afraid of no 'ghost user': Infosec world tells GCHQ to GTFO over privacy-busting proposals

Epic Fail

There are exactly two kinds of encryption:

There is the sort that absolutely nobody but the intended recipient, not even The Authorities, can crack; and there is the sort that The Authorities, and absolutely anybody else with the inclination, can crack.

There is nothing in between. If there is a way for one party to recover the plaintext without the decryption key, then that way can be used by anyone else who does not have the decryption key to recover the plaintext.

This is not a limitation of present technology, that will be solved when something is invented. It is a limitation of mathematics, and nothing that could be invented would make the slightest bit of difference.

We honestly need to give up on the idea of encryption backdoors. The first type of encryption exists, and there is no way to prevent a really determined person from using it anyway: encrypted traffic on a network is indistinguible from noise, and in any case there are plenty of ways to pass information entirely outside of that network. Forcing people to use the second type is going to lead to data leakage.

If servers go down but no one hears them, did they really fail? Think about it over lunch

Re: "Pound" and "hash"

It all goes back to the original 7-bit ASCII. The official UK variant of ASCII replaced the comment mark (at 35d/23h in the US variant) with a pound sign. By the time anybody in the UK could afford a computer, British home computer manufacturers such as Acorn and Sinclair were leaving the comment mark at 35 and putting the £ sign at 96d/60h, where it replaced the execution quote `. But the American people were now convinced that # was the British currency symbol.

If you knew what you were doing, it was possible to whip the character ROM out, dump its contents (literally as simple as plugging the chip into your motherboard, if you had a BBC micro), alter them slightly and burn an EPROM (usually a 2764) that would print a pound sign for 96 and a comment mark for 35.

It's all in the RISC: Arm legs it to Computex with a head full of Cortex-A77 CPU, Mali-G77 GPUs

Re: Body puns

I'm still waiting for a certain Umbrella hitmaker to get caught on camera relieving herself in New Zealand. "RiRi's Kiwi wee-wee shocker", anyone?

Uber JUMPs at chance to dump load of electric bikes across Islington

Re: Next logical step

I have seen first-hand evidence of this: Deliveroo drivers on rented bikes.

All it's going to take now is going to be for someone to introduce sleeping pods that you rent for the night, and we will end up with full-on gig economy accommodation.

Dedicated techie risks life and limb to locate office conference phone hiding under newspaper

Re: Donkeys

Preferrably fluffy, and with a no-show sock. And your younger sister's trackie bum-bums.

Mine's the silver, puffy chest-length one.

Legal bombs fall on TurboTax maker Intuit for 'hiding' free service from search engines

Re: Not being an American

That's more of a problem with the way your taxes are collected. In the UK, the government prefer to deduct taxes at source wherever possible. Prices advertised to consumers have to include VAT (sales tax). If you work for an employer, they are responsible for your income tax; and if you have a bank account, the bank have to take care of the tax on any interest due to you. Things like competition and lottery winnings are not taxable, tax being levied instead on the entry fees out of which the prizes are going to be paid.

Re: Not being an American

You can release the Source Code; but every user will have to obtain their own API key, which would then be stored in a configuration file.

Re: Not being an American

The UK government has published the API for submitting tax filings, so any competent programmer can write their own software -- and / or release it as Open Source. You aren't being forced to use proprietary third-party software.