Posts by Claptrap314

Totaled Tesla goes up in flames three weeks after crash

Am I the only one

that REALLY doubt's that these electric cars are "good for the environment"?

Bipolar transistors made from organic materials for the first time

Is this moving things forward?

I would like to know what kind of minimum feature size we are talking here. Also, switching speed. Also power consumption. Also MTBF (in several variants). Also, expected manufacturing complexity & stability...........

I'm not raining on conducting research, I just want to know what we really have here.

Re: Just a small elephant...

I'll trust you on the Si side of things. Do we know this on the organic side?

Mega's unbreakable encryption proves to be anything but

Re: repeat after me

You must trust someone. The problem is that few people even have the education to even understand WHY they should not trust themselves. (Most can be browbeaten into submission, but that's a separate matter.)

I was just talking about this to a friend. There are probably about 3000 people in the world today who I would trust to write a crypto library. I'm arrogant enough to include myself in that list. But because I _am_ properly trained, I also know that it would take me FAR longer to convince myself that I had not messed something up than would be worth it.

DARPA study challenges assumptions about distributed ledger (and Bitcoin) security

What exactly is new here?

And by "new", I mean, "Not already discussed on the cyperpunks mailing list in the '90s?" Certainly, we did not call the pools by that name. But the concepts were all there.

The fact that this "report", or whatever they are styling it, doesn't even mention the 40% attack on Bitcoin means either someone needed to get something published, or that this paper is an attack on crypto. (This is coming from the US govt, of course.)

I was a cypto-skeptic in the '90s. I've never attempted to create an account. I've publically called BTC & friends "beenie babies" & "tulips" & worse. But this "report" contains less value than an airdrop in Somalia.

Cloudflare explains how it managed to break the internet

Re: I'm curious

It's $200/mo for something that their competition does for free. You attacked their business model over this. And I'm doubling down here--you're demonstrating an utter lack of proper prioritization on this point.

You know (apparently first hand) that the monthly cost of building a resilient app runs at least 6 figures a year. Against that level of spending, you're going to weigh $2500 priced as an addon? What if the cost of the base contract is $5000 less?

Look, if you just don't like them, that's fine. But any evaluation of a solution has to be based on total cost, and you're talking about a rounding error.

I'm curious

How many of the stone-throwers here have ever worked in, let alone managed, an operation of Cloudflare's scale?

I've not been inside, nor have I had any extensive dealings with them, but I will say this: getting this stuff right is **** hard. I've not read their post-mortem, but just from the article, they are showing FAR more transparency than we generally see.

To address two specific points, one from the article and one from the comments. First, if $200/mo is enough to matter, then you are not spending enough on resilience for me to care what your opinion is. Resilience happens at every level of the stack, and it is a sick joke to suggest that it can be achieved on a shoestring budget.

Second as for that blowhard CEO's gripes: what is your company again? This is the sound of a small competitor whose many failings have not been in the news because they don't matter.

Certainly, from just the article, it is clear that "mistakes were made". But the nature of these mistakes--insufficient QA before a change, unclear responsibilities during a major incident--are relatively easy to fix, especially when compared to, say, Google's inability to get quotas right, or Microsoft's inability to even have an inventory of their internal DNS servers.

Yes, yes: this incident is another reminder that resilient happens at EVERY level of the stack. No one said otherwise. And big does not mean "perfect". No one said otherwise.

CISA and friends raise alarm on critical flaws in industrial equipment, infrastructure

Re: Hmm

"safely" "connected network"--I'm not certain that you fully understand each of these terms...

This is the Sonos problem

I interviewed with Sonos a few years ago. Spoke with their head security guy. Their original security model was, "don't plug in to other computers". Yeah, customers didn't do that. So, they updated to "don't plug into the internet". I think you know how that went.

The difference of course, is that Sonos is providing entertainment.

There is no way in 4377 that these systems should be anything but air-gapped to the public internet. Any any connections between systems must be carefully analyzed for absolute need to connect by security experts. The hw for these installations tends to start around $1B, and goes up (way up) from there. Security is a core requirement. Pay up.

Re: Hmm

In order to ensure 100% isolation from your corp net, you either need 100% isolation from the internet or 100% isolation between your corp net & the internet.

You might want to bring that up to your boss...

Google, EFF back Cloudflare in row over pirate streams

Interesting

that Cloudflare is objecting to being ordered to drop service to a client convicted of breaking the law, while it public dropped service to a client that was merely extremely distasteful.

These are NOT good times...

NASA tricks Artemis launch computer by masking data showing a leak

At least...

There will be no teachers on this one...

381,000-plus Kubernetes API servers 'exposed to internet'

Re: I was gifted a K8s admin course

I AM THE MANAGER<bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs>A DEVELOPER!

But I prefer to call myself a SWE.

Sure, your average dev hasn't had to think about anything below level 7 since that lecture he slept through back in school. I'm not suggesting that such a person has any business in this space.

I was gifted a K8s admin course

When I got to the part about firewall rules, the default is.... allow all.

The entire project feels like a tour de force in how to do the right thing either the wrong way or at the wrong time, but that finally broke me. I could not bring myself to continue.

Borg is an excellent solution to Google's internal problems. K8s...is a Go training tool for potential future Googlers. Nothing else makes any sense.

Beijing needs the ability to 'destroy' Starlink, say Chinese researchers

Tracking the missiles, not the targets...

Re: @Pete 2 - wolf in sheeps clothing

The embassy's orders were to deliver the message precisely one hour prior to the strike, per the Geneva conventions. Unfortunately, they had prior orders to destroy all but one of their machines, and that machine experienced mechanical difficulties.

It did not matter. We had broken their code. FDR had the message from the Signal Corp hours before. They speculated that the attack would come in Indonesia.

ICBM tracking. Essential for US vs USSR conflict. Still important for US vs China, but not as much.

US ran offensive cyber ops to support Ukraine, says general

Re: "You realize, of course.."

That would require that American foreign policy be coherent. A major weakness of popular governments is that their policies are subject to 180 degree changes at the drop of a ballot.

Still, there has been a consistent signal of weakness that defies logic associated mostly with D presidents, (but also pre-9/11 Bush 43).

Re: "You realize, of course.."

You say that like they are the only ones...

"You realize, of course.."

Not that long ago, there was an article in these Esteemed Pages about an update to the Geneva conventions to the effect that cyber attacks count as war. This has important implications, because, according to the general, the US has now conducted acts of war on Russia, and I am aware of no actions by the US congress to authorize such.

Of course, there is no way that the general would be making such comments without approval from the higher ups. I'm wondering exactly what the purpose is here.

If he had something like, "Russia has been hitting us for years, and we have decided we must now respond in kind", that would at least be a fig leaf. But this does not even appear to have been that.

Investors start betting against Bitcoin with short-trade products

Re: Investors or gamblers?

VERY few games are only played for one round. In fact, there are a lot of schemes out there where you must gamble for a significant number of rounds.

But yeah, in no case is the house ever on your side. And the folks making the rules are smarter than you, with faster computers.

If you would agree that paying taxes is the intrinsic value of taxes, (private ownership of gold bullion being generally outlawed), I would agree. But you don't.

Re: Ponzi Scheme?

Cash can keep the boys with a badge & gun off your front lawn. That is it's irreducible value. I suppose that bitcoin can do that in one Central American country now as well, but I'm not betting on the stability of that government, either...

HashiCorp tool sniffs out configuration drift

Fool's errand

Unless you capture the state of the entire hard drive, it is impossible to determine if there have been any important changes. And even if you pretend that is enough, you're still basically trying to solve the halting problem.

The rule at Google was: if you need to log in to nose around, fine. If you touch ANYTHING, however, you log out via init 6. (Yes, the break glass credentials gave us root on the boxen.) I really cannot think of a better rule.

RSAC branded a 'super spreader event' as attendees share COVID-19 test results

Re: N95 masks

Please don't put "surgical" masks at the same level as the KN95s. KN95s are WAY more effective.

That's a different kind of virus...

Capital One: Convicted techie got in via 'misconfigured' AWS buckets

Re: "Quite an expensive misconfiguration"

I think you have misaprehended what exactly can be meaningfully done in a multi-tenant environment. Let's go down before we go up. Microprocessors can operate in different modes. For simplicity, let's call them, "privileged" (P) and "not privileged" (NP). It comes a surprise to many people, but when you sudo su - root, you are still running NP. The entire concept of "users" is an OS-level concept, and the root user is simply the one that the OS is happy to grant full access to the system.

There is a HUGE effort that goes into making sure that code running in NP does not get access to P resources, but none of that matter if the OS gets it wrong. Security is a "shared responsibility" between the processor and the OS. I'm no great student of processor designs, but I have a hard time imagining a system in which the processor managed thousands of security realms. It doesn't really make sense.

It is the job of the processor to provide the facilities to the OS to restrict access to general hardware resources. The actual management rests entirely on the OS. That includes the network card, and whatever is on the other side.

Now, suppose you have two computers connected via network cards. Each has their own OS, and each OS is responsible to decide what gets to the other computer, and what to do with what comes from the other computer. I hope you don't have a problem with the processor doing nothing but preventing NP access to the network card.

Hypervisors bring a new player to the table. Now, the hypervisor runs (often) in P mode, and the OS is kept in NP. In practice, of course, modern processors support three modes, H, P, and NP, but in the end, only the most-privileged mode get access to the network card, so for this discussion, it's accurate to consider the OS as just another NP process that the hypervisor gives special treatment to in the same way that the OS favors processes running as root.

So I ask: "What business is it of the hypervisor as to which users requests have been forwarded to it by the OS?"

Is not that AWS's IAM is a lousy model--it's that AWS is in no position to extend the OS-level concept of user (and remember, they are happy to run Windows, Mac, and a dozen distributions of Linux) to their hypervisors. A Lambda or EC2 instance is designed to be running a single (primary) application. Security groups and IAM roles are supposed to lock down everything not needed by that application or its helpers.

If you mix applications on a single instance, I submit that you are almost certainly doing it wrong.

If you create long-running processes which are accessing segmented data according to external input, (also know as a web server) you better not have a Bobby Tables problem--or any other.

In the cloud, YOU ARE NOT ROOT. You have to design your processes to account for this, not demand that you get a bespoke security model.

And IAM roles are enough of a pain as it is--I would argue that adding yet another layer of complexity to them would likely reduce end security. People seem to have enough trouble with the concept of "private" verses "public" on S3 buckets...

AI's most convincing conversations are not what they seem

Re: The real issue

Is or was? Pascal was a Christian, and he argued that the creator (God), being good, would not create the evil of a non-existent consciousness.

For those who consider Christian belief to be beyond the range of polite conversation, such arguments are utter nonsense. Among Christians themselves, and Pascal was part of a society dominated by such thought, this is a meaningful argument.

Of course, you can attack _any_ truth claim by deconstructing each word in it. (To quote a not-to-distant president, "It depends on what the meaning of the word 'is' is.") But that is almost a sign that you are wanting to avoid dealing with the substance of the claim.

Plot to defeat crypto meltdown: Solend votes to seize, liquidate whale account

Re: Bandwagon

I'm pretty certain that's what Dogecoin was supposed to be...

OMIGOD: Cloud providers still using secret middleware

Re: "they also add new potential attack surfaces"

They exist. These pages covered a story about it.

It is not clear to me who would execute such an attack. Perhaps an oppressive regime attempting to punish opponents?

Google offers $118m to settle gender discrimination lawsuit

This lawsuit has 0 merit

I said this when it came out, and I'm saying it now. I was at Google during the time in question. Google obsesses over hiring & promotions. Specifically, they obsess about discrimination, with an eye to ensure that there is no discrimination against women or minorities. They also keep insane amounts of data on the subject. Someone ran the numbers once, and oops! Turns out that they were paying men slightly less. Which is a surprise only to people who don't understand random walks.

Google is big. Really big. You just won’t believe how vastly hugely mindboggingly big it is. You might think that $118M is a lot, but to Google, that's just peanuts.

Even so, if I were a senior exec at Alphabet, I would do some checking into just how this offer came to be made. I suspect that someone's friend is getting $30M (in "fees") from Google's shareholders that they are in no way entitled to.

Chinese-sponsored gang Gallium upgrades to sneaky PingPull RAT

Re: Eve Online

Nation-state actors (except for the Norks) rarely bother with ransomware, for two reasons. 1) They take all they want from their subjects already. 2) The transaction provides a level of traceability that they actors don't want.

Azure issues not adequately fixed for months, complain bug hunters

Re: Who'd a thought Windows had security problems?

In other news, I heard somewhere that the Pope is Catholic.

No, OpenAI's image-making DALL·E 2 doesn't understand some secret language

"Computer!"

Why chasing the AI dragon may force big tech to take sustainability seriously

AI...dragon...sustainability

And here I thought that there might be SOME mention of China's abysmal performance on this front. But..nope.

Seriously enforce environment regs on datacenters & you will get serious migration of compute away from the regulation.

Of all places, I would expect El' Reg to understand this.

US, Europe move to secure access to Taiwanese tech

"That if once you have paid him the Dane-geld You never get rid of the Dane"

Keeping your head as an entire database goes pear-shaped

a wide-mouthed frog mounting a toad mounting a frog eating a worm mounting a horned toad mounting...

We have bigger targets than beating Oracle, say open source DB pioneers

Re: Oracle and MySQL

I remember talking to an EA hiring rep at an event around 2010. She said they were thinking about Mongo. I told her they were WAY too big to be thinking about MySQL or Mongo at the time. I did not know then how badly folks wanted to avoid Oracle, or why. Still don't think I was wrong.

MySQL in 2010 was fine for a lot SMBs. Not fine for big businesses, which is why Bezos went with Oracle before he had the chops to build his own.

How to explain what an API is – and why they matter

Re: I'm sorry

The big deal about REST was that it allowed a standardized way to organize an API. Without REST (as I am #*$(&@@ experiencing RIGHT NOW), the entire API document has to be carefully studied to understand what a particular call does. With REST, you can feel your way through, and scan most of the document.

Of course, REST led to OpenAPI & Swagger, which means that you often DON'T have to read the API documentation at all!

What was (and is) obnoxious about REST is that there are classes of interactions that don't fit the REST paradigm, and, so far as I see, there is no clean way to handle those cases.

Predator spyware sold with Chrome, Android zero-day exploits to monitor targets

Re: Only Chrome

These aren't bugs--they are features. They ensure people are forced to upgrade their "smart" phones--after the relevant parties have extracted the needed data, of course.

Despite 'key' partnership with AWS, Meta taps up Microsoft Azure for AI work

Perfect!

Any data not deliberately sold by Facebook can now be siphoned off from Azure!

For crying in... ----------->

Florida's content-moderation law kept on ice, likely unconstitutional, court says

Re: Oh, now sites are responsible for what's posted on them?

In a word, yes, to pretty much all of it.

Right now, posting to sm is posting globally. That feels cool, but it has global effect. Because these companies have chosen to make it a global effect.

Innovation is cool until it becomes innovative ways to break laws all over the world.

Suppose I (a natural US person) decide that I've had it with the current government of India. I learn Hindi (stay with me). I start stirring up the Muslim population. Just how far can I go before the government of India takes an interest?

One post.

Actual news organizations have had to deal with this forever. You go into a country, you abide by their laws.

The hard-won free speech rights supposedly enjoyed by US persons have never been global in scope--until Zuckerberg figured out how to make a mint off it. NO country is obligated to respect his business model. Or, the US version of Freedom of Speech.

I keep getting downvoted for this, but if you operate in country X, you must abide by the laws of country X. That applies to Facebook. That applies to me if I attempt to influence the affairs of another country.

Microsoft patches the patch that broke Windows authentication

Re: "patches to fix patches seem to be becoming a little too common"

They are called "users". Have been for the last... > 30 years.

Microsoft sounds the alarm on – wait for it – a Linux botnet

Passwords for SSH?

WAT? Seriously?

I mean, I guess my logs are telling me that the skiddies are doing it, which strongly implies that there are idiots out there like that, but WHY? Seriously, what benefit is there to typing a password?

And service accounts (including root) that you can log in as?

My guess is that it's a 254% increase in honeypots & tarpits...

To multicloud, or not: Former PayPal head of engineering weighs in

Lazy terminology -> bad results

Calling an AWS shop that uses GCP for analytics "multi-cloud" is nonsense. I mean, if you want to make the board happy, I guess. To be meaningful, multi-cloud needs to be talking about having an application running production loads in multiple cloud providers. If you're even trying to be serious, that means having DNS resolve to load balancers in multiple clouds, with the LBs in each cloud capable of routing all traffic to any cloud.

Actually doing THAT is not likely to make sense for any but a very narrow slice of businesses. As mentioned, the complexity of getting it right is a substantial cost in its own right. Getting any actual improvement in resiliency means understanding a LOT about the physical locations of the servers (information which, for some reason, cloud providers are reluctant to provide) and ensuring that barn X for CP A is sufficiently isolated from barn Y for CP B.

FAR better to get a deep understanding of reliability capabilities of your provider, and set up resilience using their tools. Your engineers are certainly NOT any better than theirs, and unlike yours, they DO have both the data needed to do it right, and the job description of only getting it right.

Unless you are on Azure. Then you can look for the occasional multi-hour all-systems outages.

But for AWS & GCP, if your business actually needs more than four nines, then you can read up on what exactly it takes to get there. I would think that 99.997% uptime is quite doable with single cloud in either. But if you actually need five or so, it's probably worth looking into building your own over going multi-cloud.

Ukraine war a sorting hat for cyber-governance loyalties: Black Hat founder Jeff Moss

You're half way there. In truth, we would be free to make posts like "Four legs good, two legs better."

If you've got Intel inside, you probably need to get these security patches inside, too

In case you've fogotten

THERE IS NO SW FIX FOR SPECTRE CLASS BUGS. Sw will be able to deal with many of them. But not all. Unless it flips the bit to turn off speculative fetches, per the original NIST recommendations (that lasted less than twelve hours).

There is a new generation of hw required with WAY more complicated caches to eliminate them.

How Intel and AMD hope to win the cloud security game

Honestly?

Is there ANYONE who thinks that the folks at AMD _want_ x86 to continue? Did not Intel roll out a completely new system around, ohh, 1998?

x86 is bolted on the outside of their designs. Okay, the K5 was a bad idea, but the inside of the K7 was about as non-x86 as you could ask for while not losing speed. I assume Intel's been the same way.

The issue is the install base.

Most organizations hit by ransomware would pay up if hit again

This is why

we cannot have nice things.

----------------------------------> For crying in.

Re: Surely there's an economic tipping point here?

Given how much dirt gets pours over id claims by nation states here, I think I see a flaw in your idea...