Posts by Claptrap314

You can't spell 'electronics' without 'elect': The time for online democracy has come

Re: Advantages of hand-marked, paper ballots

Historically, we've actually gone to decent lengths to limit the impact of this weakness in the system.

At the polling place, the judge and the alternate are from different parties. The alternate is supposed to accompany the judge as the ballots are delivered.

Central county relies on a lot of temporary workers. The parties (and even some larger candidates) recruit heavily for these positions, and the authorities are generally required to be representative in their hiring.

Any candidate or committee, including the parties, can register watchers, both for the polling places and at central counting.

Nothing is 100% of course, but if the system is otherwise healthy, this part of the process is quite good.

Why, yes, you can register an XSS attack as a UK company name. How do we know that? Someone actually did it

Re: Apart from those [restrictions] the Post Office has about addresses in general

Rule #1: Use whitelists, not blacklists.

Rule #2: Use well-validated libraries, not home-spun character escapes.

Rule #2 is almost as fundamental as "don't spin your own crypto primitives".

As maddening as it is when a website won't accept valid inputs, I must credit them with TRYING. Then attempt an out-of-band sales pitch to help them get it right.

Re: I am shocked and surprised: TFA failed to mention the "Obligatory XKCD"

That's because you've missed the point that by now it is safe to assume that EVERYONE on this site know this.

If you haven't patched WebLogic server console flaws in the last eight days 'assume it has been compromised'

Those whose right minds have shriveled to peanuts, of course.

Re: Damned

Don't use Oracle, Microsoft, or Adobe?

That will give you a bit of breathing space, I would think.

Lenovo to slap ThinkShield security standard for laptop line-up on its Motorola mobiles

Think Lenovo. Think PLA.

The CCP has already declared that it is the duty of every citizen to aid in the "struggle".

When a man says he is your enemy--believe him.

NSA: We've learned our lesson after foreign spies used one of our crypto backdoors – but we can't say how exactly

Re: I'd comment ...

As a rule, I would expect that an intentionally weakened generator by an expert would be _stronger_ than some POS put together by a non-expert. See, for instance the custom-rolled PRNG in Systemd.

The question is: which did u$ employ in this case?

If you are not publishing your primitives, they ARE junk. Prove me wrong.

FCC puts final nails into net neutrality coffin. In a week, America will vote on whether to bury or open it up again

I actually agree with Kieren on something?

"thanks to the issue of internet access being turned into a partisan political topic by the cable industry."

First time for everything, I guess...

That's a pretty succinct explanation for people who are unaware of how the internet works at those levels. The only thing that I would add is that you might have understated the importance of the asymmetry in content delivery--if the ISPs are forced to treat every packet as equal, then they become the beasts of burden for likes of Disney & Google. Until they leave the business, because there is no way to make money like that, except by raising prices so high that the local authorities revoke their sweetheart deals from the 80's.

Ready for pull rate limits? Docker outlines 'next chapter' as Google tells customers how to dodge subscriptions

In other news, grass is green

Their business plan is the path forged by the likes of Google. The transition is always dicey, I wish them luck.

If you don't understand that a single docker pull command can result in more than 100 image pulls, you don't understand a thing about docker. Of course, for many reasons, the better images will have a much smaller set of pulls, but there is _no_ guarantee.

ANY company that has a business-critical dependency on an outside free service deserves to have the tap turned off at the worst possible time.

For this particular service, there is NO excuse for the production pipeline to be making outside pulls. That unacceptable from a security standpoint, let alone a reliability one.

Linux kernel's Kroah-Hartman: We're not struggling to get new coders, it's code review that's the bottleneck

Re: Linux and more

That's because testing is part of writing.

https://en.wikipedia.org/wiki/Test-driven_development

Re: Linux and more

You're directionally correct, but very wide of the mark.

If you're not testing 100% of functional logic, you are NOT testing the logic. In production code, no branch point should exist except that a test requires it.

Comments are not executed. Therefore, they are documentation and subject to becoming a false source of truth. No comment should be needed to explain what is being done, unless it is along the lines of

# See https://en.wikipedia.org/wiki/A*_search_algorithm

def a_star(graph, start, end)

or, as mentioned elsewhere # This is to comply with policy blah

In fact, comments are code smells. If you feel the need to explain your code, the strongly preferred response is to simplify it until it does not need an explanation.

Re: Linux and more

I got so fed up chasing down overwritten variables that I created a preprocessor that was also a checker. Which meant that I had to declare my variables. By using useful names, comments became limited to the tops of functions. The source code shrank 20%. And it all became MUCH easier to maintain.

Did Arthur C. Clarke call it right? Water spotted in Moon's sunlit Clavius crater by NASA telescope

Re: Nuclear waste dump.

I regret that I have only one upboat to give. Have this ----->

Controversies aren't Boeing away for aircraft maker amid claims of faulty oxygen systems and wobbling wings

Re: "implemented corrective actions"

Farming is not something you "enter". The seasonal workers will _never_ gain the skills to match someone who has more than a decade of farming experience before he graduates high school.

As technology advances, each generation needs fewer farmers to replace the ones we have. We've become so efficient that even towns which once had 25000 people in them are shrinking.

But, from what little I hear, the millennial generation has figured out that the insane pace of the rat race that farming has been for the last one hundred years is NOT what they want to do. There is a shortage of young farmers. Because the eighteen-year-olds are realizing that they really don't want to work that hard.

(When I was 12, I started hiding my hours from mom--she would get upset when she found out I went over 60. My average was over 70.)

Tinfoil-hat search engine DuckDuckGo gifts more options, dark theme and other toys for the 0.43%

I am the 0.43%!

I cannot believe it's taking me this long to say this.

US soldier cleared of taking armoured vehicle out for joyride – because he's insane, court says

Re: How things have changed

British, certainly, then. Not American. ;)

Google screwed rivals to protect monopoly, says Uncle Sam in antitrust lawsuit: We go inside the Sherman parked on a Silicon Valley lawn

Re: Well, the US was Borked (literally) quite a while ago with anti-trust

"Hidden" pricing is the price that you don't know you are paying. If I go into a store, and don't participate in their "loyalty" program, then the price I pay is the price on the box. (Assuming they're not monetizing their "security" footage.) More than that is hidden.

Re: Well, the US was Borked (literally) quite a while ago with anti-trust

Hidden pricing is not the same as underpricing. And actual violation of consumer rights does not occur until the screws are turned.

That's what the "in restraint of trade" part of the act is about.

Google hides the price of their services, and as such is being deceptive in the marketplace. This deception is (IMHO & IANAL) part of their violation of the act.

Complexity has broken computer security, says academic who helped spot Meltdown and Spectre flaws

Re: So tiresome

We're talking about an individual deer trying to keep his business from collapsing. He does not care if small business continues to survive as an industry. He wants to be able to feed his own personal family on the basis of his own personal business not being burned to the ground by a hacking attack.

So tiresome

Hearing people yammering about using biological systems as a model for computer security.

Evolution does a reasonable job in developing DNA which is successful in perpetuating itself. But if you look at the larger picture, most species average less than one in two producing offspring. One in a hundred is not unusual. I would call that a bad model for security.

But it gets worse. Much, much worse.

Take the deer. With excellent hearing, speed, and eyesight, they represent a significant difficulty for predators. Humans work in teams to exhaust them.

Or, you know, to develop weapons. Spears, bows, guns, .... rifles. Which we can produce by the millions.

Random processes do a lousy job when faced with custom-designed countermeasures. Just don't.

Chinese database details 2.4 million influential people, their kids, addresses, and how to press their buttons

Re: How many does that database say read El-reg ?

And Pooh Bear's friend AC rides to the rescue!

Palo Alto Networks threatens to sue security startup for comparison review, says it breaks software EULA

Re: Off to look at Orca

Whoosh!

Re: Fair comment?

You you believe that a court which enforces an NDA is violating the constitution?

Uh ... no.

Re: Fair comment?

The object of the US constitution is its government. Therefore, it addresses the government.

A cautionary tale of virtual floppies and all too real credentials

Re: I've mentioned it before...

I got downright paranoid about the use of BEGIN TRANSACTION ; SELECT * INTO table_backup ... when my job was to fix data in the production database.

One day I had a conversation with my sysadmin along the following lines:

"If you did not have to get involved, it did not happen, correct?"

"Yep, that's right."

Could have had it more than once...

Thought the FBI were the only ones able to unlock encrypted phones? Pretty much every US cop can get the job done

You might be, but the 2nd amendment was created by a bunch of folks who had just finished a successful revolution, and wanted to be able to do another if necessary.

The 2nd Amendment applies to arms you can "bear". That doesn't include cannons, although private cannons WERE a thing at the time.

I heard that the Florida chapter of the ACLU studied the issue in the '90s and came to the conclusion that it DID cover nuke ownership by the states. Which goes along with the idea that it is not an individual right.

<shakes head>

But...didn't the UK outlaw private gun ownership? How is it that you have any gun deaths AT ALL?

Guns are tools. The problem is with the user, not the instrument.

You say too many, I say not enough. I mean, going to a public forum and looking around sounds like actual police work.

Bitcoin value jumps as PayPal says it will accept cryptocurrencies... once it has the kinks worked out

Re: My enemy's enemy....

Because "many" does not include the incumbents in the rival space?

Love Minecraft: Java? You'll have to learn to love your Microsoft account as well – it will be required next year

Still loving 1.7.10

I wonder if they've got hooks that will mess with that? If not, there is always etc/hosts. I'm not really into networked gaming.

Samsung to introduce automatic call blocking on Android 11-capable flagships

Re: How does it work?

" if Hiya ever sells their DB to spammers... :-/"

Anything is possible, of course, but I worked at WhitePages.com, and Alex (the founder of both and current CEO of Hiya) is set on being one of the good guys.

LibreOffice rains on OpenOffice's 20th anniversary parade, tells rival project to 'do the right thing' and die

Re: Who was it?

Agreed--mostly. But again, the devs are not forked--they must be convinced, often one-by-one to jump ship. Even then, success is not guaranteed, and the prior success works against the new effort.

Re: Who was it?

Yeah, 2/3 ain't bad. My point is that this letter demonstrates that even one of the most successful stories for project forking is still substantially hampered in its success. As part of a larger conversation about why "just fork the project" is, in general, a useless retort.

Who was it?

That told me a couple of weeks ago that one can always fork an OS project if necessary? And that the OO/LO fork was a demonstration of this?

No. You. Can't.

You can fork the _code_. You cannot fork the developers, the user base, and most certainly not the brand awareness. Actual successful cutovers are quite rare.

US Supreme Court Justice flames lower courts for giving 'sweeping immunity' to Facebook, YouTube, etc when it comes to harmful content

Re: The new cold war

<sigh> We now know that then-president Obama approved of the Clinton-Kremlin developed dossier and you still push this line. Putin doesn't give a **** about who is president. He's playing a long game to limit America's ability to act internationally by undermining the confidence that the population has in the government.

YES, the troll farms supported Trump. NO, they had little direct effect on the election. They have had a significant effect to undermine the perception of the legitimacy of his victory, and THAT was the the goal. Likewise the infamous dossier. Had Clinton won, it would have similarly tainted the victory.

The Russians do not merely play chess. They also study Sun Tzu.

China is more about directly affecting policy. Trade regulations, isolating Taiwan, etc.

Re: "that may need to be addressed in legislation"

Would you allow the publication of the Federalist Papers via these platforms?

Remember when Zoom was rumbled for lousy crypto? Six months later it says end-to-end is ready

Re: AGILE means "let the users test for you"

That really depends on how competent you in-house testing is.

Still, it makes sense to make something like this opt-in in version x.y.z if the intent is to make it default in x.y+1. It's important not to break everyone, and if you implicitly admit that you might have made a mistake by making it easy to avoid a bug, that's generally a good thing. What I don't see here is a statement that this is going to become default.

Cross-border digital payment system, championed by Saudi Arabia, gets green light... and yellow card from G7

It's not really control

"We're not here to judge, we just want the money."

Any question as to whether or not the banking system is a huge scam, was irretrievably decided "yes" in the 2008 collapse. Trillions of $ "lost" only to be looted back from the $ via the magic of fiat currencies. No one went to jail. No one fined. Heck, it's not clear to me that there were even any serious criminal investigations. Meanwhile, people who had to slightest difficulty making their mortgage payments were foreclosed on. In the US, the foreclosers often did not even have valid paperwork to do so.

Cryptocurrencies threaten to put an end to that game. If you think that the US goes to war over oil, you've not seen anything yet compared to what will happen if the control of money by the central banks is seriously threatened.

Which is why I generally have stayed far away from crypto coins. Even if, history 100% to the contrary, a coin were set up that had all of the "right" features, was implemented by actual adults who have a clue about software & hardware engineering, and was somehow picked up by enough people that the problems of thin markets meant that daily, weekly, monthly, and annual fluctuations were no worse than fiat--that is exactly the point that the national governments move to destroy it.

How much of their "citizens'" money are they willing to spend to keep control? How much did they spend in 2008-2009? That's the floor. We know that they spent that much then. They will certainly do it again. They can buy enough compute power to become a majority of the miners. They can drive the compute cost to mine a coin up--and then turn off all of their miners. They can flood the system with so many transactions that recording takes days. They can custom design malware to attack miners and or the networks of the large mining groups.

Nevermind the things that nation states do when they get serious about having their way. Physical attacks, wetwork, passing laws....

Supermassive black hole turns unlucky star into spaghetti

Re: yes or no ?

The question is whether the object spaghettifies before or after it crosses the event horizon. Smaller, denser, objects spaghettiffy later than larger, less dense ones. For a large enough black hole, planets will cross the event horizon intact.

Five Eyes nations plus Japan, India call for Big Tech to bake backdoors into everything

Re: Who decides who is trustworthy?

And you think that Eric Holder & Janet Reno were any better?

The US DOJ has been pushing this garbage in every administration since the original Clipper initiative under Clinton.

Make this a partisan issue, and you are guaranteed to lose at some point. Security is way too big of an issue for that.

Singapore to treat infosec as equivalent public good to fresh running water

Re: Singapore InterNet - Hardly Unfettered and Definitely Not 'Free'

How much do you know about the drinking water in, say, the US? The NEWater process claims to use reverse osmosis and radiation. The output of THAT goes into their usual water purification process.

If this is done competently, this is going to be really high quality water.

Insurance firm Ardonagh Group disabled 200 admin accounts as ransomware infection took hold

Until we have an after-action report, we really cannot say if their security was proper or not.

If you believe your **** doesn't stink, allow me to assure you it does. Build systems so that single failures don't result in total compromise. Design your systems to permit tracking of intrusions.

Because no fortress stands forever.

Meet the new aviation insecurity, same as the old aviation insecurity: Next-gen ACAS X just as vulnerable to spoofing as its predecessor

Re: real weaknesses of ACAS

There is a huge difference between humans messing up and humans attacking a system. The fact that no attacks have been detected so far means NOTHING about the seriousness of a vulnerability to humans attacking.

See also: anything AI related.

Too many staff have privileged work accounts for no good reason, reckon IT bods

The threat is NOT from the employee, but from whomever is controlling the interactions between the employee's computer and the rest of your network.

In a world of company-issued laptops that we are encouraged to take home, that's the real threat.

Try reworking the balance of costs with that in mind.

Feds warn foreign disinformation will be spamming US voters well after the November election to sow discord and doubt

Hmmm....

"People are urged to check their facts carefully with multiple trusted sources – top tier news organizations and outlets, primarily – and on official government websites."

So, from January through March, the CDC's official position was that mask-wearing by the general public would do no good. On April 2nd, that changed. So which "official government websites" are to be trusted, and when?

Do I even need to start on the blatant bias that comes from "top tier news organizations" on a daily basis?

The Bab 5 episode "The Illusion of Truth" should be required viewing in every class on government.

"The truth is a three-edged sword." Yes, that's from a different episode.

Spain's highway agency is monitoring speeding hotspots using bulk phone location data

Re: Railway Lines?

When I worked for Google, I made regular use of the maps & waze apps on the phone they issued me. (I don't own a "smart" phone.) These apps easily distinguished northbound from southbound lanes, and almost always access lanes from main lanes.

If Spain has a comparable cell network, this won't be an issue.

Big US election coming up, security is vital and, oh look... a federal agency just got completely pwned for real

Re: Passwords in Email

What they found was a 0. It's worthwhile to read to the end of the paragraph before commenting.

Won't duke, duke, duke the URLs: AWS backtracks on plans to block old-style S3 paths

Re: Cool URIs don't change

"What, design a URI? I have to design URIs? Yes, you have to think about it."

I'm so terribly embarrassed. Actually, this article hints at the failure of REST interfaces--they bind you to a particular tree-view of data which is not at all canonically represented by any particular tree.