Posts by Claptrap314

You weren't hacked because you lacked space-age network defenses. Nor because cyber-gurus picked on you. It's far simpler than that

Re: Too hard, too frequent, too unreliable

Yeah, the SRE-educated burst into laughter at that point. They might have been SOLD five nines, but clearly only two were delivered.

This is node joke. Tor battles to fend off swarm of Bitcoin-stealing evil exit relays making up about 25% of outgoing capacity at its height

Too stupid to care?

I'm seriously having a problem understanding that this is real. In order for this attack to succeed, we need someone who

1) Uses bitcoin.

2) Uses Tor.

3) Uses a bitcoin mixer service.

4) Does NOT use https to access the bitcoin mixer service via Tor.

Isn't that like just one guy? What am I missing?

Also, if you're already using Tor, why on earth would you suddenly care about speed over blind trust in the exit node for that final hop?

India awards apps that offer citizens Microsoft and Google alternatives

Overdue, really

I've not been tracking it closely, but China-India relations have been complex at best for several decades. In particular, China's oft-stated desire to end "unipolar world" is shown to be a farce where India is concerned. They want to be the sole dominate power. Which is pretty well true of any power, really.

The idea of any power being truly independent is a farce if it depends on another power for anything necessary to defend itself in war. You may believe that such concerns are atavistic, but China's relationships with its neighbors belies that idea.

The recent escalation of hostilities on the China-India border is what seems most relevant to me, from a timing standpoint.

Pen Test Partners: Boeing 747s receive critical software updates over 3.5" floppy disks

Read-Write?

For me, the issue with floppies that you have to maintain strict physical custody in order to ensure that the data on the disk has not be compromised. I would want some sort of WORM medium.

CSI GitHub: That big outage last month? It's always DNS. Or it was Kubernetes. Maybe it was a heady blend of both

Re: Someone please explain to me

What does the IP version have to do with it? You have a map from services to ip address & port number. How do we gain by making our services to hunt for this information?

I'm really trying to understand this. DNS was created to allow coordination in the absence of organizational discipline. It's what allows the intranets to connect to make the Internet. Why is it the correct solution when everything is in-house?

Someone please explain to me

Why DNS is the right solution when EVERY application on EVERY box in the system is under the control of the same organization.

USA decides to cleanse local networks of anything Chinese under new five-point national data security plan

Re: Too little, too late?

You really want to compare the US and China on human rights. Okay... How many are at Gitmo? How many are in Xinjang? How does one end up in Gitmo? How does one avoid the abuses in Xinjang? Does the US assign your wife a husband if you go to Gitmo? Do we perform live donor organ transplants?

I do not consider the US record on human rights to be that great--according to our ever-escalating standards. But the concept of individual rights does not even exist in China.

Too little, too late?

If someone says that you are their enemy, believe them.

The Chinese have been pushing an aggressive anti-American rhetoric for decades. I was alarmed by what they were saying in the late 80s. Given that the Chinese lack the concept of human rights as we have it in the West, their party congresses have often stated that it is the duty of every citizen to aid in the "struggle". Every citizen.

But supply line vulnerability is near-total. The size of the blobs in firmware make it intractable to figure out everything that is happening at a low level

None of the above suggests that the US government is not aggressively engaging in its own espionage. It has been since president Wilson left office, at least. As it must. Which is completely irrelevant to the decisions it should make regarding the behaviors of the Chinese government.

Mozilla warns more Firefox website breakage to come because devs just aren't checking for SameSite snafus

Re: Its the old

Yeah--because English-Irish relations have been SO wonderful since forever. And English-Scott. And English-Frog<bs><bs>ench.

Give it a rest. People get along better with people who are like them. The idea that we should make the effort to get along with people NOT like us is a fine one. You should try it.

America was getting on top of its electronic voting machine security – then suddenly... A wild pandemic appears

Is this the same post office

that misplaced a warehouse full of mail (including invitations to the Clinton inaugural ball) for three years or so?

Yep, that mail is super-secure.

Ever wonder how a pentest turns into felony charges? Coalfire duo explain Iowa courthouse arrest debacle

Yeah, that part of the article is super-sketchy.

If you are applying for a security clearance, these things matter. Otherwise, the "not guilty" covers a lot of ground. Their defense attorney should press to get the record expunged.

Re: legislation??

One of the basic rules of security is that you don't relying on just one thing doing its job.

That sheriff needs tarring & feathering. But the way the law is, he's untouchable. Changing the law would help with that.

Re: Authority to hire services

Except that in every state with which I am familiar, counties are units of the state government. Counties have no sovereignty with respect to the states.

NSA warns that mobile device location services constantly compromise snoops and soldiers

Re: Talyrand: they forgot nothing and learned nothing!

And have that SIM delivered where?

The NSA has two missions. They were kinda skipping on the second one for a couple of decades, but the congressional wrap on the knuckles has adjusted things a bit.

Their second mission is to protect "our" communications and data. With the "our" being Americans', not just the government's. This is why, for instance, that the NSA is on record as opposing back door encryption.

I'm just getting started!

Wrap it before you tap it? No, say Linux developers: 'GPL condom' for Nvidia driver is laughed out of the kernel

Re: NVidia has the money and manpower

I'm pretty sure that's the point of the original comment.

NVIDIA wants to sell product into the Linux environment. Great! We'ld love to have you join in! What? You don't want to join in?

Anyone selling to the Linux market is making use of the labors of the kernel devs, the distribution maintainers, and everyone who is going to the effort of maintaining a Linux box. There is a price to be paid for the use of these efforts. Pay it, or stay away.

Infosec bod: I've found zero-day flaws in Tor's bridge relay defenses. Tor Project: Only the zero part is right

Re: The problems continue

So why did Phil Zimmerman manage to get all of that attention back in the day?

You REALLY don't understand the nature of the problem. SPECTRE-class bugs are demonstrably unfixable in current hardware. TOR is not attempting something impossible.

Re: The problems continue

There has only been one superpower since Napoleon--and it is very debatable if Napoleonic France qualified. Whether the US still qualifies as a superpower is debatable, but no other power has had the freedom of action that the had US after the defeat of the USSR.

Fun fact: If you noticed a while ago Zoom's web client going AWOL for a week, it's because someone found a passcode-cracking hole

Get the very basics down

These guys look like they took lessons from Microsoft regarding security...

Burn baby burn, plastic inferno! Infosec researchers turn 3D printers into self-immolating suicide machines

Yeah, but...

"McInerney suggested that manufacturers should look at signing their firmware." Also, that they not have their customers playing in the middle of the highway.

Face masks hamper the spread of coronavirus. Know what else they hamper? Facial-recognition systems (except China's)

Re: Plague outfit

The law of "I don't like it, and I can arrest you."

It's a Meow-nixed system, I know this: Purr-fect storm of 3,000+ insecure databases – and a data-wiping bot

Kinda like when Google broke the internet

Just how long has it been since AWS secured these things by default?

I'm having a really, really hard time viewing this action as net criminal.

Just what you want when stuck working from home: Microsoft domain mixup downs Remote Web Access

And the US government is awarding these guys the JEDI contract

Must be some sort of mind trick.

What evil lurks within the data centre, and why is it DDoS-ing the ever-loving pants off us?

What was that DDOS protection doing again?

Seriously, would it not have been simpler and faster to contact them and say, "We've got a thundering heard. We need you to block 99% of the traffic with this user agent.

And let the fix change the user agent stream. When the herd thins enough, you can drop the block percentage.

Of course now, with SRE, the rollout is paused by the system at the 15% level because of the increased network traffic driving up system load.

Raytheon techie who took home radar secrets gets 18 months in the clink in surprise time fraud probe twist

He was unauthorized WFH. That looks like time fraud. The fact that he was working on classified material *might* have something to do with why WFH was not authorized...

We've heard of littering but this is ridiculous: Asteroid dumps up to 50 quadrillion kg of space dirt on Earth, Moon

Re: A Recent Heavy Bombardment?

I would be shocked if there is ANY evidence cite which rules out Oort cloud activity in favor of an asteroid. "At the same time" in this context almost certainly means "+/= 10-20MY". Whether it was a single event, or an orbital alignment that caused numerous events over this period has got to be entirely speculative.

Don't strain yourself, Zuck, only democracy at stake... Facebook makes half-hearted effort to flag election lies by President Trump

Quis custodiet ipsos custodes?

If you don't get the reference, pull your head out & read a bit about the history of Western Civilization and the fitful and uncertain development of government that is, in some meaningful fashion, tied to consent of the governed.

What is being called for in this article is the full-on abrogation of the right to compete in the market of ideas by those _currently_ unacceptable to the author.

Don't assume you won't be next.

Re: Why no Internet voting?

No. It is #0. Internet voting permits massive vote manipulation from the no-extraditing regime of your choice. We have NEVER faced a comparable threat.

Networking boffins detect wide abuse of IPv4 addresses bought on secondary market

Re: Interesting market effects

I think you may have misunderstood. It appears to me that he is saying that a dual stack network is more of a pain to support than a v6 with 4-to-6 translation at the edge(s). Therefore, _once_ a network decides to go v6, he expects it to go v6 instead of dual stack.

I could be wildly wrong, but I expect most SMBs to stay v4 for a long time. I can see no reason for hw to drop v4--so what is the need to change over? The sw tools are all in place to support v4 with 6to4 at the edge, and they too are not going to go away.

When setup of fresh v6 networks is as simple as v4 networks, expect new networks to start being v6. Especially as the new kids come in without v4 experience.

Black hole destroys corona

I'm pretty certain that almost all of us lack the education to understand what he was talking about.

The event horizon of a black hole is the surface described by points at which the escape velocity equals the speed of light.

Lots and LOTS of people have trouble understanding what this implies. A photon created at the event horizon and aimed directly away from the center would (in a perfectly symmetric world & absent other interactions) never return. But if it were angled 179 degrees from the center, it would behave like a cannonball.

Whats more, a photon formed a short distance inside the event horizon, and angled 179.9 degrees away from center, might only deflect to being 179 degrees from center as it passes the event horizon.

In the frame of reference of an object falling into a black hole, there current escape velocity is a mere curiosity. What matters is things like the difference in the gravitational pull experienced by one part of the object relative to another. As mentioned, for supermassive black holes, this is negligible at the event horizon.

GitHub is just like all of us: The week has just started but it needed 4 whole hours of downtime

Re: Get your ******* act together

If you're big enough to be running your own servers at all, the build system should be about the first thing that you bring in-house. If not, I would SERIOUSLY look into enterprise GitHub on AWS or GCP.

Rust code in Linux kernel looks more likely as language team lead promises support

Re: Is there a reason we need YAPL?

Compilers & even assemblers have been telling us about errors since the first one were created.

Re: Is there a reason we need YAPL?

Try reading your own example.

Re: Is there a reason we need YAPL?

Sentiments like this justifying sloppy behavior on the part of the programmer are a major source of tire fire our industry has become.

I can hardly write five lines of code without some sort of bug. But guess what? I write 0 lines of production code without tests. What's more, I have the training to know when my tests are inadequate.

When I was at Google, the solution to memory leaks was often to grow the alloc. We had some small service that was running on 80G allocs (biggest available). I threw the flag, found the leak, fixed it. That service then ran on 10G or less.

Learn to find your own mistakes. Learn that the people who point out your mistakes are your best friend. Teach these lessons to others. And stop whining that your tools should stop you from playing the fool.

Re: Is there a reason we need YAPL?

1) It is NOT the same code. There are lots of ways to guarantee that a pointer is not null. Many of them don't involve a conditional branch.

2) Calling code "faster" because it is executed sooner is just weird. You get a (very) slight reduction in code size. Execution speed improvement is limited to improved cache utilization.

Report: CIA runs secret cyberwar with little oversight after Trump gave the OK, say US government officials

Re: Where it can be enforced

But the "D" part never happened. This was because of the tracability of any strike (which I forgot to mention) & the rationality of the actors.

The Doomsday Clock was & is a publicity stunt by leftists. Nothing more.

Where it can be enforced

The convention against the use of chemical weapons works because it is relatively easy to trace the physical components. Nuke treaties can (in theory) work because ICBMs are large enough to be traceable.

Bits? Not so much.

The real justification for this stuff is that if we don't continually improve our capabilities, the Chinese will get so far ahead of us that we will be wiped out in a minute. Okay if you want to live in Hong Kong these days, I guess. But for me? No.

I REALLY wish I had a good answer for this.

Re: No, probably just US Civil War #2

Unlike those Hillary supporters who just slept in late the next day and then mopped for a week or two, amIright?

FYI Russia is totally hacking the West's labs in search of COVID-19 vaccine files, say UK, US, Canada cyber-spies

You're making a HUGE assumption here. When the mob gets big enough, there is no private property. Even in the US.

Did you know that "personal need" is a defense against the crime of theft? Apply that to a vaccine during a pandemic, and you've got really strong ground. Of course, that's stupid, because you've just defunded the research for the next bat virus Pooh Bear's minions decide to grace us with.

But we're talking politics here.

Re: Why?

Thank-you president Wilson.

Twitter admits 130 A-lister accounts compromised to promote Bitcoin scam after 'social engineering' attack

Re: Not very ambitious?

My understanding is that the blatant insider trade at the start of the 2008 mortgage collapse was never traced. I don't know any more than that.

Ew, that's unsanitary: SEO plugin for WordPress would run arbitrary JavaScript inputs instead of scrubbing them

I must admit

To feeling rather conflicted this time... <sigh> It's Friday. I feel like crying --->

Privacy Shield binned after EU court rules transatlantic data protection arrangements 'inadequate'

Same song, second verse

o'tta get better....

So Safe Harbor was replaced by Privacy Shield.

Assuming that the three letters now in play suffice, I expect the replacement for Privacy Shield to be entitled "Half Privacy".

This is a charade played out by the EU government to placate its citizens while permitting the merry game of monetization of privacy to proceed full speed ahead. We're going to see a "really, truly better, I really, really mean it" fig leaf about three days before the deadline. Which will take two-three years to be ruled invalid.

Twitter says hack of key staff led to celebrity, politician, biz account hijack mega-spree

You might want to check that stereotype against the charitable donations listed in those oh-so-imporant tax returns.

Conservatives donate to charities. A. LOT. What we don't want is for the government to pretend that it should be doing, well, a whole bunch of things, including charity.

Pokémon Go players fined for breaking down-under COVID-19 lockdown rules

Re: Math + logic does not equal the hysteria

Care to re-run those numbers without the lockdowns?

If (and I do mean IF) the excess death rate is "noise", that mean's we've done it right.

Since you're so good with facts, I'll let you figure out why.

Cornwall councillor suggests authority paid £2m for Oracle licences that no one used on contract originally worth £4m

What does the party matter?

I'm about as from from an LD as you can get, but unless they've been making some huge to-do about how competent they are with managing IT contracts, that really, REALLY doesn't matter. Especially since almost certainly everything but final oversight was handled by careerists.

You're testing them wrong: Whiteboard coding interviews are 'anti-women psychological stress examinations'

That's stress?

I've had far, far too many interviews over the last 24 years. The majority have involved whiteboarding code.

If folks aren't great at thinking on their feet, then asking them to solve ANY problem on the spot is going to be an issue.

If the interviews are being nasty, then, sure--that's stress. But by far, for me, that's come from non-whiteboard situations.

If you're attacking people for syntax errors in whiteboarding, you're an ***.

If you're jumping on ANY mistake as soon as it hits the board, you're an ***.

These days, CoderPad and it's ilk have become more favored. That's acceptable 1-on-1, but you need some process to have it work for more.

And if you can BS your way through a technical interview, that's on the interviewer. I've had candidates try that. I've been polite.

Re: but this can't be true

According to the Commodore, that's because businessmen saw programmers as an expensive extension to the secretary pool, and hired accordingly.