Posts by JohnFen

EU wants one phone plug to rule them all. But we've got a better idea.

It has?

"Since then, MicroUSB has been superseded by USB Type-C"

And yet, I still don't own a single device that has a USB-C port.

Distro inferno: Debian's still rocking at 25

Fond of Debian

A couple of decades back, when I switched to Linux, I tried out a number of distros before I found two that worked well for me -- Slackware and Debian. Debian has been good to me (Slackware, too!) Over the years since, I sorta fell away from Slackware as Debian did everything I needed.

Long live Debian!

Although, I have to admit, the introduction of systemd has me seriously considering moving back to Slackware. It remains possible to have a systemd-free Debian, but it's pretty clear that this won't remain true forever without having to rebuild stuff, and as long as I have to do my own building, I may as well go with the Slack.

Google risks mega-fine in EU over location 'stalking'

Re: "It's been quite clear for some time that funding development"

"Advertising is the only reason why Android exists"

Let's be accurate here. The Android was not invented to be an advertising tool. That's just what Google turned it into when they bought it.

Good

Here's hoping that Google takes a big hit for engaging in this deceptive nonsense.

Google bod wants cookies to crumble and be remade into something more secure

Re: Beware those bearing Gifts esp Banksters & Techsters

I understand what you're saying -- my real name is very, very common and so there are numerous people on the internet who are not me, but who have my name.

I don't think that counts as "my name is on the internet", though. Having a bunch of other people using the same name as me just gives me plausible deniability.

Re: Beware those bearing Gifts esp Banksters & Techsters

If your real name is all over the internet, that's because you put it there. Mine isn't, and a couple of my pseudonyms are plausibly real names, so sites that have a "real name" policy can't tell it's a pseudonym.

Re: EU Antitrust people will love this

No. The idea is that the "new cookies" will only be readable by the exact connection that created them. Google won't be able to read the ones created by others, and others won't be able to read the ones created by Google.

This is actually a bit of a problem, as it also means that the data stored by "machine1.example.com" can't be read by "machine2.example.com" or even "example.com".

Re: Riiiight....

In his twitter feed, he already acknowledges that other parts of Google are not very keen on this idea.

Re: Zero understanding of cookies

After reading the Github piece, it seems that this misunderstanding comes from the El Reg author. It's sortof understandable, as Mike West's essay is intended for people who know this stuff and doesn't make it crystal clear exactly what he's talking about when referring to servers storing cookies.

Makes no sense

"would create a new default where user tracking has security and privacy built in"

Unless the "new default" includes a means by which you can prevent these identifiers from being created for you, this is impossible. You can't have security & privacy and still have user tracking unless that tracking is opt-in.

EDIT: I commented before I read the Github piece, and he's including the ability for users to delete these things. Let's hope, though, that this functionality is opt-in and not opt-out.

Visual Studio gains some go-faster stripes for Android emulation

Intellisense

"Not that a Real ProgrammerTM would admit to depending on Intellisense (your humble hack, however, would be quite lost without it)"

While I don't think less of programmers who depend on it (depending on the level of dependency, as it were), I have to admit that Intellisense drives me absolutely batty. It takes up a lot of CPU (occasionally bringing the entire IDE to a stop while it does its analysis thing) and the utility it provides is only rarely very useful to me.

Australia's Snooper's Charter: Experts react, and it ain't pretty

Re: Two options

"But that could mean something that's exploited & risky."

I think you misspelled "would" there.

The US has experienced exactly this

"“Are we going to see software moving overseas?” he asked."

In the Bad Old Days in the US, when you weren't allowed to export strong crypto, this was precisely the effect: almost no serious crypto development took place in the US, and as a result the bulk of crypto talent and advancement in the technology was no longer in the US.

Instead of the intended result (keep strong crypto out of the hands of whoever we considered "enemies" at the time), the actual result was the exact opposite.

You: 'Alexa, open Cortana.' Alexa: 'Who?'

Re: Magnum, P.I.

I'd watch the hell out of that!

This is an honest question, not snark: what do you find interesting about it?

Heh, yes, I agree. Using the word "experience" is a big red flag that we've entered the world of marketing wank.

Reduced usefulness

Microsoft says: "it makes sense that people would rely on two digital assistants to stay on top of their home and work lives — but also want the two of them to work together at times."

How does that make sense? I thought the only real selling point for one of these spy systems was that it is a "one stop shop" for things you want to do. Now it's a "two or more stop shop"? What's the point of that?

If you drop a tablet in a forest of smartphones, will anyone hear it fall?

Re: O/S?

"And now, Android P is here."

In this case, I'd consider not getting OS updates a good thing, as I actively don't want a slice of Pie.

Re: They sold at least three

Yeah, from my point of view they're specialty devices that only really shine for specific sorts of uses. I have one that is solely used for YouTube viewing. The three I bought this year are used as dedicated control panels for a hobby project.

Re: big screen landfill

"If you actually need a screen as big as a tablet then you need a decent keyboard."

This is certainly not true at all.

Re: Niche item

"99% mobile sites suck monkey balls and don't have the functionality of a full website, so what's the point of using a tablet?"

Just because you're using a tablet (or even a smartphone) doesn't mean you have to use the mobile sites. I make sure to get the desktop version of sites on all my mobile devices. Now, if I could only find a way to spoof those damned "responsive" sites so they don't try to adjust to my screen size.

They sold at least three

"Do they even exist?"

I've bought three tablets this year, so I know that the sales figures are at least 3 units large.

Here's a fab idea: Get crypto libs to warn devs when they screw up

Re: OK. Own up. How many coders...

Personally, I think that using code you find on Stack Overflow (and similar sites) should be a straight-up firing offense.

Using Stack Overflow to deepen your understanding of how to do something? Great!

Just copy-pasting "solutions" you find there? That's abandoning your duty as a software engineer.

Re: OK. Own up. How many coders...

Like all programmers, I've developed my share of bad habits -- but I can honestly say that isn't one of them.

Foreshadow and Intel SGX software attestation: 'The whole trust model collapses'

I agree. That's why this "trusted platform" stuff is deeply problematic.

However, here's a better example that is relevant to end user security: malicious software. With this trust model, it (theoretically) becomes impossible for malicious software to modify legitimate software to perform bad acts.

Samsung Galaxy Watch: A tough and classy activity tracker

Re: Let me save you 40-50%

"Also mentioned is inaccurate heart rate monitoring"

To be fair, all of these "fitness" wearables have inaccurate heart monitoring to go along with their inaccurate step counting, and etc.

Australia on the cusp of showing the world how to break encryption

Re: Stupidity or Conspiracy?

That's a distinction without a difference. In the end, the resulting behavior is the same, so I don't care which it is.

Re: Access

"A lot of cloud storage works this way"

Which is why anybody who is storing data in the cloud that they don't encrypt themselves first are being foolish.

Hello darkness my old friend, what happened last week in Redmond?

Skype, in my sphere, died the moment that it ceased to allow point-to-point communications.

That's so cute

" it certainly wasn’t by number of downloads, but rather in terms of ranking."

It's so cute that they seem to think those rankings actually mean anything.

"Developers, who may have been reluctant to move to the Azure App Service, can wrap up their apps in containers and take advantage of the inherent isolation boundaries to do all sorts of naughty things that the Azure App Service might otherwise frown on"

If developers aren't interested in Azure, then why in the world would they want to wrap their apps up? This seems like the sort of thing more likely to be used by developers who are already interested in Azure, but can't afford the time or expense of actually modifying their applications.

When's a backdoor not a backdoor? When the Oz government says it isn't

Re: The Holy Trinity

"If these agencies are denied the means to get evidence from communication channels then there is no chance of them carrying out their legal responsibilities"

This is simply and plainly incorrect.

To their credit

They've found a solution that gives them everything they desire while still being able to claim that they aren't mandating backdoors.

It's called "lying".

UK cyber cops: Infosec pros could help us divert teens from 'dark side'

A good start

"Our primary audience is 13 to 19 years old as the average age of arrest for cybercrime is 17 (one in four teenagers have committed some form of cybercrime)."

A good start would be to stop calling it "cybercrime". That "cyber-"prefix only gets you laughed at.

Also, does the UK define such crime differently than the US? I would guess that about 9 in 10 US teens have committed some form of it, but only because US law defines it far too broadly.

Samsung Galaxy Note 9: A steep price to pay

Re: Bezels

"Because you get more screen."

But you don't, really. You get a slightly smaller case.

"What's your problem with phones without a bezel that "made you wish you had them"?"

I have two problems. First, it's harder to pick the phone up off a table without touching something. Second, while I'm holding the phone, my hand can obscure parts of the screen I want to see.

Re: "Pricey? I would say so..."

You'd have to sign a contract with T-Mobile for that, I assume? If so, it's not for me. I'll never sign a contract with any cell carrier ever again.

Re: The one thing I wholeheartedly agree with Jobs on ...

I always sign those things (and other electronic stuff with a signature, like paying at a retail location that uses Square), just by writing a single horizontal line. There's no need to actually sign those things. Nobody looks at the signatures anyway.

Re: The one thing I wholeheartedly agree with Jobs on ...

That depends on what you want to do. In meetings, I take notes on my smartphone. It doesn't need a stylus for normal operation, but it would be horrible to use it (or any device) for note-taking without a stylus.

Bezels

"now feels weird because of its massive, archaic clunky bezels."

I don't understand this weird hatred of bezels. They provide utility that I appreciate (but didn't really notice until I used a device without bezels for a couple of weeks and found myself wishing it had them). They don't strike me as being archaic or clunky at all.

So... what's wrong with bezels? Why do some people want to see them gone? I am genuinely curious.

Criminal justice software code could send you to jail and there’s nothing you can do about it

Re: Open justice should mean open decisions

I agree, but I don't think you need to use the term "open justice". Unqualified "justice" suffices.

You won't believe this but... everyone hates their cable company: Bombshell study lands

Re: What is 'Rent-Seeking'?

That sounds like the behavior of the major cable companies to me.

Google Spectre whizz kicked out of Caesars, blocked from DEF CON over hack 'attack' tweet

"Cracking jokes about attacking their facilities will get you arrested"

Which is also 100% unacceptable.

If that's how Vegas hotels are handling this

If that's how Vegas hotels are handling this, I guess I've already made my last trip to Vegas.

Kaspersky VPN blabbed domain names of visited websites – and gave me a $0 reward, says chap

Re: sell it to the black hats and ...

This. A million times this. "Security" is not something you can achieve just by installing a piece of software or hardware, no matter what vendors claim.

This is an ongoing problem

"Unfortunately for Mishra, this data is defined as user passwords, payment information, and authentication tokens – and not IP addresses and domain-name lookups."

Yes, this is the same problem we run into when companies start talking about "personally identifiable information" generally -- the definition of PII used by pretty much every company in existence, and the definition I have are two very different things.

In my view, PII is any information that can be used to identify you. However, companies define it as a piece of information that is listed in their pre-ordained list of specific data items, all of which omit lots of information that can be personally identifying.

This is why I simply ignore any claims made about protecting "PII", since we don't even agree on our definitions.

Clap, damn you, clap! Samsung's Bixby 2.0 AI reveal is met with apathy

Re: Who's this "us" you're talking about?

I'm always amused by the counterargument that "the average consumer does not care" about some issue (even when I myself made that argument in another comment in this story!). First, that's often not clear. But, more importantly, so what? When people are expressing their own personal likes, dislikes, and desires, whether or not they are in line with what "the average consumer" cares about is irrelevant.

Re: Samsung would get a standing ovation

"Yes, our phone has no extra features, Google is optional and ... it even has a removable battery.."

Being able to dispense with Google and having a removable battery certainly count as extra features these days.

Re: "Because speaking a trivial command out loud is still too intrusive"

Not to mention that voice is a terribly inefficient way to do that sort of thing. It's really only better than typing for trivial sorts of operations.

"installing LineageOS will replace your great quality phone camera (assuming one of the recent flagships) with a very average quality camera."

That only matters if you care. I'm willing to bet that a majority of people don't.

America's top maker of cop body cameras says facial-recog AI isn't safe

Re: For what purpose?

"There's a world of difference between making a serious decision and flagging something for human attention."

If that human attention involves detention (even for a brief time for questioning) or worse, then it's a serious decision.

Re: Axon, formerly known as Taser

"Actual taser use is to impose (extreme) pain compliance, either from a "safe" distance, or to impose some extrajudicial light torture up close."

Yes, that's the primary problem with Tasers. They're used as means of torture.

Funny, though, that when their use was being sold to the public, that wasn't their selling point. They were offered as a safer alternative to guns.