Posts by bombastic bob 10944 publicly visible posts • joined 1 May 2015
i actually thought of a project management tool, like the old "Microsoft Project" which may or may not still exist. Shift to the left, get it done earlier. To the right, it's delayed. Something like that.
Managers like gantt charts, they can slide 'em around like those birthday party puzzles we played with as kids, and announce stuff in meetings (like new deadlines) based on their sliding things around.
I can think of a few examples where shipping something "with a vulnerability" might be just fine. Here's one that I think epitomizes what I mean:
Let's say you ship embedded devices with Raspberry Pi and RPi OS on them, running your software and a touch screen interface. This is pretty popular from my observation.
You don't allow ssh or listening network services (except by using a special maintenance feature from the UI that end-users normally do not know about) but since the device DOES need to phone home to a server on the network, it has access to one. And the user/password is well known (say the default RPi user/password). because the screen logs in automatically on boot. Is THIS insecure? Or, because there are no listening services (and no way to add them via the UI) it's "secure enough" ?
Then you think about whether the latest polkit zero-day is worth LOTS OF EFFORT to patch right now because oh-my-god-it-can-be-exploited, or whether it can wait for the next round of maintenance updates several months from now... because there are NO listening ports! And, you have thousnds of pre-imaged SD cards on order, and you're shipping right now, and you STILL have SD cards that have not yet been delivered (in the pipeline), and you JUST heard of this vulnerability LAST WEEK.
and because of the nature of the devices, you don't want them using automatic package updates and ending up with the kinds of problems you see when a windows system failed to boot after doing this sort of thing... and the screen displays the error instead of the user interface. And so on. [controlled updates with a USB or download or by replacing the SD are acceptable because they've been tested]
Anyway, that throws a wrench into the works ("shipping with a vulnerability"), but in the case I outline, the system config already mitigates the vulnerabilities you need to patch at some point. If you can't ssh in, and can only view a UI that consists of pages written by the manufacturer [no external links], and it's not listening to incoming network traffic, nearly every possible vulnerability has been "dealt with". And exploiting a zero day (like with polkit) would require physical access. Might as well take the SD card out and muck with it from a laptop.
(yeah I'm kinda working on something similar to this)
He simply does not realise care that being on good terms with the west would do his country a LOT of good.
fixed it for ya. He's dictator for life (like Xi) after all.
Good job for the RN at dealing with this in the smartest way possible.
/me imagines Putie doing a "Line of Death" like Gaddafi. That would be both sad AND laughable at the same time.
will we be able to run it in a VM?
VMWare appears to have TPM virtualization. VirtualBox does NOT, as far as I can tell.
In my search on this subject I have run across one or two TPM software solutions, particularly one on github.
I would expect VirtualBox to support this eventually, but it could end up being a PAYED ENHANCEMENT of some kind (and may not be supported on Linux, and PROBABLY NOT on FreeBSD). But we shall see. If the tech needs ilcensing, money will end up changing hands.
needless to say, if TPM 2 is required, and I can't run it in a virtualbox VM, I will NOT be testing it.
so they don't want anyone running it in a VM, then? At least, not with VirtualBox...
(as far as I can tell VBox does not support TPM emulation, though it appears that VMWare _DOES_)
I guess this means I will NOT be trying out their new OS. Not like I *really* wanted to, though... (the last time around was JUST! TOO! DISAPPOINTING!!!)
or think of the developers HAVING TO PAY A TOLL to get cert signing or DRM tagging or whatever OTHER "security" scheme Apple comes up with, if they can't simply use the store to filter out what they do not like and get "a piece of the action" at the same time...
Side-loading MUST become possible WITHOUT certs and DRM crap. Otherwise it will be POINTLESS with Apple as the only gatekeeper. This is most important for independent developers and FOSS.
(Saying that removing Apple's exclusive gatekeeping would somehow HARM developers is BACKWARDS)
"it was decided" a while back that the nicname should be "Micros~1", remember?
If you do not mind living in a 3rd world country where paying off politicians keeps you out of trouble, $1b each would probably go a VERY long way. Buy your own compound, or your own island, hire locals as guards in a paramilitary kind of way, private airstrip and aircraft, ship things in from all over the world, and so on.
Several nations in the equatorial and south pacific region come to mind, as do many Latin American countries. Even Cuba. And since they're from Africa, perhaps a few places on THAT continent wouldn't mind having them, either.
a dodgy character regardless of where your money really came from
A quicky online search shows that there are a number of Swiss bitcoin exchanges. I expect it would be possible to trade the $2b or so in (de-valued) bitcoin for something a bit more "depositable" in a Swiss bank account, and hide your money the same way that "a dodgy character" would have done it over the last century or so.
I'm not saying that Swiss authorities could not somehow trace that it was done, or where the perps were when they did it, but once it becomes hard cash and gets deposited in a bank in Switzerland, it may become extremely difficult to trace.
Similarly for Caiman Islands and other "hide your money" places around the world.
However, like many have already mentioned, crooks make mistakes and that's how they get caught.
Any global bounty hunters out there looking for a reward to catch them? I'm sure the investors wouldn't mind forking over a percentage to get the rest of their money back.
when you consider how dry cleaning machines and front-load washers work, it shouldn't be THAT hard to design a front-loading spinny washing machine with sufficient artificial gravity to wash clothes... and a hyper-efficient extraction process that wastes very little water [and dries at low temperatures].
I'd expect the gunk and lint would end up in a disposable filter of some kind, and anything stinky could be burnt off by passing it through high temperature heating elements in the presence of air. [in the submarine world, that is called a 'burner']
where's the X prize for this? [I need to enter]
Python tries to solve the "3rd party component" problem with pip and virtual python environments.
It does not always work, however... (my experience dealing with DJango a few years ago proves this)
[I had to mirror a broken DJango system onto multiple Linux platforms in order to fix it, and "bleeding edge" version of some things just outright failed on some systems, but worked on others. Go fig.]
Yeah, the education topic is pretty *HOT* right now, especially in one part of the state of Virginia. I'll avoid going beyond 'a mention' in this forum so as not to derail the thread.
Some of what you say may be true, but it would seem to me that companies will just build products to make money and as such they will go with a market that has a future in order to have growth potential, enough to keep them from going bankrupt along the way. The "Find a Need and Meet It" mentality drives most of the successful companies. There are still enough smart people to make the engineering happen, and even poorly educated employees can be trained by the companies themselves, if needed.
Bezos' company just needs their engine to outperform the Russian one, that's all. "Resolve the Contradictions" and they'll get there. They probably just don't have the decades' worth of experience to get it done quicker. But they will. Eventually.
30 years ago 'internationalization' was a big thing, other than for military and national security purposes. True it was short-sighted in light of the more recent behavior of those nations we were trying to normalize relations with, specifically Russia and China, but optimism about the future of the world was high, post Cold War.
Reality basically did not work out *quite* the way they saw things through their rose colored glasses.
In any case, getting U.S. companies to build engines better than the Russian ones just needs enough R&D time+money. And, are the Russian engine makers designing the next generation to remain competitive, or just sitting on what they've got and milking it for all it's worth?
a while ago I needed to submit something to an out of state court for a case I'm indirectly a party to. i tried to use e-mail to contact the appropriate person to send the info to [basically proof that I received the paperwork]. But the e-mail form had a captcha that simply would NOT work (even when run in the special context using chromium, like I usually resort to when such things are needed).
So I dug around some more on the court's web site, and found a FAX number, and I FAX'd it, by placing the item in question on the glassy copy/scan part of the fax/scan/copy/printer I bought a while back, and dialing the phone number. THAT worked. (it's why I keep that second land line).
yeah the ambiguous squares are the ones that get you a "try again" half the time, along with the faded/shadowy/grainy/too-tiny-too-see ones that might contain bicycles...
so it's "roll the dice" and hope the next one (after the 'try again') isn't one of those "slooowly fade out, slooowly fade in" types that *REALLY* irritate me...
(guess how I voted - see icon)
(re: commentard's name 'Admiral Grace Hopper')
I actually saw (the original) Grace Hopper when she was a Captain, at the Orlando RTC [she was in charge of the recruit training base as they trained the women there and it made sense]. Didn't say hello but may have saluted her (can't recall exactly).
Thinking of commentards, El Reg _could_ review some of the better ones and see if any of those tend towards meeting their selection criteria. No doubt there are zillions of examples. Or maybe they did already and none were deemed 'worthy' enough for a job offer in an e-mail
I would not consider that "exploitation" but rather 'participation'. FOSS development is usually voluntary, and I know I've volunteered here and there with various submissions, patches, etc.. [I think of it as 'giving back' or 'my license fee' for all of the FOSS stuff I use daily]. I'm sure that corporations also pay people to do the same thing for the same reasons, especially if they are staking some of their income on a particular project.
I think you may have an inaccurate perspective on the concepts of revenue, cost, profit, and loss. Perhaps a few years doing data analysis and reports for the accounting staff at a large company might help you get a better perspective (weekly internal financial reports, excess and obsolete inventory analyses, and ad-hoc cost reduction analyses, for example - how much DOES that engineering change cost and when is the best time to re-tool or switch out parts - that sort of thing).
IRL this really happened:
* kid has guinea pig as pet
* kid sees something in pet store that says 'cat' on it, wants a 'guinea pig' one, gets bratty about it
* I suggest taking the 'cat' one and crossing the word 'cat' out with a marker and writing 'guinea pig'
* kid stops being bratty, doesn't bring it up again
(everything I ever wanted to learn, I learned by watching 'Monty Python's Flying Circus')
I do not believe it has always been this way. The biggest problem most likely isn't CreateFile() itself, but the various 'Shell' versions of things that open files, or ".Not" itself. They like to get all "object-ie" and do a bunch of potentially unnecessary stuff up front, rather than as needed, and my observations concluded that this is PRIMARILY the source of file system and application startup slowness.
One of the worst offenders is the 'File Open' dialog box. Strangely, in Linux and BSD (when you use gnome or mate) it has similar problems, since the gnome and mate 'file open' seems to want to do previews, which suffers from the same *kinds* of performance issues. Granted, it's FASTER in the POSIX+X11 world, but it's EVEN FASTER if you fill the list with files FIRST, and then background query them when users need a preview (or any other details about that file), and NOT read EVERY! SINGLE! FILE! to discover its type BEFORE or WHILE filling a list of files in a directory. [that would be the 'anal-retentive-object-oriented' way to do it, where EVERYthing is ALWAYS 'an object' whether it makes sense or NOT]
So I'd say the SAME *kinds* of bad programming practices exist in Linux and BSD ports/packages, at least as far as the desktop environment is concerned. And this easily points out WHAT and WHY.
(now, where's my clue-bat, I need to 'educate' some junior-level programmers)
the OS doesn't need to be the window manager as well.
Nor does the built-in window manager need to be 2D FLATTY FLATASS FLATSO (with NO other choice available), instead of the 3D Skeuomorphic appearance that actually SOLD WINDOWS TO THE PUBLIC in the FIRST PLACE (remember 2.x vs 3.0?), simply because a handful of PFY "engineers" at Micros~1 (along with Sinofsky and the inventor of 'the ribbon') suddenly *FELT* it should... (and would NOT backtrack on the obvious mal-design, even though our W.I.M.P. desktops ARE STILL NOT PHONES).
Nor should it take away all of the capabilities that had actually SOLD the previous releases to the public (like end-user customization and built-in games and utilities that DO NOT THROW ADS AT OR SPY ON YOU). Arguably, these '7 and earlier' features sold new computers FASTER than the "more 'modern' OS" machines sitting NEXT to them on the shelves. (I recall MANY El Reg articles that pointed such things out, in the 2014-sh time range, THIS being one of them)
Nor should it sling ads, spy on you, require an on-line cloudy logon (to avoid the strong-arming or access any previously included options), FORCE you to update (or download updates) when you do not want it to, And so on.
From the article: Windows 10 is so much better than its antecedents that it has stopped being a problem.
No. It is SUPPORTED. "Better" would be Windows 7, XP, and 2000. But THEY are not SUPPORTED any more...
It reminds me of too many science fiction dystopias and they never turn out well
and one particular Dr. Who episode... (the yellow smiley button on your back isn't smiling, oops)
and when the building and everything in it (that isn't you) is a networked bunch of nanobots, they always know whether or not you are smiling...
No wonder developers have no passion for the Windows platform anymore.
I thought that '.Not' followed by C# (C-pound) and then "UWP" (and its predecessors) and all of the moving target "new shiny" things (that totally lost long term support) is wot dun that...
at least, for me.
(I just wanted to stick with C++, MFC, Win32, and the DevStudio 98 environment where things were becoming easy and familiar and I could pound out applications and libraries in no time at all...)
I liked VS98 better than the current incarnations - better keystroke navigation, no need to remove hand from keyboard and 'mouse' something if you knew the hot keys [especially important in the dialog editor]. Something like THAT in 64-bit would make me a LOT happier.
I think I'll get the preview anyway, and the full version when it's out. Maybe I can try installing under Wine...
Still, any level of GIT integration might make it useful, if for no other reason than installing for clients to view things with. And maybe I can check out how the extensions work, now. Haven't tried anything with that for over a decade.
eh, can't hurt to look, right?
some cost accountant needs to factor in the COST OF INCOMPETENT MICRO-MANAGEMENT ON OVERALL PERFORMANCE when upper management tries to determine what speed settings to use on the equipment.
That vs the cost of an industrial "accident" that prevents such micromanagement from being implemented... [boss, the window is over here - check out the view!]
they _are_ the wall.
and their users are just bricks in that wall. Unimportant, identical, mook-like bricks with no individuality and complete obedience. Just sitting there being monitized and holding up the big FB wall...
(I wonder if Zuck realizes the irony of that particular song in an ad related to one of his companies...)
smartphone users are idiots who need protecting from themselves
I wouldn't go THAT far. Even the average LUser can be educated.
All you need to do is make the default security as tight as possible, and allow people to turn things off if they don't want them. This MUST include both side-loading AND installing without code-signing, for TRUE freedom for the user.
This way open source and independent developers can more easily distribute their stuff (without paying the 'Apple Tax' or hiding your needle within their ginormous HAY STACK).
But if the end-user doesn't want that, he can just leave all of the security options ON. So simple.
(and if a system reset can wipe everything and restore the phone/slab to factory state from a ROM, so much the better, for dealing with viruses and malware, in case they show up more frequently)
Yeah, PERSONAL CHOICE. Who knew?
I would expect that generating the deepfake in a very high resolution, and then using a standard method of shrinking it down to something with less resolution (cubic interpolation, let's say), or using JPEG vs PNG even, might be just enough to fool the deep-fake spotter-bots.
I like use 'gimp' and a hand-done "fuzzy" technique around the borders of, let's say, a face, surrounded by transparency, that melds right into another photo when proper re-sizing and perspective is done (no pr0n though, just funny things).
in 'Little Nicky' (Adam Sandler) Nicky's brother pasted his face over Al Pacino in a clip from 'Scarface', and did it poorly. But often times it's funnier if poorly done, which is then obvious to everyone (including algorithms I hope).
this reminds me of a Dr. Who episode - in space, O2 is expensive, after all! (in that episode the suits literally took over)
Along with a zillion other things I'm not an expert on, I have kicked around a design concept for a one-size-fits-all space suit, mostly for emergencies. In short, a vinyl bubble [made of thick material similar to a waterbed] with an integral helmet and radio, pockets for important things like an O2 bottle with a regulator on it, a couple of hose connections (for the O2 bottle etc.), and a bunch of oversized SHOE STRINGS that you'd use to obtain a proper fit.
For working it may not be tough enough, but if you put something _like_ this on, then put some stronger clothing over it (like pants and a jacket, only SPACE pants+jacket) and gloves, it might be pretty effective, fit ANYONE, be relatively easy to put on, and maybe even cheap enough to be DISPOSABLE.
And you could put these in boxes at various places inside the people compartment, for emergency use, in case of sudden decompression.
(you'd have to strap on the extra A/C when working outside but that could be more like a backpack thrown on after everything else, connect up hoses, etc.)
yeah - I think in terms of doing it "on the cheap" yet being extremely effective and reliable. But it would look like you were wearing a balloon tied with shoelaces.
de-orbit of small things can be absorbed by the atmosphere as long as they don't have anything REALLY toxic or dangerous in them. The large amounts of things like Selenium and Cadmium in solar panels might cause some level of contamination depending on where the particles end up falling. Over the ocean, not so bad. Over a large body of water that supplies drinking water for people and water for farming, not so good.
And de-orbit of BIG things (Skylab, Mir) hasn't gone so well in the past...
(keeping the ISS alive and expanding may prove to be the better alternative, at least in MY bombastic opinion)
Just saying...
Like every OTHER framework (and language developed by Micros~1) before it, I'm sure Next.js will turn out to be
* bloated and inefficient (except when run on/by "the overlord" application/OS that will miraculously be able to run it well)
* attempts to be all to all and do all with all
* requires ridiculous hacks to actually USE it (in at least some cases)
* breaks those hacks at random with all-to-frequent updates
My opinion, of course.
and establishment enforcement of 'rules' can't POSSIBLY cover 100% of use cases. Which means something important WILL break. Or require ridiculous hacks. Eventually.
Something like ESLint (let's say) could become a way of spotting "code smells" that do not comply to well established standards, but they should be COMMUNITY standards, and not "just Google".
