Posts by cdrcat

Oracle's masterclass in breach comms: Deny, deflect, repeat

Time to refresh the classic Oracle quote

"As you know people, as you learn about things, you realize that these generalizations we have are, virtually to a generalization, false. Well, except for this one, as it turns out. What you think of Oracle, is even truer than you think it is. There has been no entity in human history with less complexity or nuance to it than Oracle. And I gotta say, as someone who has seen that complexity for my entire life, it's very hard to get used to that idea. It's like, 'surely this is more complicated!' but it's like: Wow, this is really simple! This company is very straightforward, in its defense. This company is about one man, his alter-ego, and what he wants to inflict upon humanity -- that's it! ...Ship mediocrity, inflict misery, lie our asses off, screw our customers, and make a whole shitload of money. Yeah... you talk to Oracle, it's like, 'no, we don't fucking make dreams happen -- we make money!' ...You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle." : Bryan Cantril

Huawei makes divorce from Android official with HarmonyOS NEXT launch

Apps can be more secure

Web pages have thousands of vectors of attack and scammers develop infrastructure to attack web pages. Can we trust banks to block every security flaw?

I hate Apps, but at least they can secure the login (usually as good as the phone provides) and attacking an App usually requires the phone to be compromised AND attackers would need to reverse engineer some of the App and attackers can be fingerprinted by the bank. iPhones and Pixels are both reasonably secure (certainly more secure than browsers on Windows).

I have a little experience trying to secure a web page and it is an impossible task because by-design the user controls their browser and users have lax security habits and there are multiple attack vectors (network MiTM, plugins, browsers, OS, ...).

Linux Kernel of the Beast 6.6.6 exorcised by angelic 6.6.7 update

House numbering oddities

Or why a house in Owls Green, would be numbered 2820 (too-wit too-woo).

http://paulplowman.com/stuff/uk-address-oddities/

War of the workstations: How the lowest bidders shaped today's tech landscape

Remove those retro rose-coloured glasses

There are great reasons why those good ideas died.

"Save the world" was awful as soon as there was more than one developer. I played with IBM smalltalk - ugggh. I delivered commercial software written in an object oriented DB (similar problems with delivering updates and versioning as smalltalk).

Programming languages use txt based source files not because the solution is pretty, but because the alternatives worked out to be hideous.

LISP is amazing *if* the developer is exceptionally highly skilled. Every person that demonstrates the productivity of LISP has good taste well above the average developer. Mere mortal developers create spaghetti - insanely bad DSLs and totally opaque macros. Maybe one person can maintain their own code but nobody else ever will be able to touch it because every codebase becomes so esoterically customised. There's a reason valuable LISP code can never be passed on. There is a bad reason that there are so many incompatible LISP dialects and every LISP author writes their own library code. Certain types of productivity lead to unproductive behaviours in the large. The same problems can occur with modern programming languages but successful languages and community have norms against custom complexity.

LockBit redraws negotiation tactics after affiliates fail to squeeze victims

Re: You write this as if

Currently businesses are capitalist. Individual businesses have no incentive to pay for the advantage of others: and personally I don't think we should blame the victims for making sensible business decisions.

This is a tragedy is the commons situation.

As you say, only external parties can enforce change on criminals and their victims. It doesn't help to weep because our governments and regulations are failing us.

OpenAI CEO Sam Altman's ejection sparks theories as odd as some ChatGPT output

Theories

Certainly a drama. I've been enjoying the hallucinations of all the various theories.

So many people taking two facts, and feverishly creating some convoluted explanation using whatever. Usually some nonsense story opening with "It's clear that" or a similarly unhedged statement.

Here's a list of some of them: https://techcrunch.com/2023/11/17/wtf-is-going-on-at-openai-sam-altman-fired/ (sorry for the TechCrunch link but it suits the vibe!)

Musk sues law firm for overcharging Twitter when Twitter was suing Musk

Matt Levine has a good in-depth writeup

https://www.bloomberg.com/opinion/articles/2023-07-11/matt-levine-s-money-stuff-elon-musk-blames-the-lawyers

https://web.archive.org/web/20230711174717/https://www.bloomberg.com/opinion/articles/2023-07-11/matt-levine-s-money-stuff-elon-musk-blames-the-lawyers

ChatGPT has mastered the confidence trick, and that's a terrible look for AI

Re: Dunning-Kruger Tee

The Dunning-Kruger paper posited two results, the second less well renowned result measured that humble people were “skilled but unaware just how skilled they are”.

You can apply the label Dunning-Kruger to yourself with pride if you humbly belong to the second group who underestimate their skills - similar to owning the word c*nt because you have an affinity for c*nts.

Re: How much leccy does ChatGPT consume?

Very very little, marginally. They give you $18.00 of credit to use and on the dashboard you can see how much it costs you to generate a hundred paragraphs (hint: very little). By assuming that most of the $ go on hosting, and using an estimate of percentage costs for a data centre on leccy, you can make an estimate of leccy consumption. Training is expensive, but gets amortised over a very large number of prompt queries.

Boss broke servers with a careless bit of keyboarding, leaving techies to sort it out late on a Sunday

Re: Belt up

Or, perhaps more accurately, the hard drive continuously falls at just the right acceleration to keep up with the continuous acceleration of the ISS.

Nvidia faces lawsuit for melting RTX 4090 cables as AMD has a laugh

Totally due to Tesla design flaw - no surprise - as per the linked article “The problem is that the car will prioritize its liquid cooling (shared with the infotainment system) to the batteries, leaving the CPU to overheat.”

Article writer is being a complete doofus.

Go ahead, be rude. You don't know it now, but it will cost you $350,000

“Larry was running a project to replace the laptops in an entire division of 500 staff, and decided to split the deal between two PC makers.”

"This wasn't a dozen machines, or maybe a couple of dozen. This was 350 laptops in total, at $1,000 a piece – not counting peripherals, docking stations, bags, and other doodads the company ordered depending upon the department and seniority."

Password change forms often require validating the old password. That doesn’t mean that the password is stored in cleartext.

Re: You get what you order

https://randomcriticalanalysis.com/why-conventional-wisdom-on-health-care-is-wrong-a-primer/ is an analysis of heath systems that argues against some of the typical opinions we have - I am unsure how sound the analysis is but it certainly is interesting.

Delivery drone crashes into power lines, causes outage

Nice photo of drone on the wires in the linked article

https://www.abc.net.au/news/2022-09-30/food-delivery-drone-lands-on-power-lines-qld-browns-plains/101489670

BOFH: Tech helps HR investigate the Boss's devices

And in other news . . .

Once upon a time in a far away land

How did you mourn Internet Explorer's passing?

Re: So how was all that Spyglass Code in there then?..

GML was involved with the history of HTML[1] because it was a predecessor to SGML. However stating that the GML codebase became Mosaic or Spyglass sounds surreal. If you have alternative facts, I suggest you pass them to the appropriate history buffs to cross-check them: why post anything important here?

[1] https://www.w3.org/2012/08/history-of-the-web/origins.htm

Inverse Finance stung for $1.2 million via flash loan attack

Re: The final stage of the crypto collapse

I would paraphrase your comment as “cabal of insiders team up against retail investors” (The haves team up against the fish). That sounds like nonsense: most crypto is inherently trustless: if any individual can defect against the group (defect against your “haves”) they will, which is just sensible economics.

Disclaimer: I no didly-squat about crypto and I don’t own none

Antitrust battle latest: Google, Facebook 'colluded' to smash Apple's privacy protections

Re: So What

I am not a Google lover by any means, but Google *mostly* does a pretty good job given the ad industry.

If Android and gmail were split off, I imagine the first thing would be to upgrade install the worst possible uninstallable Apps and sell off your data to the spammiest bidder. How many times have I seen a product go to shit when it changed hands? Imagine if Microsoft owned Android?

The Chrome development team are uniquely talented - the reliability is astonishing and their speed of development is unlike any other team I know of (I don’t like all the new features but I really love others, and W3 was trying to spec some epically stupid stuff so fuck them) . Three other well paid teams are shit in comparison from my very long and painful experience. Imagine what would happen to Chrome if it was sold? It is open source - a gift to us all - so you don’t have to use Chrome.

I am most dissatisfied with Google search and YouTube - the gradual degradation with more and more adverts is killing those for me.

Netflix sued by South Korean ISP after Squid Game fans swell traffic to '1.2Tbps'

Re: Looks like the ISP wants 2 bites of the cherry

Some Netflix traffic goes via backbones, but most Netflix data is streamed from cached content served by appliances installed at reasonably local peering exchanges.

“Each Open Connect Appliance (OCA) stores a portion of the Netflix catalog, which in general is less than the complete content library for a given region. Popularity changes, new titles that are added to the service, re-encoded movies, and routine software enhancements are all part of the nightly updates, or fill, that each appliance must download to remain current.” — https://openconnect.zendesk.com/hc/en-us/articles/360035618071

Stack Overflow acquired for $1.8bn by Prosus (no, me neither)

Only the questioner can select the accepted answer

Often the person asking the question marks an answer as the accepted answer, and never goes back to correct it.

Well, that was how it worked last time I looked, although I admit that I too find it frustrating.

The Audacity: Audio tool finds new and exciting ways to annoy contributors with a Contributor License Agreement

They could allow CC0 the same as Rack does

As per https://github.com/VCVRack/Rack/blob/v1/.github/CONTRIBUTING.md

“””

To accept a contribution, all authors of the contribution need to either

* declare the patch under the CC0 license.

* complete a copyright reassignment form.

* perform the work under a paid agreement.

“””

We admire your MOXIE, Earthlings: Perseverance rover gizmo produces oxygen for first time on Mars

Aerogel doesn't have to be fragile

> It seems to me that the biggest technical achievement was keeping the areogel intact for the trip

"""not all aerogels are easy to break! Classic (or 'legacy') aerogels exhibit extremely high strength-to-weight ratios and are able (in principle) to hold thousands of times their weight in applied force, however also typically exhibit extremely low fracture toughness, that is, the ability to resist propagation of flaws in the material. As a result, it is possible for a classic aerogel block that is 96% air by volume to hold a brick thousands of times its own weight, but only if the weight is placed on the monolith gently and there are no major cracks in the aerogel.

New mechanically strong and machinable aerogels such as Airloy® strong aerogels made by Aerogel Technologies fix this problem. Airloy aerogels are hundreds of times stronger and stiffer than classic aerogels and simultaneously durable and fracture tough. Unlike legacy aerogels, Airloy aerogels can be machined (drilled, tapped, turned, milled) and bent without breaking. The strength, stiffness, thermal conductivity, and other properties of Airloy aerogels depend on the product series."""

http://www.aerogeltechnologies.com/about/faqs/

Not much energy is required

Use a countercurrent heat exchanger - incoming air is cooled by the outgoing air. https://wikipedia.org/wiki/Countercurrent_exchange

George Clooney of IT: Dribbling disaster and damp disk warnings scare the life out of innocent user

A colleague thought he was Jesus

He told me about when he was committed to a mental health unit, because he thought he was Jesus.

Inside he meets a guy who says "Hi, I'm god". My colleague response by suddenly hugging the guy and says "Dad" emotionally.

Feature bloat: Psychology boffins find people tend to add elements to solve a problem rather than take things away

Some explanation could be that Lego has social rules

Different people have different rules about what is OK to do to another’s creation - and the rules are largely subconscious. They try to avoid that bias: “All the participants were told they could alter the structure however they wanted to.”

But that isn’t quite the same as giving “ownership” of the tower. It is hard to guess what one would do as a participant, but I suspect I would feel it wasn’t “my” tower, so my scope of changes would be more limited.

We imagine this maths professor's lecture was fascinating – sadly he was muted for two hours

Re: Pray elaborate?

A camera “star filter lens” adds starbursts to bright point source lights.

Camera filters can add, not just filter. I am sure you can suggest a better analogue filter example where the filter adds to the image... maybe a border?

Police drone plunged 70ft into pond after operator mashed pop-up that was actually the emergency cut-out button

Re: Fail safe?

Buttons that don’t click when you press them are a horrendous UI failure. You see the problem with slow user interfaces - people naturally click again and the second click can be on something behind a modal - fail.

You can fade-in the button, or grey out the button while it is disabled, but those solutions also lead to unwanted side-effects.

Pop up modals and unexpected scrolling are hard problems (on Android Chrome double clicking an input box selects, but the first click pops up the keyboard and scrolls the input box away, very annoying!)

Google AMP gets a shock to its system as advisor quits, lawsuit claims foul play

Re: Fuck javascript.

Google could uprank articles that serve pure HTML/CSS, with no JS. That would have achieved multiple goals: faster loading, less tracking, less viruses, better archiving, better accessibility. Bastards.

Watchdog signals Boeing 737 Max jets can return to US skies following software upgrade, pilot training

Re: The bigger picture..

“but it is not the MCAS. The autopilot has to be off for MCAS to kick in.”

“The pilots said that soon after engaging the autopilot on Boeing 737 Max 8 planes, the nose tilted down sharply. In both cases, they recovered quickly after disconnecting the autopilot.”

So the article is probably not MCAS related.

Windows kernel vulnerability disclosed by Google's Project Zero after bug exploited in the wild by hackers

Google bashing, now smearing...

The tone on multiple technical websites has really started to go up a notch whenever it is something related to Google. In this case a lot of comments are shooting the messenger.

The Google Zero team are not cowboy dicks: they follow a fair process and have thought about the issues more than most, and are trying to be responsible.

Think about what happens in an alternative world where Google keep these vulnerabilities hidden or just informs the vendor, instead of publishing them... Nobody likes the outcomes of vulnerabilities, but they are simply a result of Microsoft’s historical attitude towards security.

These security faults are often ancient, and the rate of discovery is not decreasing, so expect more of the same in the coming years.

2020 hasn't been all bad – a new Raspberry Pi Compute Module is here

Beowulf cluster of 4 of these

https://turingpi.com/

“ Today we are thrilled to announce the Turing Pi V2. The Turing Pi V2 is s compact cluster in a mini ITX form factor with 4 x cluster nodes, 2x mini PCIe (Gen 2) ports, 2x SATA (Gen 3) ports, and new Raspberry Pi compute modules 4 support.”

There ain't no problem that can't be solved with the help of American horsepower – even yanking on a coax cable

Re: Blowing fibre.

Air compressor fits the ABF gun better: https://hexatronic.com/products/installation-tools-and-accessories/air-blown-fiber-abf-installation-tool/

Anti-5G-vaxx pressure group sues Zuckerberg, Facebook, fact checkers for daring to suggest it might be wrong

Re: Welcome to the post-sanity world

And here I was thinking a healthy society cared about protecting the poor and stupid from themselves.

Be careful in wishing the worst upon those that make mistakes lest you fail to be perfect yourself.

Sun welcomes vampire dating website company: Arrgh! No! It burns! It buuurrrrnsss!

Re: Not me, but someone else

Don't spare a thought for such shallow idiots. Showing such people their mistakes is often futile, wasting your time and theirs.

Apple to keep Intel at Arm's length: macOS shifts from x86 to homegrown common CPU arch, will run iOS apps

Re: "Intel never thrilled me"

There are multiple hardware mitigations *already* in Apple processors. They are mostly aimed at preventing kernel level exploits, but it seems very likely Apple will continue putting in more security protections into the A* processors.

Intel have repeatably shown they prioritise sales performance before security, sort of like Microsoft of yore, and Intel is less likely to develop mitigations that require tight integration with the OS or deep modification of the OS.

Scroll way down to the heading “iOS kernel exploit mitigations” in this link which details some of the hardware protections: https://googleprojectzero.blogspot.com/2020/06/a-survey-of-recent-ios-kernel-exploits.html

Splunk to junk masters and slaves once a committee figures out replacements

Polish part I own; Reverse Polish notation okay to exist, opinion mine humbly.

Re: Ableist language is sadly everywhere

Calling somebody a mong is an insult in New Zealand, which I presume it is a abbreviation (and nothing to do with the Hmong).

Forget tabs – the new war is commas versus spaces: Web heads urged by browser devs to embrace modern CSS

Re: So how do "modern monitors" do it?

Say you have white (255,255,255). Now you want a red as bright as that white, maybe that should be represented as (765,0,0).

Or maybe you want to have 10 bit colours, so you can choose between (1023,1023,1023) or (255.75,255.75,255.75) as representations that allow ten bits per channel to be declared.

It’s all completely insane of course, since the page would have to say what colour space it was using, the gamma, and what representation it was using. Otherwise a browser couldn’t map the wide-gamut or 10-bit colours when someone used a normal 24 bit colour monitor.

We're in a timeline where Dettol maker has to beg folks not to inject cleaning fluid into their veins. Thanks, Trump

Re: "Orange Man Bad!"

Cristobal Colon is still alive running the show from a secret bunker located under the Vatican. You’ll notice that Christopher Columbus Is an obvious anagram containing “Hitler”, which says it all. “Americans” are actually spy robots - they have to be loud to cover up the noise of their internal machinery (Machiavellian has the same root). If the mods publish this, I will be replaced with a machine intelligence: if the quality of my comments improves then it proves it (or if they get worse it’ll be because they programmed the replacement to act dumb).

> might do us all a favour and Darwin themselves out of the gene pool

One needs to kill oneself before spawning, otherwise ones death has piss all Darwinian effect (kin selection matters, but stupidity matters more).

April 2020 and – rest assured – your Windows PC can still be pwned by something so innocuous as an unruly font

Re: Better to be an outlier?

iOS and Android dwarf Windows usage in a household context. And they are critical for security in a business context (they are often literally the keys to the bank and infrastructure in small to medium businesses).

Commit to Android codebase suggests Google may strong-arm phone makers into using 'seamless' partitioned updates

Old Android phones remain more secure from attacks via web pages, because the browser is updated regularly. Android 4.4 (released Oct 2013) is still getting Chrome updates. Most other attacks are mitigated by needing to be physically near phone, are filtered by SMS infrastructure, or can be avoided by not installing crap apps.

Anyone on iOS 12 or less is stuck on an old and insecure version of Safari - the recent flaw that gives access to cameras also gives access to stored passwords... Roll the dice on every web page visited!

I generally recommend Nokia phones with Android One (designed by HMD) because they are relatively cheap but good, they get updates, and the Android version is clean (no manufacturer shit).

That awful moment when what you thought was a number 1 turned out to be a number 2

125 million Indians speak English

The Oxford Indian Dictionary will replace the OED.

Soon to be heard from your local chav:

My daughter is convent-educated

My teacher is sitting on my head

My friend is eating my brain

https://www.britishcouncil.org/voices-magazine/ten-surprising-expressions-indian-english

Microsoft CEO Satya Nadella talks hardware supply chains and elasticity: 'Bigger issue' is what happens around US and Europe's 'demand side'

Re: Supply Chains

Testable.

Order something that needs delivery from China, preferably that has just become stocked again.

My bet is that China is open for business at the moment - if the US had some real dirt on China they would be printing it no the presses already.

And there are multiple other Asian countries that have functioning economies - the star being Taiwan.

HMD Global pokes head out of quarantine to show off 3 new Nokia mobiles

Re: SD Card & Headphone Jack?

Do they have dual SIM? Very useful when travelling and past models had it.

Google reveals the wheels almost literally fell off one of its cloudy server racks

Re: Swapping whole racks out

Why would they ever have unused hardware? That would be a waste of money - hardware should be used.

“Google's Borg system is a cluster manager that runs hundreds of thousands of jobs, from many thousands of different applications, across a number of clusters each with up to tens of thousands of machines.”.

The system is set up so that hardware failures are dealt with by restarting jobs. Google have done that since they started (optimising for cheaper machines that are expected to fail, rather than expensive reliable machines).

Thought you were done after Tuesday's 115-fix day? Not yet: Microsoft emits SMBv3 worm-cure crisis patch

One down, 900 critical bugs to go

Assuming 25 critical bugs found per month, for the next three years, means there are 900 critical bugs left to find... this one bug doesn’t matter that much since there are *plenty* left for skilled parties to find and abuse.

https://blog.talosintelligence.com/2020/03/microsoft-patch-tuesday-march-2020.html

Chips that pass in the night: How risky is RISC-V to Arm, Intel and the others? Very

The Internet Is Being Protected By Two Guys Named Steve

https://www.buzzfeed.com/chrisstokelwalker/the-internet-is-being-protected-by-two-guys-named-st

Sorry, buzzfeed, but great story.