Posts by patrickstar

What is dead may never die: a new version of OS/2 just arrived

Re: Well.......

At least in its earlier incarnations OS/2 actually ran graphics drivers in userland by giving specific threads direct access to the I/O ports and memory of the graphics card. Not a bad choice for its time (and I never had it blow up), but not exactly great from a stability/security point of view.

What I certainly do remember trouble with when running OS/2 is the single input queue. There was a third-party application (called WatchCat IIRC) to allow you to forcibly quit an errant application hogging it, by hitting a magic key combination (I suppose it hooked the keyboard far below Presentation Manager so it worked regardless of it) or even pulling a pin on the parallel port.

Re: @jake

This is just about the weirdest misconception I have ever heard...

The Apple GUI code was Pascal and 68k ASM.

The Windows (NT) GUI code is C and C++ (plus a tiny bit of ASM for the various archs supported, none of which is even remotely similar to 68k).

The non-NT Windows GUI code is C and C++ as well, plus quite a bit of ASM (x86).

The reason for the flat memory model and lack of any finer separation than user/kernel is that NT was always intended to be portable - they had to go with the common denominator across all relevant archs with MMUs. In fact, NT wasn't even originally developed for x86 and the x86 port was done pretty late in the development of the first version.

That being said, segmented protected mode and multiple rings certainly have a point (apart from scaring youngsters about the horrors we had to endure).

Atleast earlier in its life (1.x, 286 16-bit protected mode) OS/2 used this with quite good results.

Re: Nice for abandonware

"MS inflicted Win9x, not much more than Win3.x with the VFW & Win32s bundled optimised for gaming on businesses that would have been far better using NT3.5 or OS/2 Warp. A burden for them and business till XP (Win 5.1, Win2K was the unfinished Win 5.0). Idiots, though commercially sucessful, it was the source of most of the stupid design decisions and badly written SW on NT after 1995."

A lot of people who are now rabid Linux fanboys and general MS haters (or was at some point, like me in my younger days) switched to Linux from Win95/98 and still think "Windows" is like that

.

Win95* was a pretty darn impressive hack with a lot of sheer sorcery needed to build an environment that's simultaneously a new 32-bit system with all the bells and whistles, still very backwards compatible with 16-bit Windows and DOS stuff (even to the point of supporting DOS-only hardware drivers!) and had good performance on the systems of the day.

But this came at great costs in terms of stability, functionality and elegance. Which people without an understanding of the underlying reasons behind it - and more importantly, having never tried NT in any meaningful way - quickly assumed was because of "M$" incompetence when writing their "Windoze" (after all, Linux was clearly better, and also made you feel superior to common users after mastering it or even managing to install it and getting X running in high res).

So if they had just started pushing NT sooner, maybe we would have less annoying Linux fanboys...

Still, I'm not sure I can blame them for not doing it at that point in time. I really think the 9x stop-gap was needed to get people to start developing the shiny new Win32 applications, and NT wasn't exactly nice with 8 or even 4MB RAM which were common then.

They should probably have skipped Win Me though and simply launched XP at that point in time...

* Actually the biggest change from a technical viewpoint was arguably when Windows got 32BFA, which arrived in the 3.11 minor release, but...

Re: Nice for abandonware

A piece of related interesting/useless trivia is that the original NT team was actually called the Portable Systems Group.

Scheming copyright scam lawyer John Steele disbarred in Illinois

Re: Question from the UK

These are federal charges. There is no parole in the federal system. He will serve atleast 85% of his sentence - there are provisions for a little bit of time off for good behavior and earned credits.

WannaCrypt 'may be the work of North Korea' theory floated

Re: Naive Question

RS232 is too slow for a lot of things, and Ethernet too complex (and then we would be worried about people hacking that as well, not just the workstation controlling it...). Even if the gear was an entirely new design and used USB, that still required a custom kernel mode driver in XP (UMDF wasn't introduced until Vista or so).

If the gear itself is slightly older, it might very well pre-date standardized high speed low complexity interfaces altogether and then you're stuck with custom interface cards. In that case you can basically count yourself lucky if you're stuck with XP on a 10-15 year old PC, and not something like an early/mid 90s UNIX workstation, or worse (you can find spares for old SUN boxes easily, but some gear needs really specific hardware, like the rare SPARCs with VME buses).

Re: Naive Question

MS goes to great pains to maintain backwards compatibility, even to the point of "emulating" bugs/mis-features of APIs and layout of internal data structures when old code has come to rely on it.

With rare exceptions, stuff that runs on NT 4 or even 9x will run just fine on modern systems. The only caveat being the lack of support for DOS and 16 bit Windows applications on 64 bit systems.

Unfortunately, with the amount of software actually having been written for Windows - including weird in-house stuff - those rare exceptions still add up to quite a lot.

The bigger issue for things like medical equipment is probably the drivers. If you do it properly, drivers from Windows 2000 and onwards should work on modern systems (as long as they are the same bit-ness), but there's a lot of room for not doing things properly when developing drivers.

And it's a lot harder to work around when it happens (read: often impossible without the source code to the driver or the ability to re-implement it from scratch) - no such things as application compatibility hacks for drivers.

Volvo is letting Android 'take over underlying car software' – report

So, if you don't want Google spying on you, don't get a Volvo car? Or can this be avoided by simply not sticking a SIM card in it?

UK hospital meltdown after ransomware worm uses NSA vuln to raid IT

Re: Is it per workstation

Typically what ransomware does is add an extension to the file (like ".encrypted"), and then has a whitelist of extensions to actually encrypt.

Microsoft's Windows 10 ARM-twist comes closer with first demonstration

Emulating the full hardware of a modern computer is quite tricky. As in millions of lines of code tricky, with a gazillion little workarounds for things that don't follow the specs.

But emulating what a userland application sees is pretty simple. Just a simple interpreter for the opcodes, the necessary parts of memory management, and mapping the syscalls to the host OS. Couple of weeks of work for a single developer perhaps, though it won't perform well without a lot more.

Windows has had ARM support for quite some time too... there's even a distribution for Pi's like yours (unfortunately not called Raspows).

T-Mobile USA sued by parents after their baby dies amid 911 meltdown

Just a small tip that's unfortunately not widely known: If your cell phone operator is broken and you need to dial the emergency service, take out the SIM card. Then it will let you dial it using whatever network is available.

'Crazy bad' bug in Microsoft's Windows malware scanner can be used to install malware

All "antivirus software" has vulnerabilities like this one... And they tend to run with very high privileges, too. Really great concept, or not.

Super-secure Pi-stuffed nomx email server box given a good probing

Yes. And static IP addresses.

And then you still don't get things that are now basically assumed to be part of a proper secure communications setup, like end-to-end crypto or even MITM protection.

It's a bit of a shame this turns out to be utter crap, because we really need some serious commercial push-back against the agenda of putting everything in The Clown <TM>...

It's really great that they seem to claim him taking it apart was somehow needed to exploit it. 'No ordinary user would do that', etc.

Like they don't even understand the difference between reverse engineering your own hardware to evaluate a product and find vulnerabilities vs. exploiting vulnerabilities once they are known.

Re: The NOMX site

The vast majority of "home" ISPs do not offer static IP addresses, much less control over PTR records.

I'd even suspect that the vast majority of homes in the US or the world aren't even covered by an ISP offering either under reasonable conditions.

Even with a static IP address, chances are it's on the Spamhaus PBL or similar. There seems to be a total absence of any notice about a need for submitting yearly PBL removal requests on the NOMX site...

Potentially even worse, if your neighbor gets infected by spamming malware, chances are the entire range is going to be considered dirty by blocklists for quite some time, and as an end-user you are going to have very little recourse in this case.

Running a mail server on a home connection is basically throwing a dice as to whether your mail will arrive, and keep arriving. Which is fine for the hobbyist (who wouldn't buy a NOMX to begin with but rather set the mail server up on their own), but not for a mass-market product.

Having every end-user be able to speak SMTP directly with the world has been tried. As soon as the spam problem started escalating, pretty much everyone involved in delivering email (except the spammers) quickly agreed this was a Very Bad Idea.

Re: The NOMX site

There's nothing wrong with using a Pi or similar board as part of a product. This is, in fact, basically how you build embedded networking gear and similar gizmos nowadays. Most products of this kind are basically the vendor's reference design, perhaps with some light modifications.

There isn't even necessarily much wrong with hawking a product based on standard software and a web interface on top of it (though you should definitely provide updating facilities, and not only because of security issues).

There is however much wrong with stating that said product is the most secure e-mail solution ever, some sort of innovative security revolution, and literally having "Everything else is insecure" as your motto.

Even avoiding the 'hard' issues like the lack of end-to-end encryption, secure storage, the vendor's hostile response to basic security testing, the sure-fire snake oil of a challenge with artificial conditions, etc this product has a huge issue when sold for personal/home use. Namely that it's utterly useless for that.

You can't run a mail server on a home connection and expect it to be able to deliver mail to the Internet without using a relay/smarthost. You can't even use its 'super-innovative' feature of sending directly to other NOMX boxes using SMTP on port 26, since most connections have a dynamic IP address.

US taxmen pull plug on anti-identity-theft system used by identity thieves

Re: No withholding = ZERO chance for "refund fraud"

It's somewhat telling to see what one of the people involved in the birth of the withholding tax has to say about it:

http://reason.com/archives/1995/06/01/best-of-both-worlds

"I played a significant role, no question about it, in introducing withholding. I think it's a great mistake for peacetime, but in 1941–43, all of us were concentrating on the war.

I have no apologies for it, but I really wish we hadn't found it necessary and I wish there were some way of abolishing withholding now.

"

FYI: World was warned FIVE years ago about flaw exploited in Google Docs phishing phrenzy

Re: "It's like if a web browser didn't show the address bar"

We're slowly but surely getting there, with browsers already not showing protocol and in some cases path info...

'I feel violated': Engineer who pointed out traffic signals flaw fined for 'unlicensed engineering'

Re: Thus the color of any light is irrelevant.

For your information, ANPR cameras are typically IR.

These cameras tend to be IR so they work in the dark without having a flash distracting/blinding the driver.

Thus the color of any light is irrelevant.

Transatlantic link typo by Sweden's Telia broke Cloudflare in the US

A lot of Cloudflare services depend on actually being able to contact the site behind it, as opposed to hosting it directly.

If the Intertubes are broken, then it can't do so. This was the sort of error that really breaks normal redundancy as well - the prefixes were still in BGP but traffic wasn't delivered.

There isn't really any way to automatically protect 100% against that. Certainly not when some traffic via the transit provider is getting through and other traffic isn't - you really need a human to make the decision in that case. Especially since the only way to fix it is killing the entire transit connection, and doing so comes with its own risks (flap damping, for example).

FTP becoming Forgotten Transfer Protocol as Debian turns it off

When you say "file sharing platform", do you mean some clown service?

In that case I'd universally recommend an internal FTP server over any of them...

I use it all the time for downloading ISO images and source tarballs, especially when doing it straight to a server. Sure, there's always Lynx/links, but just firing up the basic always-available ftp client is quicker.

Plus I use it a lot for transfers within networks. Typically I will have an account with a not-very-secret password for uploading stuff, with FTP access only.

Many FTP daemons actually have an important security advantage to SSH - it's a lot easier to setup an account that can upload/download/list files in a specific directory and do nothing else. Try doing it with SSH - certainly possible, but a lot more work and things that can go wrong. Even to properly chroot the user you may very well end up having to run a separate sshd for the task.

Compared to, for example, vsftpd where it's a single configuration option and voila - all users end up chroot'ed to their home directories.

It's paydaygeddon! NatWest account transfers 'disappearing' (not really)

Re: Cobol

Well, VB had a very significant user base as well. Lots of businesses still depend on mountains of VB code for their day-to-day operations. It never had the sort of big well-known projects that Java does however.

Today you will find lots of new developers starting out with C# - far more than start out with VB. And entire shops that do nothing else.

As to C, I remember hating the syntax at first, also coming from a Pascal background. Especially casts, dereference, pointer fiddling, etc are objectively pretty damn ugly, but the syntax is very workable once you get used to it. Don't get me started on C++ though, now that's true horror!

Re: Cobol

It's been said that the curly brace syntax is so popular simply because it looks cool.

Compare VB.NET to C#. They are basically the same language - just that one looks lame and the other cool. Guess which one is the most popular, by far...

I bet that if Ada had curly brace syntax it would be where C++ is today... and modern software would be slightly less awful.

This is probably closer to the truth than you intended. Lots of stuff in banks happen with text files. Not so much permanent storage as Money transfer, though. Sometimes even transferred by plain old FTP.

Stanford Uni's intro to CompSci course adopts JavaScript, bins Java

Re: Tells you what the real aims of the course are

It's a horrible language if you need a stable, secure runtime with high performance. Which incidentally would be three of the major requirements for using it in web pages.

The various behaviors and quirks of the language really makes any implementation a mine field. Part of this is outside the language itself but rather things like the DOM APIs, but the fundamental language design certainly plays a big part as well.

Because of fundamental misdesigns like the type system, today's JS engines really have to jump through hoops and perform black magic to achieve the sort of performance needed, and this comes at a great cost.

No harm to Brendan Eich intended - anything designed and implemented in a couple of weeks in 1995 would have its share of issues when people decided it's a good idea to use it for general purpose applications 20 years later.

Re: C-pound? ANYTHING BUT C-POUND!

Uhm, you are aware that there is a fully open source implementation of the .NET runtime?

You can run your C# applications on Linux just fine.

And that the languages is basically Java but with the worst mistakes fixed, and some nifty new features?

It's not the best thing since sliced bread, but I'd certainly prefer it to Java...

Re: Advatage/disadvantge

Javascript/ECMAscript syntax actually only requires the semicolon when it's needed to resolve ambiguities.

Which might avoid cancer of the semi-colon, but leads to fun situations like:

return { foo: "bar" };

and

return

{

foo: "bar"

};

not doing the same thing.

Script kiddies pwn 1000s of Windows boxes using leaked NSA hack tools

Re: Does anyone but MS understand BITS?

It's well documented, and is even usable from PowerShell.

Can't say I have seen it used much in third-party software though.

As to vulnerabilities - it's basically a glorified HTTP client. I wouldn't be more worried about it than any other. Which is still a non-zero amount of worry, since apparently humanity hasn't evolved to the point where a simple protocol implementation can't pwn your computer...

Re: Tut tut tut

I operate lots of Windows servers on the Internet. And lots of Linux servers. As well as several other OSes. For some reason, they tend not to get hacked, regardless of OS.

Might have something to do with the fact that I don't do dumb things like expose port 139/445 to the world, regardless of whether it's the Windows, Samba, or Solaris implementation.

Re: Can you hack my DOS 6.22?

Back in the days, DOS boxes were frequently crawling with virii.

And BBS systems running on DOS were frequently hacked.

Even simply stuff like ANSI bombs were a thing too (print ANSI escape sequences to re-map the keyboard to do nasty things next time you pressed a key). Or shell escape hacks.

Since DOS has no memory protection at all, plus pre-dates secure coding practices, I'd assume you'd be quite royally screwed if you ran some sort of network server on DOS and someone was actually out to get you. Maybe your average DOS application is a little less worse off since Pascal was a lot more common than C, but still.

(Yes, there are network services and Ethernet drivers for DOS - I haven't done much TCP/IP personally though, maybe setting up a BBS for inbound telnet or such. I have run a lot of TCP/IP on Win 3.1x though, and it's not much better protection wise).

Re: Tut tut tut

If security is your concern, then you are just as (if not more) screwed with Samba. It has a truly atrocious history of vulnerabilities.

Google launches root certificate authority

Uhm, all root certs are self-signed.

And it's not the actual root cert that will be used for their sites. It'll be kept very much offline (HSM in a vault/safe, probably), or else they would be very much in violation of any established rules for CAs.

At most this will result in a shorter certificate chain. Usually CAs just sign a couple intermediary certs with their root and then use them to issue certs so a compromised cert will have less impact. Google could conceivably, if their organization allows it, actually sign the certs for their sites directly with the root.

Mastercard launches card that replaces PIN with fingerprint sensor

Re: No card is secure

There are different values of "secure".

In the case of smartcards in general it means "takes too much time and/or money to attack them". With debit/credit cards you can even make a nice budget for how much it has to cost the attacker to compromise a single card.

You should rather think about it in terms of physical security (where literally anything is possible to compromise given enough of those two things), not computer or cryptographic security (where 'secure' tends to mean that it's either actually literally impossible to compromise given certain assumptions, or that it would take more time than the universe has left).

Just like it's standard procedure for the clerk to check the signature for transactions without a PIN?

And by "standard", I mean "never actually done".

Re: Really?

This policy predates chip-and-pin, so, no.

Apparently another commentard was able to point to the relevant legislation that seems to be the reason for the difference.

So, just by stealing someone's wallet you get everything needed? Card plus fingerprint lifted from anything in there (including the card itself unless it has very good anti-fingerprint coating...).

Wasn't this exactly what PIN codes were supposed to prevent?

The gangs that do skimming and card theft en masse aren't stupid or poorly equipped. They would quickly figure out how to emulate fingerprints without the clerk noticing.

Re: Really?

In the US, VISA has adopted a policy that basically says the cardholder shouldn't ever lose money because of fraud. You can just do a chargeback without any fuss.

In Europe, not so good. I don't know the formal differences or what the reason is, but there's a lot more resistance from many card issuers.

There has even been some news stories here about people being signed up for recurring charges against their will and the issuer's response being along the lines of "You must have clicked OK so that means you agreed to it! No chargeback for you, come back never!".

Such a scam would never fly in the US, and neither would the merchant account used for long since it'd be nuked once resulting flood of chargebacks arrived.

The point is that doing so is supposed to cost more than what you can gain from abusing the card. Just like changing/reading the PIN of the card would.

Drunk user blow-dried laptop after dog lifted its leg over the keyboard

Re: Back in the day...

I had a SUN Type 5 keyboard that got literally soked in coke (the liquid kind) twice. Once to the point that the entire thing was totally shorted out - the Caps Lock LED had an omnious glow.

Both times I simply took the thing apart, took out the controller board and cleaned it manually, and gave the keyboard itself a good shower.

Worked perfectly fine for many years after.

Oracle patches Solaris 10 hole exploited by NSA spyware tool – and 298 other security bugs

It's an easily mitigated local for something that shouldn't be present on a server anyways, so the lack of urgence is somewhat understandable.

Re: Money first, patches later

Not that I'm a fan of Orrible, but for those of you with a shitload of legacy systems and no support:

The remote is fixed in the freely downloadable version.

dtappgather shouldn't be present on a server, and if it is, you can just remove the SUID bit.

'Tech troll' sues EFF to silence 'Stupid Patent of the Month' blog. Now the EFF sues back

You actually consider yourself more well-versed in freedom of speech and libel law in the US than the _EFF_?

That's a bit ballsy... So how many decades exactly have you spent litigating some of the biggest cases in those areas?

By your logic, noone could ever publish anything that's illegal anywhere in the world.

I am very sure you can easily see the problems with this approach.

Back to the Future 2: Gasp! America's trade watchdog discovers the risks of 'free' movies

Well, I suppose you could find a combination of vulnerabilities that lets you cover most widely used media players with a single file, but I've certainly never seen it done. Chances are that triggering a bug in one would cause another to see the file as invalid, but theretically it could definitely be done.

Have I ever seen it? No. Would anyone waste such a masterpiece on infecting random pirate movie downloaders? Hell no!

Only infections stemming from pirate sides I've ever heard of are either standard drive-by downloads, , getting an EXE file instead of a movie, or being told you need some special codec and given the file to install it...

PS. Somewhat relevant blast from the past on El Reg: http://www.theregister.co.uk/2003/01/14/is_the_riaa_hacking_you/

DTMF replay phreaked out the Dallas tornado alarm, say researchers

Re: Actually it has nothing to do with phreaking...

There are still lots and lots of voice mail systems and PBXes around that obey the basic laws of phreaking.

And other strange stuff connected to the public phone network and taking commands over DTMF.

DTMF being "one of the oldest signalling techniques around"? Uhm, no.

Pulse dialing is still supported by most exchanges, and there are actually some of those phones around. More common would be its close cousin, the current loop, which is used in many brand-new designs when you need very high reliability despite interference and can't do fiber.

Morse code is still pretty widely used on radio.

Semaphores and flag signals are still used.

Even signaling by lighting huge fires is occasionally used...