Posts by Tessier-Ashpool

Google releases beta version of Android 13 'Tiramisu'

Re: Other handset manufacturers are available

That would be Android Crème Brûlée, a thin brittle veneer over a sloppy mess.

Apple's grip on iOS browser engines disallowed under latest draft EU rules

Re: We live in a lovely world where third party software is completely benign

You obviously missed the forthcoming legislation that will force Apple to permit use of third party App Stores. The days of Apple-reviewed apps are numbered.

Re: Browser Warz

Dreadful idea. Apple refused to implement certain Google "standards" because they degrade privacy and make it easier to track users.

We live in a lovely world where third party software is completely benign

2025: I install a random browser and its own custom engine on my iPhone. It kills iPhone performance, just life Flash did. Even worse, it steals my data and makes my navigation app slow to a crawl.

Since this *could* happen, I would expect Apple to have a checkbox (ticked by default) that installation of such software voids my warranty.

Fair enough that you are allowed to do this, but don't expect to install such software willy nilly without agreeing to caveats. And don't expect to be able to take your phone into an Apple store if it goes tits up.

Apple iOS privacy clampdown 'did little' to reduce tracking

Re: How is Apple supposed to prevent use of email addresses to identify people?

I changed my longstanding Register email address to use a Hide My Email address a few months ago. It’s not difficult.

Re: How is Apple supposed to prevent use of email addresses to identify people?

Apple provided Hide My Email functionality for exactly this reason. No more mucking about managing email aliases; just click the option to generate a new hidden email alias when registering on a website. Because it’s so easy, I imagine a lot of people are using this, myself included.

Microsoft Azure developers targeted by 200-plus data-stealing npm packages

Re: Aargh!

Why? Because there is implied trust. You can’t even start a Visual Studio web project these days without it importing a plethora of third party nuget packages first, like certain JavaScript helpers.

From a security perspective, this is far from ideal. But it’s what happens routinely. Huge numbers of packages get downloaded millions of times by developers.

Let’s say you want, by this time tomorrow, to have an app that will compute distances between postcodes in a spreadsheet. Do you write the bulk of that code yourself taking weeks or months, or do you use one or more of the numerous helper packages to do the job? The vast majority of developers do the latter, and do trust by numbers. Package A has been downloaded a million times; must be safe, right? Of course not, but it’s what is practical. You have no easy way of knowing for sure that a package is benign.

Re: Aargh!

Most package downloads are bytecode or binary executables. Do you really want to get into extensive decompilation analysis? Or do you want to get your project done on time?

This browser-in-browser attack is perfect for phishing

Re: Password Manager

I don’t remember the last time I actually typed a password into a website. Safari/Keychain normally handles that for me. I presume saved passwords in Chrome would do the same?

Apple, Google urge monopoly watchdog to leave them alone

Re: Meddling regulators

One founder amongst many others. What's your point?

Meddling regulators

Meddling regulators shouldn’t put too much weight on the opinions of moaning developers who are slap happy eager to embrace each and every Chrome standard everywhere. Funnily enough, the Developers Alliance agree (somewhat ironically) that the status quo should essentially be preserved.

https://assets.publishing.service.gov.uk/media/6229aba98fa8f526cf29aa2e/Developers_Alliance.pdf

“We come to the ironic conclusion that we cannot support the CMA’s narrow developer objective even though it is couched in developer self-interest because it ignores the health of the ecosystem, its critical role in market creation and stewardship, and its role in connecting consumers to market participants.“

114 billion transistors, one big meh. Apple's M1 Ultra wake-up call

Re: "it's too small for your cat to sit on"

Slightly off-topic, but I used to have an expensive AV amplifier that was the favourite resting place of my cat. One day he wasn’t feeling too good, and puked up into the device, which promptly stopped working. Grrr!

Reg reader rages over Virgin Media's email password policy

Re: Rainbow tables anyone?

No, it doesn't mean that. It's more like peering through an unfrosted window to see a door's key code written on the wall.

For a long long time, huge numbers of websites accepted a user's login on a form that is used to compute a crappy SQL command. e.g.

"SELECT TOP 1 * FROM [Users] WHERE [User] = ' " + $User + " ' AND password=' " + $Password + " ' "

which, if jbloggs 1234 is entered, maps to a string

SELECT TOP 1 * FROM [Users] WHERE [User] = 'jbloggs' AND password = '1234'

But what happens if someone, instead of typing jbloggs, types ' OR 1=1 ;

A crap website will, from this, construct a SQL command:

SELECT TOP 1 * FROM [Users] WHERE [User] = '' OR 1=1; AND password = '1234'

which will successfully find the first user in its [USERS] table, regardless.

Oops.

Decent websites won't do things this way, and certainly those that engage in penetration testing. But I daresay there are still quite a few around that are exposed to SQL injection of this kind.

Re: Rainbow tables anyone?

@Ian Johnston

Most notably by SQL infection on a crappily-written website.

Re: Rainbow tables anyone?

A proper password hash will have been computed in conjunction with a salt. So a rainbow table in this case won't be much use unless the hacker has the salt as well as the hash. If that happens, your password provider has been seriously compromised!

I use iCloud email in conjunction with its custom email DNS feature, meaning I can easily direct emails for [e-mail] to iCloud mail. I already pay £2.49 a month for iCloud storage, so the emails and custom email DNS come at no extra charge. That's nothing, really, considering the whole family can share this feature, and a domain can be registered for around $15 per year.

https://9to5mac.com/2021/09/07/how-to-set-up-an-icloud-mail-custom-email-domain-video/

Just two die for: Apple reveals M1 Ultra chip in Mac Studio

Re: Threadripper? Deadripper more like.

Indeed, you could fry an egg on the intel chip.

I wouldn't use the M1 Pro for video encoding. I'd use its bigger brother the M1 Max, which has a ton of GPU cores available for that kind of work.

Or, of course, the M1 Ultra, if you have a few quid to spare.

Apple, Google, Microsoft, Mozilla agree on something: Make web dev lives easier

Re: Keep It Simple, Stupid.

Once upon a time, in my early days as a dogsbody (and largely unsupervised) programmer, I formulated a couple of SQL queries for a web app that returned HTML to make the data look a little nicer.

I would sack myself as a hopeless case if I could go back in time!

Apple emits emergency fix for exploited-in-the-wild WebKit vulnerability

Re: Late Gate

Since you know so much, exactly when did the bad guys find and exploit this vulnerability, and how long did it take Apple to address it? Do not forget to mention "stable door" in your answer.

Re: Late Gate

The first I knew about this particular vulnerability was the day that the fix became available. Like most onlookers. Even then, the actual mechanics of the vulnerability were not announced, making life difficult for would-be miscreants.

I’d like to know the kind of world (in the absence of a functioning time machine) you imagine where a fix for a zero-day vulnerability is released ahead of its discovery and announcement.

UK Home Secretary Priti Patel green-lights Mike Lynch's extradition to US to face Autonomy fraud charges

Are you local?

This is a local IT shop for local people. We’ll have no trouble here.

HPE has 'substantially succeeded' in its £3.3bn fraud trial against Autonomy's Mike Lynch – judge

Quick! Make a donation to the Tory Party, Mikey!

It's the only way to be sure.

Shut off 3G by 2033? How about 2023, asks Vodafone UK

Re: Saving energy?

How big is a 4G/5G cell?

5G has been rolling out in my nearest town lately, and I amuse myself on my regular jaunts to civilisation by keeping tabs on the 4G/5G CarPlay icon during my drives. When 5G pops up, it’s typically so for about 1km or thereabouts.

Bug in WebKit's IndexedDB implementation makes Safari 15 leak Google account info... and more

All those other browsers rely on iOS webkit, which is the source of this particular vulnerability.

Depending on your point of view, that’s a good or a bad thing. Personally, given that numerous other iOS apps and services depend on webkit, I’d say that centralising core code this way is for the best, even if the occasional howler surfaces.

Don't make an iOS of yourself – Apple's patched its OSes, you know the drill

Re: "Excluded: Licenced media" etc.

"Is there anywhere in the those licenses that they are bound to the lifetime of the owner?"

Yes. To take the example of movies purchased via iTunes, the rights owner of the movie grants a sub-license to Apple, which is transferred to the *purchaser* when they "buy" a movie. The purchaser has no right to transfer that license to another party.

But... it's worse than that. If the rights owner removes said movie from the iTunes Store, Apple are obliged to withdraw said sub-license from the purchaser. It doesn't happen that often, but your purchased iTunes movie can be disappeared. Nice.

This is sufficiently aggravating that a court case is ongoing, disputing the use of the word "Buy". I, like many others, do not consider a movie to be "bought" if it can be arbitrarily removed from the user's movie library.

Amazon tells folks it will stop accepting UK Visa credit cards via weird empty email

Re: VISA will be just the first

I did read the article.

What the article fails to mention is that the scope of the increased charges are far greater for Visa Credit.

"Visa has announced similar changes to Mastercard, but with a larger scope. More specifically, the Visa changes will have significant impact on consumer card-not-present transactions, consumer refund transactions, and commercial transactions between the UK and the EEA."

Re: VISA will be just the first

You should know. For sure.

EU regulation (2015) caps credit card fees at 0.3%

Outside the EU, Visa have chanced it and whacked up their prices way beyond that limit, something the EU put in place to protect consumers.

Rather like phone companies reintroducing exorbitant roaming charges now that we don’t have EU price protection.

Good old Brexit.

Of course, the amusing twist here is that Visa have effectively priced themselves out of the market by getting a little too greedy. Nice job, Amazon. You are under no obligation to accept payment methods that charge exorbitant fees.

Google's Pixel 6 fingerprint reader is rubbish because of 'enhanced security algorithms'

Re: Near Real Time

I got an iPhone 13 mini a couple of weeks ago. The facial recognition is really fast and reliable. Whether I’m holding it, or using in a holder in the car. No complaints from me.

Slight Fanboi alert: I also have an iPad Pro with facial recognition. Far less reliable because I typically need to go out of my way to look in the right direction. With its much smaller angular diameter, look in the general direction of an iPhone and you’re going to be looking at the faceID scanner.

Google swats away £3bn Safari Workaround ad-tracking cookie lawsuit in Supreme Court victory

Don’t be evil

Just a thought.

Apple's anti-ad-tracking iPhone feature took a '$10bn' chunk out of social network revenues

Re: Apple tracking

Settings | Advertising | Personalise ads | Off

Zuckerberg wants to create a make-believe world in which you can hide from all the damage Facebook has done

I already live in a simulation. Thanks, but no thanks.

Your toy universe emulator will never be as good as the simulation we already inhabit. And ours runs as a proper virtualisation close to the metal.

But the Zuckerverse will have way way more advertising and whiney American accents.

So thanks, but no thanks.

Antitrust battle latest: Google, Facebook 'colluded' to smash Apple's privacy protections

When the Devil says “Don’t be evil”…

…you know he’s wearing a tricky mask.

Apple's Safari browser runs the risk of becoming the new Internet Explorer – holding the web back for everyone

iPhones are typically fully supported far more and more often than Android devices, including the rather important bits like the network stack / operating system that lets your browser do its thing.

Facebook may soon reveal new name – we're sure Reg readers will be more creative than Zuck's marketroids

ZuckZuckGo, surely.

Apple arms high-end MacBook Pro notebooks with M1 Pro, M1 Max processors

Re: Great but ...

Logic Pro X and Final Cut Pro X are killer apps for the Mac. Great capabilities at a *very* reasonable price, and no software rental involved. Always in the top 5 of paid apps on the App Store.

I find the Touch Bar to be reasonably useful. It's a snappy way to change the brightness and volume with a sliding finger. Or to quickly lock the machine. I don't use daft features like the words that auto-appear when I write.

When I earn my debugging crust switched and I'm switched into a Windows VM, the Touch Bar shows the regular function keys you'd expect of Windows. So that's pretty good.

Apple patches 'actively exploited' iPhone zero-day with iOS 15.0.2 update

Re: If it is similar to the last one

You'd need a juicy target for that approach to be worthwhile.

My understanding is that Pegasus is highly targeted at specific users.

Progress report: Asahi Linux brings forth a usable basic desktop on Apple's M1

Re: Looks interesting

I can think of one reason Apple might be against it; brand recognition. Just look at the efforts they go to on iGadgets to run Apple-approved apps.

Frankly I’m surprised Apple ever provided BootCamp on earlier Macs. And just as surprised that they don’t have the ARM Macs locked down hard to prevent any OS installation other than one signed by Apple.

2FA? More like 2F-in-the-way: It seems no one wants me to pay for their services after all

Re: To be fair

To be even fairer, I’ve only seen snippets of Seinfeld, and I was already at the point of chewing my leg off to go see something that was actually funny.

Maybe it’s a classic case of humour not travelling well. But I don’t blame myself.

One-size-fits-all chargers? What a great idea! Of course Apple would hate it

"The UK Government is not currently considering replicating this requirement"

Ha ha. Don't make me laugh. The UK government is now the tail being wagged by the much bigger EU. They will fall in line with whatever gets built for the EU market.

Re: Next move

Next iPhone to be an inch thick so that you can open it up and unfold the schematics ;-)

Re: Apple don't like it?

Your wife is yanking out the cable rather than using the strain relief. OK, she’s “holding it wrong”, but there you have it. Or she has a habit of repeatedly bending the cable. Some people are careless like that. My son, for example, sees no problem in picking up an open laptop be grabbing the corner of the screen. Makes me wince every time.

As for the connector itself, I’d be happy to see Lightning ditched in favour of USB-C. Unlike the EU’s former attempt to standardise on micro USB which, thankfully, went by the by. That truly is a rotten, fiddly, polarised connector. Good riddance.

SpaceX successfully sends four amateurs into orbit for three-day tour

Wow!

Really exciting stuff. That's proper space travel.

The glowing white hot engine was pretty impressive.

I go stir crazy after a 12 hour long haul flight, so God only knows how I'd fare stuck in that capsule for 3 days.

Question: was the crew put on a special diet for the past few days? I imagine the toilet facilities in there are rather limited.

Apple emergency patches fix zero-click iMessage bug used to inject NSO spyware

Re: What could go wrong with browser lock-in?

You could argue that letting any old browser rendering engine onto the iPhone would almost certainly lead to many more vulnerabilities. At least Apple WebKit vulnerabilities are addressed snappily.

This drag sail could prevent spacecraft from turning into long-term orbiting junk. We spoke to its inventors ahead of launch

Deorbit time

“At lower altitudes, deorbit could occur in days, while at higher altitudes it could take tens to hundreds of years”

I suspect that geostationary satellites, out at 36,000km, would stay up an awful lot longer than that. At that kind of altitude, space is an extremely hard vacuum.

Real world not giving you enough anxiety? Try being hunted down by the perfect organism in Alien: Isolation

I lived it for real

In my student days, not long after the release of Alien, I had a summer job doing night-shift security work in a Silvertown paint factory. Man, it was like the spitting image of the Nostromo interior in that place. Dark, pipes everywhere, blinking lights, claustrophobic corridors, cavernous rooms full of oily machinery, strange noises, an oddball technician doing experiments in a lab somewhere. On my hourly patrols, the Alien was on my mind most of the time. My nerves weren’t helped when, very occasionally, one of the few night workers would randomly appear out of nowhere. That job really scared me.

Apple's iPhone computer vision has the potential to preserve privacy but also break it completely

Re: Pear shaped

I can’t be arsed to read all their blurb again in detail. But I seem to recall that the review staff are said to be just there to confirm the accuracy of the reporting process itself. Reading between the lines, I read that as: if we suddenly get a massive uptick of autosnitching, someone with eyes will be there to hit the kill switch.

Microsoft emits last preview of .NET 6 and C# 10, but is C# becoming as complex as C++?

3 years

I don’t know what this 3 year cycle is all about. My trusty old .Net Framework system that gets 20M requests per day, was coded more than a decade ago. I’ve had to lather in newer versions of the framework but it still works fine. They’d better not pull the plug on 4.8 anytime soon, cos we don’t have the manpower to rewrite from scratch.

Apple responds to critics of CSAM scan plan with FAQs, says it'd block governments subverting its system

Re: No upside for Apple, so... draw your conclusions

I can't speak for America, but in the UK, if a phone manufacturer is compelled to introduce technical means to get at private information, said manufacturer would be committing an offence if they disclosed that order.

Thanks, Theresa May!

Apple is about to start scanning iPhone users' devices for banned content, professor warns

Re: Dream on......

'Tis not I who is dreaming. Various senior political figures in the US and UK want backdoors into secure protocols. They are, of course, engaging in magical thinking, as has often been pointed out on this site.