SAML seemed to do the job 20 years ago. Albeit with horrendous XML baggage.
176 publicly visible posts • joined 21 Feb 2017
Re: Aquired taste
How did their MSA signing key get “acquired”?
Yes, and more importantly, how will that be prevented in future? Microsoft seem to have reasonable measures in place to detect and assess the problem, as well as the processes to mitigate it, but prevention is better than cure.
How could they have such a fundamental vulnerability as allowing tokens signed by a key for a consumer service access their enterprise service (OWA)?
I think "consumer" in "consumer signing key" refers to a service that validates and uses (ie consumes) the token that was produced and then signed using that key, not "consumer" as in "consumer-grade".
Another important question is, given the key provided "access to email accounts affecting approximately 25 organizations including government agencies as well as related consumer accounts of individuals", what else could have been accessed with it? If a single compromised key allows access to email of more than one organisation, what are the chances it was limited to those?
Re: American cars are too heavy - solution blame electric cars
It's of course true cats have got bigger and, especially, heavier. Part of it is crash safety, part "mod cons" all adding up. EV batteries make the problem a double whammy.
The only real solutions are fewer cars and better drivers. So we're fucked.
Re: Serves Google right
Of course, email is not a reliable transport, and anyone who doesn't understand that is an idiot. It was never designed as such, however.
On the contrary, It was expressly designed to be reliable. A core principle is thot when an SMTP server accepts an email, it promises to deliver it to a mailbox or pass on that responsibility to another system, and notify the envelope sender if it can't do either.
Accepting email but neither delivering it nor notifying the sender - usually because it "looks like spam" - is the violation of the above that makes it unreliable. "Backscatter" favours not accepting email that will not be delivered (or forwarded).
(I didn't downvote, for the record.)
Re: Well, every little bit helps
upgraded from 'crippled slug' to 'drunken sloth'?
Pretty much my first thought. When it's so pathetically sluggish to start with there's plenty of scope for improvement.
The most amusing note to me was, "the Windows biz has apparently cut the latency involved with raising a hand by 16 percent."
(a) The UI latency of such an action being significant enough to consider measuring in the first place says there is a problem (network latency is unavoidable, but that should apply only for others to see a raised hand).
(b) IMHO the meaningful measurement is the time from beginning to act to raise your virtual hand until that action is completed. That increased manyfold when the UI was changed to move the button under "Reactions" and no technology improvement can ever recoup that.
"Expected product lifetime ... or five years"
The fact sheet gives an obligation of the expected lifetime or five years. Who decides that lifetime?
Also, it's "whichever is the shorter". It certainly seems ridiculous for a car manufacturer to have no requirement for what is in practice more than half the lifetime of a car.
While a car is probably the most extreme example, similar can probably be said for many products.
Re: Faster web sites
Yes and no. A site hosting its own fonts, JS libraries, etc means no need to connect to other servers, But you'll download common resources once for each site, instead of just once.
I'm not sure I understand the basis of the fine. If I host a site, visitors must reveal their IP address to those operating intermediate routers. The visitor has no control over this. That's OK, because there's no alternative? I can reference remote resources but only if hosted by a provider that assures me it won't use the IP addresses it sees, beyond what is necessary?
Re: A solution looking for a problem
Is Autopilot a level 5 system? No
Does that mean it’s inherently bad? No
In and of itself, the latter may be true. However, the combination of the former, the name and human nature seems very likely to result in something for which "inherently bad" seems an appropriate description. That result is what is important, and seems to be supported by evidence.
Another question is, can anything less than a level 5 system avoid that result? If not, does it not follow that as long as the answer to your first question is "no", the answer to your second question is "yes"?
It seems typical of the GNU mindset to think "Ah! But the user may be using a machine without function keys!" It's 2020.
Personally I find function keys just a little too far away from my fingers, and I can't find them without looking (but I guess that's at least partly because I don't use them much). So perhaps "machine without function keys" is not the reason, or at least not the only reason.
Re: Whats not to like ?
The catch is that NR makes a whole slew of optional and rarely used features in LTE-A mandatory. The big one IMHO is carrier aggregation, ...
Sounds like this is something that the software update doesn't need to enable: use of the feature is controlled by the network. That is, it's a problem if not supported by phones, which won't work if the network uses it.
Call it a hunch but from Suri's previous comments I suspect the approach is technically questionable (ie will not deliver various intended benefits of 5G), and has been pursued by Nokia for non-technical reasons.
Re: Yes please
Just... don't expect to be able to tell the difference in the price. After all, combined these two things together probably only cost a couple of quid at the volume Apple makes them...
Possibly more saving from reduced packaging and transporting more boxed phones per unit volume than the cost of the electronics.
Re: "There's no slave in git though"
Masters are the official finalized recordings from which copies are made. A Git master branch constantly updates, so it should be main or devel.
The "master" branch is analogous to a master copy in that it is (in many cases) the one from which copies are made (new branches). Of course, I can't deny the "finished" aspect breaks the analogy, but then there's no such thing as finished software :).
Also, some people seem to think that by changing the word from master to main (or blacklist to blocklist) it's a condemnation of those who previously used the terms. It's not.
Regardless of the motive for change, the problem is that there are some people who will see it as a reason to condemn those who previously used the terms.
Edit: the point of this being that you can't win.
An Internet of Trouble lies ahead as root certificates begin to expire en masse, warns security researcher
Re: What problem are the certificates solving?
iPlayer can ship with Public Key A
I think you're describing the same thing as I was trying to. I called it key0.
So it works as long as the first connection is within the expiry date of the initial download or pre-installation, and it's run often enough.
The same is true if you use certificates from a public CA, and embed the roots in the client with a way to update them (provided that's done in time).
It's the expiry that makes it functionally similar, even though the detail is different. The benefit you describe comes down to having control over expiry. You could equally get this with certificates by using a private CA, without the wheel reinvention: you just need to be able to specify which CA certificate you trust and have a way to update that certificate.
Re: What problem are the certificates solving?
So is the PKI there to perform some other function, or is it just being used because the code is there already so it's easier than finding a domain-specific solution?
Just because it's easier doesn't mean it's a bad thing: as with encryption, using existing code is generally a good thing for authenticating a server.
To answer your question in the title: I think the obvious answer is that certificates are intentionally providing a time limit to the trust, because eventually, the private key matching the public key in the root certificate will be discovered.
Say you wish to avoid PKI. On the face of it, embedding (say) an RSA public key in the client and validating signatures would work fine. But there would need to be some mechanism to periodically change the key, because eventually the private key will be discovered.
I think this could work safely through a chain (key0 used to sign key1, key1 used to sign key2 etc), but only if that chain is unbroken, which can't be guaranteed unless you trust key0 forever, which is a bad idea because eventually the private key will be discovered.
I can't see a way out of this...
Re: start using DANE and CA if you must
Doesn't this either just move the problem to DNSSEC, so you get the same issue due to https://www.icann.org/resources/pages/ksk-rollover, or (more likely) avoid it only because of absolute trust of wherever you get your DNS answers from? (Genuine question.)
Guess who came thiiis close to signing off a €102k annual budget? Austria. Someone omitted 'figures in millions'
It's not really about marketing (well OK, maybe a little bit.) Hard disk capacity used base 10 units once the average disk size got a little too big for conveniently using base 2 units, as they are a linear/serial storage medium which means a disk platter's capacity can be any number of bytes you like.
At the read/write head, hard drives are basically serial, but (for a long time) from the outside, they are random access devices addressed by sector. The capacity is actually any number of sectors you like. Sectors have a power-of-two size, as a natural consequence of the fact they are buffered in RAM. This may explain 1MB = 1,024,000 bytes being used for a while; this is the definition applicable to a "1.44MB" floppy disk.
Binary prefixes are a natural convention for memory chip sizes: they simplify expressing exact values because the chips have both a power-of-two addresses (a number of address lines) and a power-of-two data lines. Decimal prefixes are a natural convention for line rates: they simplify expressing exact values when, as is typical, a factor in the rate is a clock frequency defined with a decimal prefix.
The rationale for a convention is less clear-cut and often varies in other cases, such as hard drive sizes. This, I assume, led to kibibyte etc to disambiguate.
There's a new comet in town and you don't need a fancy multi-million-dollar telescope to see it. Just regular eyeballs
Re: I'd like to see it
I'm in the middle of Austin. We see no stars at all. Just the Moon, Venus, possibly Mars and maybe, just maybe Jupiter at times
"Possibly Jupiter and maybe, just maybe Mars at times" is more likely. Put another way, if you can ever see Mars, you will be able to see Jupiter regularly.
The maximum apparent brightness is basically the same, but Mars is more variable. I think the primary reason for this is that the orbit of Mars is more eccentric. An instructive diagram and more here.
Coronavirus didn't hurt UK broadband speeds in March. Call of Duty: Modern Warfare, on the other hand...
"Ofcom attributes the resiliency ... to their ability to scale with demand."
"Ofcom attributes the resiliency shown by broadband providers to their ability to scale with demand."
I'd have thought it's more down to daytime not being the normal peak for domestic ISPs; no need to scale (much) if capacity is already (mostly) there.
Fancy some post-weekend reading? How's this for a potboiler: The source code for UK, Australia's coronavirus contact-tracing apps
I am sceptical that it has to have location permissions granted to use bluetooth.
'Optional' is the new 'Full' in Windows 10: Microsoft mucks about with diagnostic slurpage levels for Fast Ring Insiders
Re: How can "Diagnostic Data Off" and "Required Diagnostic Data" coexist?
Or is this like saying if you go out for dinner tonight, it's required that you dress a certain way—but you can still choose to stay at home instead?
I think that's basically the logic. I can see some sense in the wording by reading it from Microsoft's perspective, but surely the wording should have been chosen for the users' perspective. For example, "required" is the minimum required for any useful diagnostics.
I think off/minimum/full would be the most clear (to the user) options for the implied result of the choice. Whether the actual result matches this (ie whether "off" really means "off", as you mentioned) is a different matter.
Amazon staffer based just a stone's throw away from Seattle HQ tests positive for COVID-19 coronavirus
Re: Doesn't check out
No, I don't think this virus is really as scary as people make it, the main problems are that it seems to spread easier and quicker than an influenza and that there is no vaccine.
Mortality seems to be comparable, so maybe we are overreacting a tad?
More infectious and no vaccine with the same mortality means more people dying, no?
Dual screens, fast updates, no registry cruft and security in mind: Microsoft gives devs the lowdown on Windows 10X
Is it a make-up mirror? Is it a tiny frisbee? No, it's the bonkers Cyrcle Phone, with its TWO headphone jacks
Re: On the plus side...
The snap had been shot by my wife on her smartphone (Ugh) so it was in 3:2 format (re-ugh). I took care to re-frame it properly and change it to the proper 4:3 format for photographs, only to have the millenial shopkeeper tell me that she'd have to crop it as it was not in a standard format.
"Proper photographs" - that is, on 35mm film - are 3:2 (https://en.m.wikipedia.org/wiki/135_film). Hence 6x4 (inch) prints.
Complete with keyboard and actual, literal, 'physical' escape key: Apple emits new 16" $2.4k+ MacBook Pro
Re: Finger Printing and The DMCA
If corporations can have a law that prevents circumvention of the what they do to protect their data (DMCA), then why can't we have one to prevent circumvention of tracking and privacy tools/controls that we use to protect our data?
That's a very clear way to put it, and I can't see a reasonable argument against it. Have an upvote.
Re: Why obsolete?
According to the totally reliable Wikipedia it was five times more expensive to operate than on road vehicles (disputed by the Communications Workers Union who said it was only three times as expensive).
Could be viewed as: road vehicles should be three/five times as expensive as they are...
Sudo? More like Su-doh: There's a fun bug that gives restricted sudoers root access (if your config is non-standard)
Re: As a ex sys-admin....
You should be able to assign administration accounts only the rights actually needed in a "JEA security" type model.
Err, that is literally exactly what sudo does (bugs aside). Its configuration says which users can do which things as which users. Such as "members of this (administrative) group may stop/start this service".
The NetCAT is out of the bag: Intel chipset exploited to sniff SSH passwords as they're typed over the network
Allowlist, not whitelist. Blocklist, not blacklist. Goodbye, wtf. Microsoft scans Chromium code, lops off offensive words
Re: This reminds me on Son May
Throatwarbler Mangrove: "... fundamentally, it's hard to work up the same level of outrage about "software piracy" as it is to do so about stealing food."
This, along with some other things you wrote, did make me wonder about any differences in society's views of "piracy" between software, music and video.
I think, of the three, music may be seen as more "personal" as opposed to "corporate" and therefore somehow closer to stealing food, although I have no basis for that.
Re: "Which hasn't struck me as particularly advanced either"
And mixing passenger and goods traffic on the same lines is much more common. Which makes for a lot of specific rules in the signalling logic if you don't want to treat every train as the slowest heaviest goods train that line might carry.
Can you elaborate? It looks to me in the UK like passenger trains may have a higher speed limit, presumably if their braking is good enough, with the default limit presumably being for the heaviest goods train (both presumably for trains with the worst brakes in the worst conditions, plus margin). No need for special signalling logic in this case.
Mixed speed traffic is very obviously a headache for timetabling though, same as stopping vs non-stop passenger trains of the same type.
Re: Help with "Innovative Solutions"
"Surely what matters with such cameras is what they do with the information."
Absolutely, but in general people seem to trust what computers say more than I think they should.
Yes, facial recognition may have prevented the tragedy in Stockwell, but the concern due to the above is how to ensure it doesn't end up causing more such tragedies because "computer says he's armed and dangerous".
Unfortunately, I fear the answer will come too late for some, but research like that reported here offers some hope that fear will not be realised.
Re: Dates? Don't talk to me about dates...
... "Oh, it's ok", they eventually exclaimed. "We'll just delete any double-quotes from each line before we process it. And as we asked, you're sending the file with pipe delimiters, so we don't need to worry about escaping commas".
This story resonates with my own experience. Things like this seem to be increasingly common. I've gone past getting mad, now it just makes me sad...
Oblivious 'influencers' work on 3.6-roentgen tans in Chernobyl after realising TV show based on real nuclear TITSUP
All of the MFA implementations I've seen so far are much less convenient than passwords and/or require information disclosure to unsavory companies.
All security is a trade-off with convenience. (Wouldn't it be more convenient if you just had your user name, with no password to remember?)
From a convenience/handing over data perspective, I've used:
- Mobile app notification: minimal inconvenience, who knows about data (though not an inherent issue)
- Phone call: slightly more inconvenient than an app for most, but you need to hand over your telephone number.
- SMS OTP: probably slightly more inconvenient than a phone call in most cases; again, you need to hand over your number.
- TOTP/HOTP and similar (RSA SecurID springs to mind): like SMS OTP except no data.
The only other option I'm aware of (am I missing any?), and looks very interesting to me, is U2F. This keeps the "no data" aspect of TOTP etc, while reducing inconvenience to be similar to a mobile app. From a security perspective, it also allows a lot of potential weaknesses affecting the above to be avoided.
Bad news from science land: Fast-charging li-ion batteries may be quick to top up, but they're also quick to die
It's worth noting that the average reader of the Register would probably enjoy a visit to the Diamond Light Source
I have been there, and concur. An astonishing amount of infrastructure around the (comparatively small) storage ring, yet minute compared to (eg) the LHC... (I know DLS and LHC have other differences apart from size.)