Posts by really_adf

Google Chrome coders really, truly, absolutely ready to cull third-party cookies from 2024

SAML seemed to do the job 20 years ago. Albeit with horrendous XML baggage.

Microsoft admits unauthorized access to Exchange Online, blames Chinese gang

Re: Aquired taste

How did their MSA signing key get “acquired”?

Yes, and more importantly, how will that be prevented in future? Microsoft seem to have reasonable measures in place to detect and assess the problem, as well as the processes to mitigate it, but prevention is better than cure.

How could they have such a fundamental vulnerability as allowing tokens signed by a key for a consumer service access their enterprise service (OWA)?

I think "consumer" in "consumer signing key" refers to a service that validates and uses (ie consumes) the token that was produced and then signed using that key, not "consumer" as in "consumer-grade".

Another important question is, given the key provided "access to email accounts affecting approximately 25 organizations including government agencies as well as related consumer accounts of individuals", what else could have been accessed with it? If a single compromised key allows access to email of more than one organisation, what are the chances it was limited to those?

Cisco kindly reveals proof of concept attacks for flaws in rival Netgear's kit

Re: ummm?

I think you're thinking of Linksys, bought in 2003 by Cisco and sold in 2013 to Belkin (according to Wikipedia).

Fat EVs may cause 'more death on our roads' – watchdog

Re: American cars are too heavy - solution blame electric cars

It's of course true cats have got bigger and, especially, heavier. Part of it is crash safety, part "mod cons" all adding up. EV batteries make the problem a double whammy.

The only real solutions are fewer cars and better drivers. So we're fucked.

Too big to live, too loved to die: Big Tech's billion dollar curse of the free

Re: Serves Google right

Of course, email is not a reliable transport, and anyone who doesn't understand that is an idiot. It was never designed as such, however.

On the contrary, It was expressly designed to be reliable. A core principle is thot when an SMTP server accepts an email, it promises to deliver it to a mailbox or pass on that responsibility to another system, and notify the envelope sender if it can't do either.

Accepting email but neither delivering it nor notifying the sender - usually because it "looks like spam" - is the violation of the above that makes it unreliable. "Backscatter" favours not accepting email that will not be delivered (or forwarded).

(I didn't downvote, for the record.)

Microsoft feels the need, the need for speed in Teams

Re: Well, every little bit helps

upgraded from 'crippled slug' to 'drunken sloth'?

Pretty much my first thought. When it's so pathetically sluggish to start with there's plenty of scope for improvement.

The most amusing note to me was, "the Windows biz has apparently cut the latency involved with raising a hand by 16 percent."

(a) The UI latency of such an action being significant enough to consider measuring in the first place says there is a problem (network latency is unavoidable, but that should apply only for others to see a raised hand).

(b) IMHO the meaningful measurement is the time from beginning to act to raise your virtual hand until that action is completed. That increased manyfold when the UI was changed to move the button under "Reactions" and no technology improvement can ever recoup that.

EU puts smart device manufacturers on the hook for cyber security

"Expected product lifetime ... or five years"

The fact sheet gives an obligation of the expected lifetime or five years. Who decides that lifetime?

Also, it's "whichever is the shorter". It certainly seems ridiculous for a car manufacturer to have no requirement for what is in practice more than half the lifetime of a car.

While a car is probably the most extreme example, similar can probably be said for many products.

Interconnect innovation key to satiating soaring demand for fiber capacity

Why AI/ML?

Symbol rates, power levels, FEC parameters etc have long been managed to optimise links without any AI/ML, so what does that bring to the party?

Tech world may face huge fines if it doesn't scrub CSAM from encrypted chats

Re: Will it happen?

No sensible Prime Minister would appoint [Nadine Dorries] to a cabinet position.

I'm not sure that answers the question of whether it will happen.

Website fined by German court for leaking visitor's IP address via Google Fonts

Re: Faster web sites

Yes and no. A site hosting its own fonts, JS libraries, etc means no need to connect to other servers, But you'll download common resources once for each site, instead of just once.

I'm not sure I understand the basis of the fine. If I host a site, visitors must reveal their IP address to those operating intermediate routers. The visitor has no control over this. That's OK, because there's no alternative? I can reference remote resources but only if hosted by a provider that assures me it won't use the IP addresses it sees, beyond what is necessary?

US watchdog opens probe into Tesla's Autopilot driver assist system after spate of crashes

Re: A solution looking for a problem

Is Autopilot a level 5 system? No

Does that mean it’s inherently bad? No

In and of itself, the latter may be true. However, the combination of the former, the name and human nature seems very likely to result in something for which "inherently bad" seems an appropriate description. That result is what is important, and seems to be supported by evidence.

Another question is, can anything less than a level 5 system avoid that result? If not, does it not follow that as long as the answer to your first question is "no", the answer to your second question is "yes"?

Adobe yanks freebie Creative Cloud offer – now universities and colleges have to put up or shut up

Nowadays, if you asked someone to name a vacuum cleaner brand they'd probably say Dyson.

If you ask people to name a hoover brand, I think more would say Dyson than Hoover.

Venerable text editor GNU Nano reaches version 5.0 and adds the modern frippery that is scrollbars

It seems typical of the GNU mindset to think "Ah! But the user may be using a machine without function keys!" It's 2020.

Personally I find function keys just a little too far away from my fingers, and I can't find them without looking (but I guess that's at least partly because I don't use them much). So perhaps "machine without function keys" is not the reason, or at least not the only reason.

With a wave of Nokia's wand, behold as your 4G network magically becomes... 5G

Re: Whats not to like ?

The catch is that NR makes a whole slew of optional and rarely used features in LTE-A mandatory. The big one IMHO is carrier aggregation, ...

Sounds like this is something that the software update doesn't need to enable: use of the feature is controlled by the network. That is, it's a problem if not supported by phones, which won't work if the network uses it.

Call it a hunch but from Suri's previous comments I suspect the approach is technically questionable (ie will not deliver various intended benefits of 5G), and has been pursued by Nokia for non-technical reasons.

Apple said to be removing charger, headphones from upcoming iPhone 12 series

Re: Yes please

Just... don't expect to be able to tell the difference in the price. After all, combined these two things together probably only cost a couple of quid at the volume Apple makes them...

Possibly more saving from reduced packaging and transporting more boxed phones per unit volume than the cost of the electronics.

GitHub to replace master with main across its services

Re: "There's no slave in git though"

Masters are the official finalized recordings from which copies are made. A Git master branch constantly updates, so it should be main or devel.

The "master" branch is analogous to a master copy in that it is (in many cases) the one from which copies are made (new branches). Of course, I can't deny the "finished" aspect breaks the analogy, but then there's no such thing as finished software :).

Also, some people seem to think that by changing the word from master to main (or blacklist to blocklist) it's a condemnation of those who previously used the terms. It's not.

Regardless of the motive for change, the problem is that there are some people who will see it as a reason to condemn those who previously used the terms.

Edit: the point of this being that you can't win.

An Internet of Trouble lies ahead as root certificates begin to expire en masse, warns security researcher

Re: What problem are the certificates solving?

iPlayer can ship with Public Key A

I think you're describing the same thing as I was trying to. I called it key0.

So it works as long as the first connection is within the expiry date of the initial download or pre-installation, and it's run often enough.

The same is true if you use certificates from a public CA, and embed the roots in the client with a way to update them (provided that's done in time).

It's the expiry that makes it functionally similar, even though the detail is different. The benefit you describe comes down to having control over expiry. You could equally get this with certificates by using a private CA, without the wheel reinvention: you just need to be able to specify which CA certificate you trust and have a way to update that certificate.

Re: What problem are the certificates solving?

So is the PKI there to perform some other function, or is it just being used because the code is there already so it's easier than finding a domain-specific solution?

Just because it's easier doesn't mean it's a bad thing: as with encryption, using existing code is generally a good thing for authenticating a server.

To answer your question in the title: I think the obvious answer is that certificates are intentionally providing a time limit to the trust, because eventually, the private key matching the public key in the root certificate will be discovered.

Say you wish to avoid PKI. On the face of it, embedding (say) an RSA public key in the client and validating signatures would work fine. But there would need to be some mechanism to periodically change the key, because eventually the private key will be discovered.

I think this could work safely through a chain (key0 used to sign key1, key1 used to sign key2 etc), but only if that chain is unbroken, which can't be guaranteed unless you trust key0 forever, which is a bad idea because eventually the private key will be discovered.

I can't see a way out of this...

Re: start using DANE and CA if you must

https://tools.ietf.org/html/rfc7671

Doesn't this either just move the problem to DNSSEC, so you get the same issue due to https://www.icann.org/resources/pages/ksk-rollover, or (more likely) avoid it only because of absolute trust of wherever you get your DNS answers from? (Genuine question.)

Guess who came thiiis close to signing off a €102k annual budget? Austria. Someone omitted 'figures in millions'

It's not really about marketing (well OK, maybe a little bit.) Hard disk capacity used base 10 units once the average disk size got a little too big for conveniently using base 2 units, as they are a linear/serial storage medium which means a disk platter's capacity can be any number of bytes you like.

At the read/write head, hard drives are basically serial, but (for a long time) from the outside, they are random access devices addressed by sector. The capacity is actually any number of sectors you like. Sectors have a power-of-two size, as a natural consequence of the fact they are buffered in RAM. This may explain 1MB = 1,024,000 bytes being used for a while; this is the definition applicable to a "1.44MB" floppy disk.

Binary prefixes are a natural convention for memory chip sizes: they simplify expressing exact values because the chips have both a power-of-two addresses (a number of address lines) and a power-of-two data lines. Decimal prefixes are a natural convention for line rates: they simplify expressing exact values when, as is typical, a factor in the rate is a clock frequency defined with a decimal prefix.

The rationale for a convention is less clear-cut and often varies in other cases, such as hard drive sizes. This, I assume, led to kibibyte etc to disambiguate.

There's a new comet in town and you don't need a fancy multi-million-dollar telescope to see it. Just regular eyeballs

Re: I'd like to see it

I'm in the middle of Austin. We see no stars at all. Just the Moon, Venus, possibly Mars and maybe, just maybe Jupiter at times

"Possibly Jupiter and maybe, just maybe Mars at times" is more likely. Put another way, if you can ever see Mars, you will be able to see Jupiter regularly.

The maximum apparent brightness is basically the same, but Mars is more variable. I think the primary reason for this is that the orbit of Mars is more eccentric. An instructive diagram and more here.

Coronavirus didn't hurt UK broadband speeds in March. Call of Duty: Modern Warfare, on the other hand...

"Ofcom attributes the resiliency ... to their ability to scale with demand."

"Ofcom attributes the resiliency shown by broadband providers to their ability to scale with demand."

I'd have thought it's more down to daytime not being the normal peak for domestic ISPs; no need to scale (much) if capacity is already (mostly) there.

Fancy some post-weekend reading? How's this for a potboiler: The source code for UK, Australia's coronavirus contact-tracing apps

I am sceptical that it has to have location permissions granted to use bluetooth.

https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions

'Optional' is the new 'Full' in Windows 10: Microsoft mucks about with diagnostic slurpage levels for Fast Ring Insiders

Re: How can "Diagnostic Data Off" and "Required Diagnostic Data" coexist?

Or is this like saying if you go out for dinner tonight, it's required that you dress a certain way—but you can still choose to stay at home instead?

I think that's basically the logic. I can see some sense in the wording by reading it from Microsoft's perspective, but surely the wording should have been chosen for the users' perspective. For example, "required" is the minimum required for any useful diagnostics.

I think off/minimum/full would be the most clear (to the user) options for the implied result of the choice. Whether the actual result matches this (ie whether "off" really means "off", as you mentioned) is a different matter.

Amazon staffer based just a stone's throw away from Seattle HQ tests positive for COVID-19 coronavirus

Re: Doesn't check out

No, I don't think this virus is really as scary as people make it, the main problems are that it seems to spread easier and quicker than an influenza and that there is no vaccine.

...

Mortality seems to be comparable, so maybe we are overreacting a tad?

More infectious and no vaccine with the same mortality means more people dying, no?

Dual screens, fast updates, no registry cruft and security in mind: Microsoft gives devs the lowdown on Windows 10X

Microsoft; you need to learn what legacy means before you can even think about improving Windows.

I think Microsoft know full well what legacy means, this is just the (wishful) thinking of one part of the organisation that is at odds with other parts, those being more in touch with reality.

Is it a make-up mirror? Is it a tiny frisbee? No, it's the bonkers Cyrcle Phone, with its TWO headphone jacks

Re: On the plus side...

The snap had been shot by my wife on her smartphone (Ugh) so it was in 3:2 format (re-ugh). I took care to re-frame it properly and change it to the proper 4:3 format for photographs, only to have the millenial shopkeeper tell me that she'd have to crop it as it was not in a standard format.

"Proper photographs" - that is, on 35mm film - are 3:2 (https://en.m.wikipedia.org/wiki/135_film). Hence 6x4 (inch) prints.

Who loves Brexit? Irish distributors ... after their sales jump by a third

Re: Insurance

It’s very rare insurance predictions are wrong.

Natural selection: insurance companies making bad predictions die?

Physicists are rather giddy after creating a rare type of laser using laughing gas

Re: Radar

Much more than twice the range, surely: reflection won't be perfect, and a "useful" return signal will be stronger than the minimum detectable.

Complete with keyboard and actual, literal, 'physical' escape key: Apple emits new 16" $2.4k+ MacBook Pro

Re: Selective deafness

Most people who buy a computer (laptop or desktop) for work don't care so much about looks.

I'm not sure about "most"; I think it depends on whether you want to actually do work on it or because you are a superficial twat, eg many in sales, marketing and management.

Google warns devs as it tightens Chrome cookie security: Stuff will break if you're not clued up

Re: Finger Printing and The DMCA

If corporations can have a law that prevents circumvention of the what they do to protect their data (DMCA), then why can't we have one to prevent circumvention of tracking and privacy tools/controls that we use to protect our data?

That's a very clear way to put it, and I can't see a reasonable argument against it. Have an upvote.

We read the Brexit copyright notices so you don't have to… No more IP freely, ta very much

So that’s the end of cross-EU mobile roaming, then. Why would companies pay for this when they can pass the costs on to the customer?

The obvious answer is because none of them want to be the first company to start charging for EU roaming.

We're going deeper Underground: Vulture clicks claws over London's hidden tracks

Re: Why obsolete?

According to the totally reliable Wikipedia it was five times more expensive to operate than on road vehicles (disputed by the Communications Workers Union who said it was only three times as expensive).

Could be viewed as: road vehicles should be three/five times as expensive as they are...

Sudo? More like Su-doh: There's a fun bug that gives restricted sudoers root access (if your config is non-standard)

Re: As a ex sys-admin....

You should be able to assign administration accounts only the rights actually needed in a "JEA security" type model.

Err, that is literally exactly what sudo does (bugs aside). Its configuration says which users can do which things as which users. Such as "members of this (administrative) group may stop/start this service".

The NetCAT is out of the bag: Intel chipset exploited to sniff SSH passwords as they're typed over the network

Why is SSH (as a protocol) singled out here?

Because it's by far the most likely way to access a machine with an application warranting the vulnerable infrastructure requirements?

Cu in Hell: Thousands internetless after copper thieves pinch 500m of cable in Cambridgeshire

Re: A simple (but costly) answer

If 1km is worth 20k

At a guess: it's not 500m of cable = £10k, but a 500m stretch of (say) 10x 100-cable bundles = 500km of cable = £10k.

Allowlist, not whitelist. Blocklist, not blacklist. Goodbye, wtf. Microsoft scans Chromium code, lops off offensive words

Re: This is stupid

I'm surprised not to have seen mention of Android's Log.wtf(), "Report a condition that should never happen."

They say piracy killed the Amiga. Know what else piracy is killing? Malware sales

Re: This reminds me on Son May

Throatwarbler Mangrove: "... fundamentally, it's hard to work up the same level of outrage about "software piracy" as it is to do so about stealing food."

This, along with some other things you wrote, did make me wonder about any differences in society's views of "piracy" between software, music and video.

I think, of the three, music may be seen as more "personal" as opposed to "corporate" and therefore somehow closer to stealing food, although I have no basis for that.

It's so hot, UK needs to start naming heatwaves like we do when it's a bit windy – climate boffins

Re: Shameless plug.

Downstairs is a bit more difficult

Huh?

Scientist, war hero and gay icon Alan Turing is new face of the £50 note

I think I've only had one or two fifty quid notes in my possession ever

Same. Not so surprising when the current note was introduced, but seems strange when the inflation-adjusted value of a (rare) £50 note now must be similar to a (common) £20 note then.

Train maker's coder goes loco, choo-choo-chooses to flee to China with top-secret code – allegedly

Re: "Which hasn't struck me as particularly advanced either"

And mixing passenger and goods traffic on the same lines is much more common. Which makes for a lot of specific rules in the signalling logic if you don't want to treat every train as the slowest heaviest goods train that line might carry.

Can you elaborate? It looks to me in the UK like passenger trains may have a higher speed limit, presumably if their braking is good enough, with the default limit presumably being for the heaviest goods train (both presumably for trains with the worst brakes in the worst conditions, plus margin). No need for special signalling logic in this case.

Mixed speed traffic is very obviously a headache for timetabling though, same as stopping vs non-stop passenger trains of the same type.

Metropolitan Police's facial recognition tech not only crap, but also of dubious legality – report

Re: Help with "Innovative Solutions"

"Surely what matters with such cameras is what they do with the information."

Absolutely, but in general people seem to trust what computers say more than I think they should.

Yes, facial recognition may have prevented the tragedy in Stockwell, but the concern due to the above is how to ensure it doesn't end up causing more such tragedies because "computer says he's armed and dangerous".

Unfortunately, I fear the answer will come too late for some, but research like that reported here offers some hope that fear will not be realised.

Mmm, instant Java: Visual Studio Code 1.36 brings tasty updates – unless you run 32-bit Linux

Indent guides

"Indent guides, vertical lines which connect items of equal indentation, are now optionally available in tree views such as those in the File Explorer."

So, more like they used to be (on Windows at least)? Maybe those GUI designers of yesteryear had a point after all...

The Eldritch Horror of Date Formatting is visited upon Tesco

Re: Dates? Don't talk to me about dates...

... "Oh, it's ok", they eventually exclaimed. "We'll just delete any double-quotes from each line before we process it. And as we asked, you're sending the file with pipe delimiters, so we don't need to worry about escaping commas".

This story resonates with my own experience. Things like this seem to be increasingly common. I've gone past getting mad, now it just makes me sad...

Oblivious 'influencers' work on 3.6-roentgen tans in Chernobyl after realising TV show based on real nuclear TITSUP

Re: iPhone?

Q. How do you know if somebody is a vegan.

A. They tell everyone.

Better, I think:

A. Don't worry, they'll tell you.

Have I Been S0ld? Troy Hunt's security website is up for acquisition

Re: MFA

All of the MFA implementations I've seen so far are much less convenient than passwords and/or require information disclosure to unsavory companies.

All security is a trade-off with convenience. (Wouldn't it be more convenient if you just had your user name, with no password to remember?)

From a convenience/handing over data perspective, I've used:

- Mobile app notification: minimal inconvenience, who knows about data (though not an inherent issue)

- Phone call: slightly more inconvenient than an app for most, but you need to hand over your telephone number.

- SMS OTP: probably slightly more inconvenient than a phone call in most cases; again, you need to hand over your number.

- TOTP/HOTP and similar (RSA SecurID springs to mind): like SMS OTP except no data.

The only other option I'm aware of (am I missing any?), and looks very interesting to me, is U2F. This keeps the "no data" aspect of TOTP etc, while reducing inconvenience to be similar to a mobile app. From a security perspective, it also allows a lot of potential weaknesses affecting the above to be avoided.

Amazon Alexa: 'Pre-wakeword' patent application suggests plans to process more of your speech

Re: How is this patentable?

I really hope the buffering isn't patentable. The technique for identifying the start of the sentence containing the wakeword could be novel.

Bad news from science land: Fast-charging li-ion batteries may be quick to top up, but they're also quick to die

Re: Scanning...

It's worth noting that the average reader of the Register would probably enjoy a visit to the Diamond Light Source

I have been there, and concur. An astonishing amount of infrastructure around the (comparatively small) storage ring, yet minute compared to (eg) the LHC... (I know DLS and LHC have other differences apart from size.)