Posts by vtcodger

California cracks down on Internet of Crap passwords with new law to stop the botnets

Given that your IOT connected toothbrush likely has a rather limited UI -- one button -- entering a password may be challenging. Changing that password, even more challenging.

Re: Where's the master list of passwords kept ?

Password is the same as the serial number.

Bet on it.

Microsoft gets ready to kill Skype Classic once again: 'This time we mean it'

"It's easy to blame GDPR. What next? Blame Brexit?"

What the hell, blame any one of Hillary Clinton, Fake News, Iran, Russia, millenials ... your choice.

Why are sat-nav walking directions always so hopeless?

Re: Too many apps

Those of us who live elsewhere usually use the sun as a reference. But I suppose you work with what you have. I take it that in England, that's the wind.

US JEDI military cloud network is so high-tech, bidders will have to submit their proposals by hand, on DVD

Rules and Regulations

It's been many decades since I worked on a US government proposal. But back in the day, even the most modest proposal had to be delivered in physical form to a specific place by a specific time. If any portion was classified it would have had to be handled according to appropriate rules -- double wrapped, properly marked on the inner wrapper, delivered by hand or registered mail, hand receipted so that a security audit of the submitter could establish where the numbered copy went. And it would have had to be accompanied by half an inch of properly completed forms attesting that if granted the contract the submitter would fully comply with thousands of health, safety, workplace policy regulations; wouldn't discriminate in employment, wouldn't pollute the environment, would use no product produced in Cuba or North Korea, etc,etc,etc.

DVD sounds to me like a step forward.

Amazon Alexa outage: Voice-activated devices are down in UK and beyond

Alexa deserves a break

My God. Can't the poor, overworked woman take a few hours off now and then? Maybe we could arrange for Alexa to work a 164 hour week. And bring Clippy in for four hours on Sunday afternoons.

Cookie clutter: Chrome saves Google cookies from cookie jar purges

"Do they think...?"

Most likely thing is that they don't think at all. I would guess that every personal computing device at Google is permanently logged into a wide variety of Google services. It'd be aggravating if they had to log back in constantly, so they don't clear their own cookies. The notion that folks outside of Google might not want to be logged into all that stuff permanently probably never crosses their minds. That's the way large organizations tend to work.

"Why do people still use Chrome?"

Because some websites won't work right with other browsers? I don't use chrome myself, and put up with a lot of websites not working very well although I do use a lot more profanity than I used to. My perception is that between security issues, javascript, vendor misbehavior, government misbehavior, and miscellaneous lunacy, the Internet is rather closer to total chaos than most folks realize. But maybe I'm wrong. I am sometime.

Some credential-stuffing botnets don't care about being noticed any more

Re: Maybe just

Look folks. I really don't care about securing my password for Slashdot, The Register, or a multitude of other non-financial sites. Neither do many (I suspect most) other users. The password/account logic is imposed by the sites for their convenience, not mine. For them I reuse the same password within the limits of obscure and often conflicting length and content rules So does my wife, my kids, and (I suspect) damn near everyone.

Fifty plus years of computer work tell me that attempting to educate users or to force them to do things your way is pretty much a complete waste of time. I really believe that "crap" and reused passwords are part of the universe we live in. They aren't going away.

User authentication is a huge problem. It's a problem that will, I think, quite likely eventually limit the utility of the Internet. Basically, the problem is that a website that is actually secure -- for example the US treasurydirect.gov -- is going to be horribly difficult to access and is likely to have other problems as when multiple individuals need to access an account.

Do I have an answer? Nope. If I did, I'd be working on a business plan, not posting here.

But I do think you folks should recognize that passwords don't work very well and, as far as I can see, probably can never be made to work much better than they do now.

(Interestingly, one organization that I actually need to interface with has a website that is perpetually broken in one way or another, but has something I'd thought to be unlikely -- an automated phone system that actually works. FWIW, It authenticates me by date of birth and postal code. Not great from a security point of view, but not awful, and better, considering the medium and all, than passwords).

Fallover Friday: NatWest, RBS and Ulster Bank go TITSUP*

Re: Its really not that difficult.

Sadly, even very simple, clearly defined, systems can be quite difficult to understand. Check out this example. https://en.wikipedia.org/wiki/Feynman_sprinkler Large collections of digital logic are rarely either simple or clearly defined,

You're alone in a room with the Windows 10 out-of-the-box apps. What do you do?

"You're alone in a room with the Windows 10 out-of-the-box apps. What do you do?"

Find the host/hostess, mumble something about lovely party, but you have a prior commitment, and leave?

Buried in the hype, one little detail: Amazon's Alexa-on-a-chip could steal smart home market

Re: I would refuse to buy ANYTHING with built in Alexa

"I'm sure nothing bad would happen if someone was able to hack into my microwave and make it turn on and stay on with nothing in it."

Well, I CAN attest that there was a thermal fuse in ours that blew after the potato that I'd intended to cook for 6 minutes was about 15 minutes into its conversion to charcoal. (Extra zero on the cook time.) But the oven was really never quite the same even after I replaced the fuse.

Scottish brewery recovers from ransomware attack

Re: offsite backup

All really good advice. But be aware that, as with many other things, what's simple in concept may not be so simple in practice. For example, it'd take a good part of a week to stash a copy of my PC hard drive to the "cloud" over my suburban US DSL line. And I don't have any video data. Folks (including businesses) in neighboring towns have even slower connections BTW. Moreover, tying up the home data pipe with a massive, days long, upload is likely to annoy the other folks that reside here. Therefore my home system offsite backup is on a usb stick in the spare tire well of my car. THAT only takes about five hours to build

One very likely wants to encrypt offsite data. Easy enough, if one does something like tar-compress-encrypt on high level directories. Why tar? Because I really don't want to deal with data recovery from a file system with tens of thousands of files with obsfucated names. Rsync isn't going to work very well. Solvable? Yes, I think. I haven't actually tried to integrate rsync into the workflow. Easy? Not so much I'm pretty sure.

Re: Customer caught

Also, an offsite backup wouldn't be a bad idea. Buildings do burn down or washed away. Offsite backup is likely to be a PITA to do, so it may only get done weekly or monthly. But losing only a few weeks worth of data will probably look like a blessing when confronted with the loss of all the configuration information and data that the company owned other than what can be recovered from surviving scraps of paper and a random selection of files and eMails from personal machines.

Fat chance: Cholesterol leads boffins to discover world's oldest animal fossil – 558m years old

Re: Just one thing I don't understand...

"how the hell did he know where to look?"

Typically, one would look at the talus as the base of the cliff for clues as to what sort of fossils (if any) are exposed in the cliff. If something promising is found, one would try to figure out which layer it came from. In this case, I'd guess they found nicely preserved Ediacarian fossils, or fragments thereof at the base of the cliff, figured out which exposed bed was the source, then rappelled down the cliff to mine fresh, unweathered material. That's only a guess.

Paleontology can be a rigorous and perhaps at times somewhat dangerous avocation.

HP Ink should cough up $1.5m for bricking printers using unofficial cartridges – lawsuit

Re: My printer

My God man. Who told you our secret ink formula? You can expect to be hearing from our attorneys.

30-up: You know what? Those really weren't the days

Re: Yellow and blue

Actually, we old timers punched cards. ... Fade to scene of a dozen gaijin and Japanese programmers frantically moving hundreds of boxes of punched cards from computer room floor to tables as typhoon driven floodwaters slowly infiltrate computer center. Yes, that happened.

MY thanks to Ms Stob

I'd like to thank Ms Stob for making me realize that I've been avoiding drag and drop for three decades. Didn't like it in 1988 and don't like it now. I have no idea why.

And I'd also like to thank her for letting me know that I'm not the only one who finds git to be baffling. Not that I think get is bad or evil. I just don't grok it. Fortuitously RCS is sufficient for my needs.

Flying to Mars will be so rad, dude: Year-long trip may dump 60% lifetime dose of radiation on you

Re: Radiation

Radiation is far from the only problem. I think provisioning a trip that takes many months with no hope of resupply may be a far greater issue. Back in the days of exploration, ships carried some hand tools, nails, rope, canvas, metal parts, and figured they could find food, water and wood for repairs along the way and make/improvise anything they needed. They didn't always come home.

An interplanetary vessel is going to include huge quantities of sophisticated electronics, composite materials, etc, etc, etc. Fixing anything that breaks en route is likely to be a major challenge. And due to the complexity of providing food, air, and water to the astronauts, there is going to be lots that might need fixing. A one or two year trip to Mars is going to be a far more complex task than a quick round trip to the Moon.

Microsoft: Like the Borg, we want to absorb all the world's biz computers

Re: I have just one question

Perhaps I'm misreading it, but I think the vision is that you send Microsoft a (whopping great) check every month and every three years or so a bunch of big boxes shows up on your doorstep. You open them, take the computers therein to your desks/counters/workstations, unplug the old computer, plug the new one in (along with the network, keyboard, mouse) and turn the power on. In a week or three, a truck shows up to collect the boxes that now contain your old computers and carts them off to Niceragua where they are given away to schools. Microsoft handles ALL the details for you.

Perhaps I misunderstand.

Re: Testing

"And how exactly would the customers applications be tested to ensure that the patches work before they nuke the entire organisation ?"

I don't think this is targeted at users who have significant local applications. The target audience is probably businesses that have relatively simple needs that can be met by Windows, Office and maybe a select few business tools from associated vendors who work hand in glove with Microsoft.

**I** wouldn't touch this unless and until it's been in place for about a decade and has a vast numbers of actual, satisfied users. I don't expect it to play out that way because it requires MSFT to do a really difficult job really well. They aren't stupid, but I doubt they are smart enough to make this work. I doubt anyone is smart enough to make it work.

NUUO, do not want! CCTV webcams can be hacked to spy on you

Re: CCTV?

While someone might buy CCTV cameras to monitor day to day activity -- to detect shoplifting for example -- they might also buy them to monitor for vandalism, theft, etc when no one is around. That implies sending the signal to somebody who will watch for suspicious activity in the wee hours of the morning. Some of these things are probably going to be on the internet. Conceptually, there should be a properly configured firewall between the camera and a bored hacker in Budapest. But in practice a lot of them won't have firewalls at all, and some that do will have misconfigured firewalls.

What to do about that situation ... I haven't the slightest. And neither, really, does anyone else.

Microsoft pulls plug on IPv6-only Wi-Fi network over borked VPN fears

Re: Why do we need IPv6

"But do you really think we should have left our grandchildren with a network limited to 4 billion addresses"

Actually, given the current state of communications security, that's exactly what I think. I do NOT want to spend my life defanging badly designed household utensils that probably shouldn't have a network interface in the first place. It's apparently only a matter of time before my can openers won't open cans if they aren't connected to a network. IPv4 at least makes it hard for them to call their maker and very hard for their maker to cold call them. I think that's good, not bad.

I also think that communications security is an enormously difficult problem. The current "solutions" are laughable. AFAICS, they mostly just randomly break stuff. I do not expect security to improve very quickly.

I will give you that the IPv4 addresses are poorly allocated and I'd support a well thought out and realistically implemented program of yanking back portions of the overly generous initial block allocations and making them available to latecomers.

"Really? I never heard of 'Lasse Haugen' before. Why should I, or anyone else, give a damn about his opinion?"

Indeed, I'm getting on in years and my memory is not what it once was, but I really can't recall when it was that I asked Mr Haugen for advice about how to configure my computer. Or advice on anything else for that matter.

Two questions if I may

"And yes, yes, yes, before you point it out, The Register is still not IPv6 compatible either. We're working on it. Really. "

1. Why are you working on it? What benefit(s) do you expect?

2. If IPv6 is such an easy, natural option, what's preventing the Register from rolling it out tomorrow?

Leeds hospital launches campaign to 'axe the fax'

Re: @vtcodger

You're correct, it's twisted pair all the way to the house. I know because the street construction guys severed it -- twice -- while rebuilding the street a couple of years ago. I had reason to look into how the US POTS telephone network works once. Robbed Bit Signaling and stuff like that. I'm amazed that the system works at all, much less well. But for the most part if does seem to work pretty well except for some pathological cases.

Re: We have two fax machines

It depends? We have dsl at our house and fax did work. For that matter I tried a 32K analog modem connection over the phone line with the dsl filters in place just to see if it would work. Rather to my surprise, it did.

"Yes, I'd pick #1 any day of the week, or night of the weekend for that matter."

Not anymore you won't, Luddite trash!!!

We don't take kindly to your sort in this century.

Take your outdated technology and get the hence. ... And don't come back.

(Actually we scrapped our fax machine a couple of years ago. If wasn't working very well. ... But I have a USB fax modem stashed in a drawer just in case.)

Boffins ask for £338m to fund quantum research. UK.gov: Here's £80m

Fortunately we'r talking quantum here.

Surely there is some sort of quantum effect that allows one pound to do the work of four?

Let's see, if we define quantum size as 500M pounds isn't 80M exactly the same as 338M?

"My in project experience is that pork barrels are not found in the US alone."

Maybe now, but Trump's gonna fix that.

A basement of broken kit, zero budget – now get the team running

What budget?

Everyplace I've ever worked, there is an routine that is gone through near the end of the fiscal year wherein any unspent money in better managed accounts is quietly transferred to accounts with pressing needs. But doesn't that largely obviate rational budgeting? Why yes, of course it does. Wherever did you get the idea that budgeting is supposed to be, or is, rational?

Coming into a situation like that described -- were I crazy enough to put myself in that situation, I wouldn't be at all surprised to find that the budgeted funds had been hijacked.

Trump shouldn't criticise the news media, says Amazon's Jeff Bezos

There's plenty wrong with news reporting both in the US and overseas. But one suspects that Trump's unhappiness with the press is mostly due to their practice of recording or writing down what he says then quoting it back when he says something different 24 or 48 or a week later.

How can you expect a leader to function if people are going to do things like that?

You'll never guess what you can do once you steal a laptop, reflash the BIOS, and reboot it

Re: Again.. How many people turn their machine off?

Nothing wrong with powering off when not in use, but perhaps it'd be a good idea to unplug as well. There is something called -- as I recall -- Wake On LAN that allows "powered off" devices to be turned on remotely. Obviously, some hardware isn't as turned off as one might desire when one flips the power switch off. Who knows for sure what is actually running in there when the power is "off".

Solid password practice on Capital One's site? Don't bank on it

"by the time I was done I was almost ready to chuck the laptop out of the window"

Are you ever going to need to access that account again? Do you reckon you'll be able to?

"With any complexity to the password there's then little choice but to write it down."

Actually, there is another choice. And it's one you might want to seriously consider. Don't do financial stuff on the Internet. No internet accessible accounts, no need to worry about passwords.

Given the current state of computer security, the rate at which new problems are being introduced, and the slow rate at which the underlying problems are being corrected, it seems to me that internet banking is only marginally safer than asking a random stranger to watch your wallet while you go swimming.

In a few years (decades, more like) when the digital Wild West has been tamed, things will presumably be different and of course you'll be able to paste passwords if passwords are still in use.

Non-profits push back against Big Cable's bumpkin broadband blueprint for America

Easy Answers

While it's true that America's major broadband providers are, by and large, complete and utter scumbags, it's likely not true that there are easy answers. Take municipal broadband for example. Part of the story of Burlington, Vermont's bungled effort is at http://truenorthreports.com/lesson-of-burlington-telecom And Burlington (Population 40,000) is anything but rural. Heck, they even pave the roads there. Providing reliable, affordable, broadband service to rural areas where even power and POTS telephone service somewhat iffy is NOT a simple problem.

2-bit punks' weak 40-bit crypto didn't help Tesla keyless fobs one bit

Re: Problem-solution dichotomy

There's a difference between keyless entry and keyless ignition. Hacking keyless entry allows one to steal stuff. Groceries, your laundry, the radio. Hacking keyless ignition allows one to drive off with the vehicle. (Although I'm a bit hazy on why one would want to drive off with a Tesla. What, exactly, does one plan to do with it?).

Also, many vehicles that allow keyless entry have mechanical locks that can be used when the keyfob fails. That's more useful than one might think as keyfobs tend to fail when the battery gets tired. Because of the nature of batteries, that's likely to be when it's cold out. At night. In Winter.

Email security crisis... What email security crisis?

Re: Secure email?

There are plenty of methods to communicate securely, but email isn't one of them.""

I'm not sure there are "plenty" or sometimes even one way to communicate securely to an arbitrary third party. At least not electronically. But I think it very likely that attempts to make email "secure" would likely make it very difficult or maybe impossible to use email for purposes where security is not an issue.

Security is very difficult to do even passably well. And it's very costly and inconvenient.to secure stuff. I don't see any sign that the helpful folks who sincerely want to help me out on the security front understand the potentially negative impacts of their efforts.

Tor(ched): Zerodium drops exploit for version 7 of anonymous browser

Javascript XOR Security

More evidence, were any needed, that you can have javascript or you can have security. Pick one.

Register-Orbi-damned: Netgear account order irks infosec bods

marketing data?

On what planet does marketing need data or use it if it exists? Surely they'll just make stuff up just like always.

Top antivirus tool nuked from macOS App Store – after it phoned browser histories to China

China is stealing data that rightfully belongs to Google. Outrageous!!! Donald Trump will be coding a patch to prevent this ever happening again and will be posting it on Twitter and Github shortly.

It looks like tech-savvy drivers will have to lead connected car data purge

Re: Users?

I don't think this is as hard as we're making it. All it takes is for a major jurisdiction -- The EU, China, or even just California to require a standard jumper in a standard place -- perhaps next to the OBD/EOBD connector. If the jumper is in place, personal data is retained. If it's not, the vehicle asks when powered on "clear personal data, yes/no?" Until the question is answered, no entertainment system. On rental vehicles the jumper is removed by the cleaning crew and is tossed into the glove box.

Official: Google Chrome 69 kills off the World Wide Web (in URLs)

Re: Less is more -- not!

"you're entire screen will turn black"

Blue is traditional.

Re: AMP

"and has slow JavaScript disabled."

There's such a thing as fast Javascript? Where can I download it?

Re: The layers keep piling up

"Unbolt rocker shaft ... Refit rocker shaft ..."

At the risk of seeming petty, that sounds like Central (Single Port) Fuel Injection where a single fuel injector replaces the carburetor. I'm told that nowadays most cars use multiport injectors -- one for each cylinder. On my last three cars, the fuel injectors are mounted on a fuel rail running down the engine above the intake manifold and are activated electronically. No need to remove the valve(rocker) cover to change them, They are as accessible as they are going to get from the top of the engine. They look to be easily be replaced by any abnormally flexible individual with small hands and three or more functioning arms. Caveat. I haven't had to mess with a fuel delivery system since my 1969 Mazda carburetor automatic choke died of old age about three decades ago. I'll be overjoyed if it stays that way.

Re: The layers keep piling up

"the Internet, ... it actually works."

It works? Who knew? Don't worry, A bit of Javascript will fix THAT.

Re: If www doesn't matter,

"then why does google.com redirect to www.google.com?"

Artificial Stupidity?

Re: No worries!

Surely, you are under the misapprehension that you are capable of making your own decisions without help from Google?

China will overtake America as leading AI superpower, warns ex-Google Beijing bigwig

per capita

Ah Come on folks. China has roughly four times the population of the US -- Twice that of the EU. The culture respects hard work and education -- perhaps more so than the US. All other things being equal, China is inevitably going to take the lead in all sorts of things Americans tend to think of as being our domain. It's a good bet that long before a century has passed, most technical advances, scientific papers, and Nobel Prizes will be Chinese (or Indian?). So what? North America and Europe will still be important on a per capita basis and will still be fine places to live.

As for AI, one huge problem is that when it is successful (e.g. gmail spam filtering), hardly anyone notices it. When it isn't successful (e.g Clippy), everyone notices and disparages it. It also appears to be, not actually impossible to do well, really difficult to do well. There are certainly opportunities in the field, but there are probably vastly more opportunities for embarrassing failure. It may not even be an area where one actually wants to be a world leader.

Ever wanted to strangle Microsoft? Now Outlook, Skype 'throttle' users amid storm cloud drama

Re: "Gee ..."

Of course we don't know if update installation is optional even if you are a Microsoft system administrator. For all we know, their first clue that the system was being updated was a message telling them "Getting Windows Ready. Don't Turn Off Your Computer" or some such.