Posts by vtcodger

Thousands of misconfigured 3D printers on interwebz run risk of sabotage

Re: Why

Pretty obviously connecting your printer -- 3D, 2D or whatever -- to the Internet is likely not to be a wonderful idea. The problem is that the vast majority of computer users are quite incapable of configuring network enabled devices "safely". My guess is that maybe 4% think they can do so and that less than 1% actually can. I'm no stranger to networking, but I doubt my wireless printer or any other device I've set up is actually "safely configured". Personally, I consider myself lucky if I can manage to get the bloody box to work.

Spies still super upset they can't get at your encrypted comms data

70 or 80 years ago the Japanese and German Navies thought that their communications codes were unbreakable. Turns out they were both wrong. Granted, encryption technology today is vastly improved. But so, one suspects, is decryption technology. If you are going to send messages that might interest the CIA or its friends, I'd strongly recommend the use of one time pads.

Otherwise, I'm far from convinced that encryption of non-financial material is worth the effort required to deal with the inevitable glitches. Personally, I still use paper, telephone, and face-to face for most financial stuff -- not because of concerns about encryption, but because most of the software I'm expected to use on line is really quite awful.

ABBYY woes: Doc-reading software firm leaves thousands of scans blowing in wind

Re: No data was lost to an unknown party during the exposure.

It's conceivable that they actually had access time logging turned on and thus could tell that no one had been reading the files. (What is the point of storing 203,000 files no one is looking at?)

We've found another problem with IPv6: It's sparked a punch-up between top networks

Re: IPv4 Address Pool Has Been Expanded Significantly

What would the affect of using the 240/4 addresses be on routing tables? My understanding is that one of the few (maybe the only) actual benefits from IPv6 is more compact routing tables.

Re: El Reg & IPv6

"the big players extort the small ones, who want to have a free ride on the big ones."

Isn't that how capitalism is supposed to work?

Of course, there is always the old Russian joke. "Everything Marx told us about Communism was wrong. Unfortunately, everything he told us about Capitalism was right."

Re: El Reg & IPv6

"Bring on IPv7, with additional health benefits and twice the amount of protein."

Perhaps we should hold off on IPv7 until we see some signs that IPvX specifiers have actually learned something from the world's failure to enthusiastically embrace IPv6. Next time maybe they ought to take backward compatibility a bit more seriously.

(There are,BTW, a number of medical conditions associated with excessive consumption of protein. Some of them are probably imaginary of course. But some aren't.)

Just how rigged is America's broadband world? A deep dive into one US city reveals all

Re: When I read articles like this...

"For what possible reason would "everybody" need 100 to their home?"

.... what reason? .... The decision makers at "content providers" are clueless and assume that all users everywhere -- even in remote mountain hamlets -- has bandwidth similar to what they have on their desktop PCs. AND, they think "latency" (a separate and also serious issue for many applications) probably has something to do with milk.

Welcome to Fantasyland

I have this uncomfortable feeling that there is a large gap between what our American politicians think they are regulating and what is actually available. 100Mbps for everyone? My guess is that if someone went out and measured actual speeds -- not claimed, not what is paid for, but what is actually delivered to customers, access would be substantially worse than even what this depressing report suggests. Maybe things are better in other countries. ... or maybe not.

Gartner's Great Vanishing: Some of 2017's emerging techs just disappeared

Re: 4D Printing

That's disappointing. I was hoping that dimension 4 was time and that 4D printers printed materials before one needed them instead of hours, days, weeks or months after they are required.

Re: I wish Gartner would Vanish!

That would be self-destructing prognosticator technology. It'll probably show up next year or the year after as a yellow triangle in the extreme lower left of the chart.

4D Printing

Might not it be a good idea to get 2D printing to actually work reliably before upping the ante?

Windows 10 Linux Distribution Overload? We have just the thing

Re: I still think they're majoring in the minors. again.

"... why do you guys constantly complain about data collection from Windows and never talk about how pervasive Google's tracking is all over the web and ..."

Most likely the depth and vigor Google's obsession with spying on users hasn't registered on most folks yet. Those who have been around a few decades can possibly recall a time in the 1980s and 1990s when Microsoft was widely perceived as being quite friendly to home users. Reasonably priced, non-copy protected software. A lot of free stuff. What's not to like? Things started to change around 2000. Something similar is happening with Google I think. ... sad ... but I reckon it's time to start thinking about moving on.

Self-driving cars will be safe, we're testing them in a massive AI Sim

Re: "It's a synthetic digital model of the real world,"

Despite humanity's inability to handle a lot of simple stuff, there are some things that are done really well. One of those is aircraft safety. I can conceive a similar approach to autonomous vehicle safety wherein every significant accident involving an autonomous vehicle is analyzed, responsibility assigned, fixes implemented, and the accident simulator suites updated to include an emulation of the situation that caused the accident.

Not that I'd bet that will actually happen.

Talk about left Field: Apple lures back Tesla engineering guru

"Also, will they slow their cars down as the batteries wear out?"

Of course not. The vehicle will simply drive itself off to the dealer in the middle of the night and you'll get an e-mail telling you that it is unsafe and won't be returned unless you pay $5300 for a battery swap. The only way to prevent that will be to chain the vehicle to a mooring ring when not in use.

You can't always trust those mobile payment gadgets as far as you can throw them – bugs found by infosec duo

Priorities

Interesting, but as security flaws go, not that big a deal I think. I do question the priorities here. Altering the amount charged in a transaction isn't good, but it's basically no different than a dishonest waiter or merchant altering your credit card paperwork after you sign for the charge. It'll show up on your statement so its risky for the perpetrator. Code execution flaws OTOH probably have a potential for leaking your credit card information via the internet to some of the world's multitude of scoundrels.

Say what you will about self-driving cars – the security is looking 'OK'

Ooopsie

"The other serious weak point is external communications. Autonomous vehicles are going to be updating their code, neural network models, and other datasets daily"

This seems to me a very bad idea. The idea that one can hack autonomous vehicle software together using whatever demented development "technology" is currently popular, then fix any problems in production is almost certainly going to lead to injuries, deaths, and enormous manufacturer financial liabilities. Good for lawyers. Not so good for those who share the road with these things.

The phrase "Blue Screen of Death" has a different meaning when the software in question can actually kill people. I think a more measured approach with few and VERY carefully controlled updates will prove to be necessary.

Second-hand connected car data drama could be a GDPR minefield

"without the "CSM", because who would want that in a car?"

That's where stuff like GM's On-Star system and probably parts of Tesla's "Autopilot" live along with the pernicious telemetry unit? Manufacturer "enhancements" over and above basic wheels. Some of them may actually have some value to some car owners.

One thing that MIGHT, and I emphasize MIGHT, help is for developed countries plus China and India to pass laws that require the various subsystems -- power train, location/performance monitoring, entertainment -- be segregated and interface to the, for want of a better term, corporate spying module (CSM) through standardized interfaces. The laws should require that the vehicle be drivable and meet all safety and pollution standards using a standard integration module costing no more than $100 in place of the CSM. Hopefully that would allow a buyer of the vehicle to keep the existing CSM, install a new manufacturer CSM with all the nifty features if they chose, or to simply replace the CSM with a cheap third party integration module and get on with their life

The idea as I've presented it is probably unworkable. But maybe with some tinkering ...

Just a Random Thought

Just a random thought not specific to this story. More general. What are the chances that "We" -- society, software and hardware makers, purveyors of automobiles, etc -- are on our way to building complex systems that nobody can understand or fix?

Imagine that your 2036 Belchfire 2000 is blinking all its lights -- internal and external and running poorly. First you try the internet and find that you aren't alone. Most posters are baffled except one guy who claims that rubbing SPF 50 sunscreen on the battery cables will clear the problem right up. It doesn't. Then you try the local mechanic. Sorry, he only does struts, belts, tires and mechanical stuff. So you take it to the dealer who replaces $2000 worth of electronic components over six visits before confessing that he has no idea what's wrong. The problem is escalated to the manufacturer whose major contribution seems to be repeated assurances that your problem is very important to them.

What now Kimosabe?

IPv6: It's only NAT-ural that network nerds are dragging their feet...

Re: "the world is clinging stubbornly to IPv4"

"Microsoft since Win7 [aside might have been Vista but...] have shipped Windows with an IPv6 stack that works out of the box."

Right. And you are aware that Microsoft had substantial difficulty switching to IPv6 internally not all that long ago? e.g. https://www.theregister.co.uk/2017/01/19/windows_10_bug_undercuts_ipv6_rollout/

Re: "the world is clinging stubbornly to IPv4"

The world is clinging stubbornly to IPv4. And IPv6 zealots are clinging stubbornly to the notion that everyone MUST switch to IPv6 despite the fact that doing so costs money and provides little or no benefit to the end user. What's wrong with a world where home users and small businesses use IPv4 and their ISP bridges their traffic onto IPv6? Note that most home/small business users are not only uninterested in switching to IPv6, they are quite incapable of setting up IPv6 gear or a dual IP stack.

Further, unless/until the IoT mess is straightened out, many, probably most, IPv4 users are best off sticking with IPv4 which makes world access to badly designed, poorly secured, digital enabled junk difficult or impossible..I don't know about you folks, but I don't want my scale, toothbrush or printers talking to bored teenagers in Bratislava.

Click this link and you can get The Register banned in China

Re: whatever’s wrong ...

China, for whatever reason, has long had a quota for foreign films in its theatres. The quota started off at 10 a year in the 1990s and has been expanded to 34 today. The chances that a less than stunning movie with a character that might be taken as a parody of Chairman Xi will be one of those films are probably close to zero. Especially given President Trump's recent trade related antics and the fact that it's an American film. There are alternate mechanisms that could allow its distribution, but probably won't. See http://chinafilminsider.com/foreign-films-in-china-how-does-it-work/

AI on Raspberry Pi, Waymo touts robo-rides to Arizonians, and more

Re: If it comes from any mainstream media

FWIW -- https://www.democracynow.org/2018/7/27/noam_chomsky_on_mass_media_obsession

"Israeli intervention in U.S. elections vastly overwhelms anything the Russians may have done, I mean, even to the point where the prime minister of Israel, Netanyahu, goes directly to Congress, without even informing the president, and speaks to Congress, with overwhelming applause, to try to undermine the president’s policies—what happened with Obama and Netanyahu in 2015."

Overall I'm not all that big a fan of Chomsky. But here at least, the man seems to have a valid point.

Alaskan borough dusts off the typewriters after ransomware crims pwn entire network

It sounds like they MIGHT be able to eventually very carefully recover their data from the infected backups. Personally, I'd look into using a unix to do so in order to minimize the chance of propagating their old infection back into their system once they get it decontaminated and running again.

The American dilemma: Competition, or fast broadband? Pick one

Re: I have

The article misframes the issue. A choice between competition or fast broadband is the best one can hope for in the US. For a large part of the population, one's only option is neither.

The Solar System's oldest minerals reveal the Sun's violent past

"100microns is small?"

Good point actually. Objects 1/10th of a mm wide are readibly distinguishable by the naked eye. The (perfectly legible) mm markers on my ruler look to be 100 micron wide black lines spaced at 1000 micron (1mm) intervals.

Microsoft devises new way of making you feel old: Windows NT is 25

Re: Obviously...

Not hatred exactly, but I thought at the time that NT -- no matter what its technical merits -- was a dubious idea. The problem I anticipated was that NT was never likely to be the server OS that Unix was even back then and migrating the user OS away from a small, minimal core (i.e. MSDOS) would mean that when the next generation of low end devices came along, Microsoft wouldn't have an ecosystem that could be shoehorned into them.

Pretty much what happened. You cell phone doesn't run an NT derived system because by the time the hardware became capable enough to support one, other OSes owned that market. And neither does all the annoying IoT stuff -- largely for the same reason.

FBI boss: We went to the Moon, so why can't we have crypto backdoors? – and more this week

""We put a man on the Moon. ..."

When, exactly, did the FBI put a man on the moon?

And why?

If the FBI genuinely can't operate without spying on the citizenry, perhaps it's time to consider whether there is any point to having an FBI.

Some Things just aren't meant to be (on Internet of Things networks). But we can work around that

Re: I had to laugh

"Wouldn't it be better to have a recognized standard for IoT security,"

Of course there will be standards for IoT security. Probably about seven of them. All mutually incompatible. And no one will implement any of them in exactly the same fashion as anyone else.

Google Chrome: HTTPS or bust. Insecure HTTP D-Day is tomorrow, folks

Re: They can only do that if...

Actually, the complete, accurate statement is "you really can't trust HTTPS".

Probably true. OTOH I personally don't much care except when money is involved. And I try to do as little as possible involving money on-line. I find that face to face, paper, and/or telephones work better and are less inconvenient than online with proper security and are less scary than online without proper security.

For me, most of the time, https mostly means I can't view a constantly changing array of sites in one browser or other (I have at least six installed) because their certificates have some subtle or not so subtle flaw this week.

My guess is that most users will have no idea what Google is about with this HTTPS thing. Depending on implementation details, they will either click through any annoying error messages or will whinge until someone shows them how to switch to a different search engine.

No, I don't know what to do about all this until folks are ready to accept that online security is a very tough problem, the toolkit we are approaching it with is entirely inadequate, and we may have to stop doing some things (e.g. Javascript) that are surely incompatible with secure computing.

Sysadmin sank IBM mainframe by going one VM too deep

"Why leftpondians call it a pound sign ..."

Because # is sometimes used as an abbreviation for a unit of weight/mass = to 453 grams still in use in the US. ("lb" is a lot more common in practice).

The US hasn't had a currency called the pound for about 240 years. Canadians switched from pounds to dollars well over a century ago.

Friday FYI: 9 out of 10 of website login attempts? Yeah, that'll be hackers

Re: password reuse

"Are you one of the "I want everything, and easy, and until this happens I will mope" people?"

Not especially. More a "Sooner or later you folks should acknowledge that what you're doing isn't working and quite possibly will never work" sort of person.

Doesn't mean one can't use the Internet for entertainment, access to information, casual conversation and many other things. Just that it truly may not be a satisfactory vehicle for command and control, financial activity and some other activities.

"you better use what's available"

Why would I use a defective and potentially dangerous tool when there are safer alternatives? Why would anyone?

password reuse

"so try not to reuse the same password on every site, eh?"

There's an assumption here that I care whether someone hacks into my Register account using my reused password. Actually, I couldn't care less.

But what about my bank account? You think I'm crazy enough to bank on line? That's not going to happen unless and until "they" come up with an authentication scheme that is both a lot more secure than those in common use -- and a lot less inconvenient.

As Corning unveils its latest Gorilla Glass, we ask: What happened to sapphire mobe screens?

Drop Counter

"Corning claims it should be able to withstand 15 drops from one metre onto a hard surface"

The first thought that went through my mind was that if it'll withstand 15 drops, it'll probably withstand 1500 drops from the same height.

The second was that the bastards will build in a drop counter and a software controlled screen buster. Sadly, were it not for the complexity of a screen busting device, this is not entirely implausible on our modern world.

Elon Musk, his arch nemesis DeepMind swear off AI weapons

Re: It would help ...

"if they could demonstrate a real functioning AI. At the moment all we have is a load of marketing hype"

I want to agree with you, but it crosses my mind that Google, for all its faults, seems to do a fantastic job of despamming my gMail without discarding legitimate messages. Maybe that's not really AI. But whatever it is, it works.

Re: Meaningless.

"A stronger pledge would be one in which the signatories agree not to build any algorithm or A.I. system that facilitates conflict at arms in general."

Sounds good. But I suspect the reality is that many AI algorithms, like much construction equipment, are easily weaponized by folks with only modest skills. Need a tank? Start with a bulldozer. Add armor and a heavy duty gun or two. Need photointerpretation software? Start with whatever archaeologists are using.

Oldest swinger in town, Slackware, notches up a quarter of a century

Re: Good(?) old days...

" Slackware dropped Gnome when it became dependent on dbus (if memory serves)"

My recollection -- which may be faulty -- is that Volkerding wanted to keep his distribution on a single CD and there wasn't enough room for both KDE and Gnome. Volkerding argued at the time that a Slackware compatible Gnome was available for those who wanted/needed it and that it was better that some people could install from a single CD than that everyone needed two.

BTW -- judging from the number of gratuitous dbus related error messages thrown up on the konsole, KDE also seems to depend on dbus nowadays

No GUI Installer

While it's technically true that the Slackware installer is command line text, it doesn't usually require typing long lines of cryptic text. It uses either query-response or Dialog widgets -- I forget which -- that are no different functionally from GUI message boxes, radiolists, and checklists. What is more daunting perhaps is the lack of an apt-get style automated installer with conflict resolution. Finding Slackbuilds for software not included in the distribution can be a drag. And installing non-mainstream software -- especially stuff that doesn't install with ./configure, make, make install can be tedious

OTOH, if you need to solve some problem and you search for a generic Unix "How do I ...?" or "How does Unix ...?" solution, Odds are that the solution you find will work cleanly with Slackware

Wearable hybrids prove the bloated smartwatch is one of Silly Valley's biggest mistakes

"I have my shopping list on a piece of paper, and cross things out when picked off teh shelf."

Indeed. A decade ago, I had a eeePC in the kitchen so that people could call up recipes, play music, and add to the shipping list. There was a printer on the shelf above to print recipes and shopping lists.

Problem is that no one used it but me, and I didn't use it all that much (and mostly for music)

Nowadays, the eeePC and printer are gone. Recipes are in a notebook and the shopping list is on a notepad hanging on the fridge next to a pencil holder.

Re: Er, seemsd to have missed....

"Also my Fenix 5 battery lasts for weeks!"

OTOH, the battery in my 10 year old $12.95 Timex watch lasts about 5 years. Of course, it only tells time, but that's all I want it for. (Well OK, I have been known to use it as a VERY light duty hammer, but it doesn't need a battery for that).

Submarine cables at risk from sea water, boffins warn. Wait, what?

"It never takes long for articles like this to reveal those still in denial about climate change due to our greenhouse gas emissions. What evidence would ever convince you?"

Models that make verifiied predictions would help. I think that if you forget your preconceptions and do some research, you will find that the Climate Models have never made even one prediction that would persuade an objective, unbiased observer. It's not that CO2 isn't a greenhouse gas. It is. And it isn't that CO2 isn't increasing. The CO2 measurement program put in place by Charles Keeling in the 1950s stands up to scrutiny.

But the Global Climate Models are clearly generating highly dubious numbers and worse, they aren't providing insights into what causes glaciations, what ends them, what causes obvious cyclic phenomena like ENSO, PDO, AMO. It may be that the idea of climate modeling using the same basic techniques used for weather forecasting simply can't ever work over time spans greater than, at most, a few hundred hours.

Re: Except the USA

"They'll just build a wall"

Sure, why not? Mexico's paying for it.

Re: Total Malarky. This is abject stupidity

"It's also resting on a swampy floodplain that people are sucking all the water from - which makes the land drop, thus making the problem worse."

I think the current record for subsidence caused by pumping fluids belongs to Los Angeles-Long Beach Harbor where parts of the Port of Long Beach sank as much as 29 feet due to pumping oil from the Wilmington Oil Field. The subsidence was eventually stabilized by injecting salt water as oil was removed.

Re: Total Malarky. This is abject stupidity

In general, you're correct. Sea levels are rising -- but slowly. If one has any doubts, it's easy enough to check for one's self. NOAA has data for US tide gauges on line. They'll even do a linear fit and compute the rate of rise for you. Typically, it's about 7-10 inches a century. Hint: The two longest records are for The Battery in New York and San Francisco. For data on stations outside the US, try the Permanent Service For Mean Sea Level.

That said. Folks are prone to build infrastructure without sufficient allowance for worst case storm surge. Worst case storm surge in a strong tropical storm can reach 7 to 8 meters. (23-26 feet). And that's before allowing for tides and waves. I suppose that it's inevitable that sooner or later one of the stations will be flooded. But compared to the near certainty of occasional massive flooding and/or total destruction of seafront residential and commercial property every time a tropical cyclone makes landfall, the potential problem is not very large.

Sad Nav: How a cheap GPS spoofer gizmo can tell drivers to get lost

Why assume spoofing is bad?

The factory GPS system in my wife's car is so obtuse and user antagonistic that it's hard to believe GPS spoofing could make it worse. My wife and daughter have dubbed the pleasant female voice (its best feature) "Miss Guided".

Ticketmaster breach 'part of massive bank card slurping campaign'

Re: Why do browsers allows JS from other domains to run

"I've never understood i) why a site would trust other sites to host code for them and ii) why browsers allow one site to run scripts from another."

Heck, I've never understood why anyone would think that downloading ANY code from ANY website into a browser for immediate execution, could possibly be a good idea. It seems clear to me that can only work in a world with technology that provides 100% iron clad security as well as computer folk who never, ever, make mistakes. We do not live in such a world. We are unlikely ever to live in such a world.

But ... but ... but ... That'd make life harder for web designers. Yep. Almost certainly it would. So what? If we're going to do financial and other important stuff over distributed public communications network, shouldn't USER security be the overriding priority?

Snooping passwords from literally hot keys, China's AK-47 laser, malware, and more

I think I must be missing something here

"That microcode-level mitigation left some AMD-powered systems unable to boot, and now has been given the boot from Ubuntu Linux computers."

If the computer won't boot, how does one (un)patch it?

Gentoo GitHub repo hack made possible by these 3 rookie mistakes

Re: Quite honestly

Two points:

1. Any security scheme that depends on programming users is unlikely to work. (Exception: The protected information -- e.g. nuclear weapon Permissive Action Codes -- is so important that users genuinely respect the necessity for security).

2. Passwords are a major impediment to usability. 2FA is a much greater impediment.. If you insist on making stuff unusable, folks either won't use it or will use it and find ways to "simplify" usage. They will somehow bypass your security measures.

No, I don't know (an) answer(s). I just know that recommended security practices are not working well. And I suspect they are probably never going to work well except for a rather limited fraction of users.

The strange tale of an energy biz that suddenly became a blockchain upstart – and $1.4m now forfeited in sold shares

The SEC is going to come after me because I renamed my taco truck "Blockchain Burgers"?

Now you tell me.

Looks like I'm out the cost of a paint job.

Be The Packet. Take each hop it makes. Your network will repay you

Wrong Problem

"Qualcomm and Gizwits are cooperating to try and crack one of the Internet of Things' more difficult problems: securely field-upgrading low-function devices."

Perhaps the problem they should address is that of building low function devices that do not require (and therefore do not permit) upgrades.