Posts by vtcodger

Snooping passwords from literally hot keys, China's AK-47 laser, malware, and more

I think I must be missing something here

"That microcode-level mitigation left some AMD-powered systems unable to boot, and now has been given the boot from Ubuntu Linux computers."

If the computer won't boot, how does one (un)patch it?

Gentoo GitHub repo hack made possible by these 3 rookie mistakes

Re: Quite honestly

Two points:

1. Any security scheme that depends on programming users is unlikely to work. (Exception: The protected information -- e.g. nuclear weapon Permissive Action Codes -- is so important that users genuinely respect the necessity for security).

2. Passwords are a major impediment to usability. 2FA is a much greater impediment.. If you insist on making stuff unusable, folks either won't use it or will use it and find ways to "simplify" usage. They will somehow bypass your security measures.

No, I don't know (an) answer(s). I just know that recommended security practices are not working well. And I suspect they are probably never going to work well except for a rather limited fraction of users.

The strange tale of an energy biz that suddenly became a blockchain upstart – and $1.4m now forfeited in sold shares

The SEC is going to come after me because I renamed my taco truck "Blockchain Burgers"?

Now you tell me.

Looks like I'm out the cost of a paint job.

Be The Packet. Take each hop it makes. Your network will repay you

Wrong Problem

"Qualcomm and Gizwits are cooperating to try and crack one of the Internet of Things' more difficult problems: securely field-upgrading low-function devices."

Perhaps the problem they should address is that of building low function devices that do not require (and therefore do not permit) upgrades.

UK Foreign Office offers Assange a doctor if he leaves Ecuador embassy

"But even Brits can't all grasp English punctuation rules."

English has punctuation rules? Who knew?

Linus Torvalds tells kernel devs to fix their regressive fixing

Re: A thin line

"A more professional approach is that the design documents define the functionality and a deviation of the code, from the documentation, is a bug"

Sigh ... Somewhere, perhaps, there is an unparallel universe, where software is carefully designed before it is coded, and programmers translate carefully written specifications from people-speak to machine-speak. And I'm sure if it exists, it runs a lot better than this universe.

But in this universe, specifications -- other than interface specs sometimes -- are uncommon and when they exist at all are more often than not, useless or worse.

India tells its banks to get Windows XP off ATMs – in 2019!

An ATM is a large, publicly accessible, box of money. While I understand that banks may not be the most astute operations in the universe, the assumption that banks need to be told how to secure ATMs strikes me as being a bit odd. Do the banks have some way of laying off their theft losses on someone else? If not is there perhaps something else going on here? Are there perhaps companies that profit somehow from forced upgrading of ATMs?

Ubuntu reports 67% of users opt in to on-by-default PC specs slurp

Re: Majority irrelevant

"You can pretty accurately assume the typical user from what's sold."

Possibly not. PCs, like cars, are pretty durable, at least modestly repairable, and are often handed down/repurposed.when a new PC is purchased. I suspect that the "typical" desktop PC might be what was being sold six or seven years ago. Laptops do not last as long and might be closer to what is being sold. And some PCs do experience memory and storage upgrades although I suspect that is less common than it used to be.

Schneier warns of 'perfect storm': Tech is becoming autonomous, and security is garbage

Now you have two problems

"how to update systems that have an effect on the physical world in near real time"

Apparently "We" decided at some meeting I somehow missed, that we're terribly clever and all we need to do is fix a few bugs quickly and efficiently in order to achieve digital nirvarna.

Maybe you folks really are that smart. But that's not my bet. My bet is that the population of bugs is VERY large and that new problems are being created faster than old ones can be eliminated and that you can't patch your way to anything but unending grief.

I'm guessing that in maybe a couple of decades folks will figure out that traveling the road to digital nirvana requires DRAMATICALLY reducing attack surfaces then exhaustively testing what few attack surfaces you decide to retain.

Enjoy the flight folks. It's going to be a bumpy ride.

Hot new application for blockchain: How does botnet control sound?

Re: No worse than something on a web page

"....they are no more of a risk than something on a web page." Or, for example, a rogue NTP server that embeds commands in the least significant bits of the timestamp it returns.

'No, we are not rewriting Office in JavaScript' and other Microsoft tales

Re: Emacs

"Does LISP count as a scripting language?"

An elisp file reads more like a grimoire than a "script". But the spells undeniably do produce interesting and sometimes useful results.

Re: It'll be clippy all over again

"Clippy on Steroids."

More like Clippy on Laughing Gas. It'll probably be nowhere near as quick, responsive, easily dismissed, or useful as Clippy.

Pwned with '4 lines of code': Researchers warn SCADA systems are still hopelessly insecure

Re: SCADA systems running windows

my guess would be that at least some of the 'Windows 98' systems are out there because the production floor has some collection of gears, wire-wrap, and relays somewhere that needs a driver that only works under MSDOS. I'm far from convinced that's bad although I suspect that turning on TCP/IP and hooking up a network with internet capability might not be a great idea.

US-CERT warns of more North Korean malware

Re: Didn't get the memo?

Historical Note. The last official attack on the US by Canada was a failed surface and naval attack on Plattsburgh, NY in 1814. The last (unofficial) attacks from the US on Canada were a series of raids launched from the US by Canadian rebels in 1838 with some unofficial US support..

Google cloud VMs given same IP addresses ... and down they went

Re: This kind of incidents

<blockquote>will slowly increase in number and will take longer to be solved.</blockquote>

Interesting point. There is presumably a "Fault Surface" similar or maybe identical to the malware "attack Surface" that expands as interfaces become more "flexible" and complex. Problem is that the intelligence of those managing the interfaces doesn't expand to match the increasing size of the Fault Surface.

Back in the 1960s, as we discovered that implementing simple ideas on computers was anything but simple, we used to say the FLEX was a four letter. Brace yourself cloud-people, we are probably going to be flexed repeatedly in coming years.

Citation needed: Europe claims Kaspersky wares 'confirmed as malicious'

Re: Microsoft windows spied on your computer directly

"Microsoft Windows 95 spied on your computer and habits"

Probably not. IIRC Win95 didn't even have TCP/IP support turned on in the default configuration. And people still used modems on 1200 to maybe 32K phone lines back then and not everyone had an ISP. I don't think Microsoft OSes started calling home until sometime in the 21st Century. I don't recall when. Vista maybe? Perhaps someone else with a better memory can fill in details.

Comcast's mega-outage 'solution'... Have you tried turning your router off and on again?

As an Ex-Comcast Customer ...

Comcast has actually acknowledged that there is a problem? And they are probably trying to fix it? Let me assure you, that's a step up from my experiences with Comcast.

UK's first transatlantic F-35 delivery flight delayed by weather

It has been the dream of the common soldier and sailor since time immemorial to only work in nice weather. It appears that the F35 makes one small step toward realizing that vision.

Linus Torvalds decides world isn’t ready for Linux 5.0

... 98 -> ME -> 2000

It's easy to forget ME. A very forgettable product. Microsoft would like to forget it also.

And there really was a Window 1 -> 2 ->3 ->3.10 ... prior to 3.11. Window 3.0 was really the first usable Windows and was quite popular for a couple of years in the early 1990s. But it was nearly universally replaced by WFWG 3.1 then WFWG3.11 (free upgrade) which had networking.

Smart bulbs turn dumb: Lights out for Philips as Hue API goes dark

Perhaps a bit off topic, but why smart light bulbs instead of smart light fixtures that work with any old bulb? Not that either seems to me to have all that much utility.

Visa Europe fscks up Friday night with other GDPR: 'God Dammit, Payment Refused'

Well, the sort of acceptable scapegoats this week are GDPR, Climate Change, Iran, or Trump. Which would you pick?

Storm in a teapot: Anger brews over npm's jokey proxy error messages

Re: Guess which I bring?

Data you thought was deleted is back? Isn't that a security problem? Have you checked to see if there is a bug bounty?

'Autopilot' Tesla crashed into our parked patrol car, say SoCal cops

Teslas don't LIKE firetrucks

In what seems to be an entirely separate incident from the Culver City crash, a Tesla in Jordon Utah ran into a stopped fire truck a few weeks ago. http://www.newsweek.com/tesla-model-s-crash-car-autopilot-sped-just-utah-firetruck-944251. The only possible conclusion is the Teslae have a deep, instinctual hatred of fire trucks.

FBI to World+Dog: Please, try turning it off and turning it back on

Re: Ahem.

"Did it also arrest itself for making malware?"

No, but it has seized one of it's own cell phones involved in the case, and is seeking help from the vendor in cracking the password.

Buggy software could lock a Jeep's cruise control

Re: Some things to think about

I'm not sure "optimization" is the appropriate term here. A compile time warning "Statement at line 8 - default: error(); break; - will never be executed" seems reasonable. But quietly ignoring the code seems to me an emulation of a common form of human "intelligence" often associated negatively with civil servants.

How about "logic devolution" instead of "optimization"

It's maybe even a little worse

I have read elsewhere that not only will the cruise control not turn off, it will not let you turn the engine off with the push button control while cruise control is on. Any chance we can get an Old-Fuddy-Duddy package on our vehicle that uses metal keys without computer chips and old-fashioned mechanical interlocks?

Advanced VPNFilter malware menacing routers worldwide

Re: WTF kind of advice is that for our average person?!

"FFS! What terrible advice!"

On top of which, I would guess that the second or third thing that malware authors addressed was making a reset to factory firmware difficult or (preferably -- from their POV) impossible.

I'd add that reseting a router to factory defaults often is not so easy to accomplish, and that researching the procedure and possible problems BEFORE potentially killing a key element in one's internet connection might not be a bad idea.

About to install the Windows 10 April 2018 Update? You might want to wait a little bit longer

Re: Steve

"I switched 2 years back. Much happier now. I only miss paint"

It's been so long since I used MSPAINT that I really don't recall what it can and can't do. I use the kolourpaint program (part of KDE) for simple image editing. For that matter, I think MSPAINT will probably run under WINE, but my experience with WINE has never been very positive -- not really a criticism of WINE. WINE seems a noble attempt to create a Windows compatible environment on Unix, but that's really a monumentally difficult task I think. I vaguely think that ImageMagick has some editing tools. And of course, there's always Gimp. Rumor has it that Gimp's once legendarily baffling UI has mellowed in recent years.

Braking news: Tesla preps firmware fling to 'fix' Model 3's inability to stop in time

Re: Heavily tested then

My understanding is that Tesla doesn't use LIDAR. That would presumably make determining the distance of a stationary object like -- Oh, I dunno, a crash barrier or a stopped firetruck for example -- much more difficult than one might think.

That's an explanation, not a justification

Re: Musk originally claimed there were no issues

"You don't normally fix braking distance issues via software as the brakes are predominantly mechanical ..."

I was puzzled for a while as to how one juices up the disks or pads via software. But then it got through to me that Teslae use regenerative braking. So presumably they can send more power from the wheels to the batteries with only a software change. But that raises a bunch of questions like: Did they fail to test braking before shipping early production cars? If so, what else did they fail to test? Do they even have a formal test plan for the vehicle? Did they possibly initially set the braking distance high for a reason? What reason? What, exactly, is the tradeoff (if any)?

I find all this less than reassuring.

Map app chaps Waze add shout-at-sat-nav support for Ford cars

Both valid complaints: The weird routings MAY, and I emphasize MAY be reduced by careful attention to the configuration settings. If you tell a GPS to use expressways, then it'll try to use expressways even though you'd actually prefer a more direct route with a few traffic signals.

The confusion probably is due to the GPS device not knowing exactly where it is. GPS is often accurate to a few meters, but if the gods are unkind and/or if some satellites are not visible and/or there is multipath reception and/or there is interference with the satellite signals and/or you are in a parking garage or tunnel and/or who knows what, the $%^# box can be off by many tens of meters. That results in it issuing instructions that are worse than useless. And, yes, not knowing exactly where it is is likely to be a BIG issue for autonomous vehicles.

Mobileye's autonomous cars are heading to California. But they're not going to kill anyone. At least not on purpose

A Mad Max Moment

The Mad Max moment will presumably occur when a Mobileye vehicle and an Uber vehicle decide to occupy the same space on a road. Two cars enter. One car leaves.

UK.gov expects auto auto software updates won't involve users

Bricking is not the worst thing that can happen

Having a dead car is supremely annoying, but unless you are trying to outrun a wildfire or are racing to a hospital it's not that big a deal. But imagine if 1,726,314 recently updated 2021,2022 and 2022 Toyota Fussbudgets all decide to turn left simultaneously at local noon without regard to where they are or how fast they are going.

I really don't think software QA is capable of guaranteeing the quality of software that would be needed to make automated vehicle software updates a routine procedure.

Warren Buffett says cryptocurrency attracts charlatans, AI won’t change investing

There's a possibility that if AI actually did improve capital allocation significantly (whatever that means), that could be bad for financial markets rather than good. If everyone invested rationally wouldn't the real rate of return on "good" investments likely sag to some quite low value?

Pentagon in uproar: 'China's lasers' make US pilots shake in Djibouti

Why?

The Chinese seem pretty disciplined. Why would they go out of their way to piss off us Americans unless they see some benefit? They probably wouldn't. Maybe they have a laser guided anti-aircraft system (do such things exist?) that they might have tested on a live target without thinking through the consequences? Also the base really is purportedly physically quite small. 300 people on a half square km facility https://en.wikipedia.org/wiki/Chinese_naval_base_in_Djibouti It's probably located somewhere around 11.5950N 43.0683E about 10 km NW of the Pizza Hut at Camp Lemonnier. FWIW Google maps doesn't seem to fuzz the image of the Chinese, US (or Japanese) bases at Djibouti, but it only labels the American base. Amateur photointerpreters would seem to be welcome to take a shot at analyzing the facilities.

HP Ink to compensate punters for bricking third-party ink cartridges

Re: Lovin' my HP printer

If I recall correctly those fondly remembered HP II and III printers that cost a fortune and lasted forever actually used a Canon engine inside. Not sure about the HP4.

Ahem! Uber, Lyft etc: California Supremes just shook your gig economy with contractor ruling

More complicated in the US

The situation is complex everywhere of course, but it's worse here in the US because our largely dysfunctional and extraordinarily expensive "healthcare" "system" is based on insurance purchased by employers. In concept independent contractors excepting a few older folks covered by Medicare or younger folks somehow on their parent's policies take care of their own health insurance -- although in reality few can afford it

If Uber and Lyft have to purchase health insurance for their drivers it's going to cost them big bucks.

Google founder Sergey Brin promises to protect humanity from AI

Re: 'controlled by a few people at Google with no oversight'

"So if AGI represents an extreme level of power, should that be controlled by a few people at Google with no oversight?" - Elon Musk

"Quis custodiet ipsos custodet?" - Juvenal

Programmers! Close the StackOverflow tabs. This AI robot will write your source code for you

MBAs will love it.

Terrific, testing is no longer either necessary or, in fact, possible. What Could Possibly Go Wrong?

TSB outage, day 5: What do you mean you can't log in? Our systems are up and running. Up and running, we say!

In the short term, switching may not be so easy if you can't access your assets in the old bank. In the longer term, switching might be an excellent idea.

Surprise! Wireless brain implants are not secure, and can be hijacked to kill you or steal thoughts

Re: Cost.

"Good news! The operation was a success and your tremors should be under control. Just don't get your head wet when you bathe, and don't get any MRIs, and be sure and tell your dentist you have a brain implant. And, Oh yes, here's the battery charger you'll have to wear for at least three hours every day ...

What could possibly go wrong?

OK, this time it's for real: The last available IPv4 address block has gone

Re: Time to claw some back

"What's the point in trying to claw back IPv4 addresses? It would not fix the problem, just delay it for another couple of years."

I'd submit that Plan A -- everybody grumbles a bit them and switches to IPv6.-- does not seem to be working. In reality, many users can't "upgrade" because third parties like their ISP don't support IPV6. Others lack resources to upgrade. Many users feel, possibly correctly, that the minimal security provided by IPV4 plus NAT is better than not having "NAT security". A lot of stuff that purportedly supports IPV6 doesn't. Less than a year and a half ago, Microsoft had to fix Windows 10 before they could change their headquarters network to IPV6. Most users don't have the resources to fix their OS(es) or their hardware. There may be other valid reasons. Whatever ... IPV6 adoption is glacial at best.

I'd submit that a few years to develop and implement a Plan B that -- unlike Plan A -- realistically addresses the needs/desires of users might be a really good idea.

And a Plan C developed in parallel with Plan B in case Plan B doesn't work out, might not be a bad idea either.

US, UK cyber cops warn Russians are rooting around in your routers

Re: If anyone shoud know

Surely there's enough room for both (plus France, North Korea, Iran, ISIS, and the Grand Duchy of Fenwick).

Aw, all grown up: Mozilla moves WebAssembly into sparsely furnished Studio apartment

Re: Hypervisor?

I'm not worried much about the turtles under me. The turtles I am under worry me a bit at times.

Insecure by design

Pretty much everyone acknowledges that there are widespread and serious security problems with computers and especially with computers attached to the internet. Our response is to continually expand our internet attack surface by adding stuff like Web Assembly. Is that really a good idea?

Imagine you're having a CT scan and malware alters the radiation levels – it's doable

They run XT. So What?

Is it unreasonable to hypothecate that there things in the world that should NOT be connected to networks? Voting machines come to mind. And nuclear reactors. But potentially dangerous medical devices also would seem to be high on the list. I suspect in a really rational world, no one would allow anything any more complex than Windows 3 anywhere near a radiation emitting medical device. But we don't live in a rational universe. It would seem to me that isolating medical devices running dangerously complex sotware from potential problems induced via networks (and sneaker nets as well) would be a major step toward securing them.

It's April 2018 – and Patch Tuesday shows Windows security is still foiled by fiendish fonts

I'm getting stupider as I age. And maybe I didn't start off from all that much intellectual altitude. But can someone 'splain to me why a video player HAS to be a bundle of security bugs? Is it possible to write a player that can play most or all non-malicious Flash material and is relatively safe to use? They could call it FAIL or FLUNK.

Modern life is rubbish – so why not take a trip down memory lane with Windows File Manager?

Re: Bring back DOSEDIT

"Nothing wrong with emacs."

There's plenty wrong with EMACS (and plenty right also). But EMACS is, if nothing else, configurable. It is not too hard to configure EMACS such that when used with a keyboard with Insert,Home,End, etc keys, it's about as easy and intuitive to use as the MSDOS editor. I have no idea if vi can be set up to do that. Wouldn't surprise me that it can.

Birds can feel Earth's magnetic fields? Yeah, that might fly. Bioboffins find vital sense proteins

Mythbusters

The Mythbusters TV show did a show of tests on the human sense of direction. https://en.wikipedia.org/wiki/MythBusters_(2011_season)#Episode_173_%E2%80%93_"Walk_a_Straight_Line" They tried walking across an open field, swimming across a pond, and driving in a straight line while wearing blackout goggles and earplugs. Neither of the hosts could do any of those things. Their conclusion: Their sense of direction depends on visual/auditory clues.

An easy-breezy attitude to sharing personal data is the only thing keeping the app economy alive

Re: And that's exactly why...

Of course the data is poor quality. Even if it were good quality, it probably wouldn't actually be of much real use or value. My guess is that the "information age" will go down in the annals of human lunacy along with Dutch tulips, the South Seas Company, cryptocurrencies, the late 20th century Japanese stock/real estate markets and the CDO craze. On the bright side.-- Facebook and Google et. al. don't own or operate guillotines.