Posts by Solviva

Security boss thought MFA would be too much security

Re: CYA

Penis? Surely he was talking about one who plays a piano? Hardly a sacking offence...

Locked-out iPhone user tells The Reg that Apple is scrambling to fix character flaw passcode bug

Re: USB Keyboard?

But said Iphone needs to be unlocked before any USB devices can be used.

Re: Wouldnt an external keyboard work

Security means you need to unlock the phone before any USB devices can be used...

South Korea introduces universal basic mobile data access

Re: Digital ID Required?

"The real trouble happens when there is a systemic security breach. What happens when 3 million people simultaneously try to make an appointment with their bank"

I'm not sure what breach you are thinking of here. If, say, there was a vulnerability found in the smartcards then it's reasonable they would all be blocked. What I didn't mention is the smartcards themselves have expiry dates just like bank cards, and when due for renewal they are simply sent out to the registered address, no need for extra security. The only reason I needed to verify myself was due to blocking my card. To be honest it did seem a little odd I couldn't just go to my online bank and order a new card but that's how it was.

As I mentioned there are at least 2 forms of this digital ID, my bank provides smartcards and mobile ID, whereas other banks my offer a security fob instead of a smartcard. The 2 (or more) types IDs are physically separate, like two SSH keys that both allow you to log in to a device. Each key identifies you as you, but by blocking one key the other key still works. Of course you can disable the account so no keys work which would be the equivalent of cancelling somebody - AFAIK this isn't something that is done centrally, it would be need to be done for every service that wants to block you. The bank, as your ID provider however, could block all your IDs, but then there's nothing stopping you getting another ID from another bank for better redundancy, just as there's nothing wrong with getting a card from another bank for better payment redundancy.

Re: everyone has a cell phone

To file a police report there is an app for that in SK however I'd read dubious stores about how many permissions it wants and what it does with those.

The alternative was to go to a police station and make a police report, requiring no phone, no app, no data.

Re: Digital ID Required?

It's frightening to think they had digital IDs back during WWII where you had to present your digital ID to get your weekly ounce of butter ration. Oh wait, they did that without a digital ID?

Strange all these fear mongering anti digital ID folks come up with all the things digital ID will be used for to restrict your daily life, where most of these things have been done previously with no digital ID.

Another European digital ID user here for getting on 20 years now. The only bad things I've got to say is the hassle to get a replacement smart card when I brain farted and put in the wrong code 3 times thus blocking it. Fortunately I also had a mobile digital ID that works just as well. It was such a hassle to actually to make an appointment and go to a bank branch, hand them my driving license, they ring up the transport authority to confirm it's genuine then they can order my new smart card.

Most if not all the traditional banks whilst letting you access their online offerings with digital ID also offer alternatives.

To put it bluntly, digital ID makes life easier, but without one then life would be like life was before digital ID - it hasn't taken anything away simply made many things infinitely easier.

Re: Security nightmare as nobody updates?

Like most sensible folks they'll download updates over wifi.

Google gives Android users a way to install unverified apps if they prove they really, really want to

As a 'power' user then you'd enable this in advance (permanently) for the day you think you might need it, and download at your own risk tomorrow onwards.

As a regular user who uses nothing more than the Play store, when Peter Smith with a funny non-matching accent calls and asks you to go to this 'ere website and install this app to make your banking secure again, then they'll be frustrated that they can't get their instant kill anymore. However sadly they often prey on these people as if they've got them to the website already and trying to download then they've passed the 'easily manipulated' test and they just keep them on the hook for the next day when they *can* now install random app having been told how to 'fix' the issue with your phone.

Supermarket sorry after facial recognition alert flags right criminal, wrong customer

Re: 99.98 accuracy

Sounds more accurate than their pricing was when I shopped there 20 years ago. Invariably every time I went, there would be at least 1 item that didn't match the shelf price at checkout. Staff couldn't care less.

What if Linux ran Windows… and meant it? Meet Loss32

Re: The last thing we want

Nvidia are free to offer binary blobs that compile (within reason) with any kernel, alternatively they can provide a pre-built module that works with a very limited set of kernels. I expect they do the first, in which case you need somebody who can update the Nvidia sources which support later kernels to add back in the necessary support for older cards - caveat being they haven't also pulled support from the blob (which they probably did) in which case you're at a dead end.

You're also free to buy AMD cards which have better in-kernel support, but assuming you already shelled out your cash to Nvidia then the Nouveau driver provides support for cards Nvidia has disowned.

Re: Ok right up until it's not

I guess you never really own that loaf of bread you bought as it doesn't come with the recipe to make and/or modify it. Hmmm.

Microchip's MPLab compiler requories a paid license to enable *GCC's* optimisations (-On). Of course one is free to edit out the check should one not wish to offer any shekels to Microchip.

GPL FTW.

Stop the slop by disabling AI features in Chrome

And migrating from Chrome to these Chromium browsers is fairly painless in that you can copy your profile from Chrome to your favour of Chromium and most things transfer with the exception of saved passwords and session data. Made me breathe a sigh of relief when my 40ish windows and several hundred (getting on for a thousand?!) tabs (yes I'm doing it wrong - tabs aren't bookmarks, but then I bookmarked my then tabs a few years back so they are like L3 cache, with the current tabs L2 cache, to be visited again one day).

Re: DuckDuckGo

Have to say I installed Vivaldi on the phone a couple of months ago (phone being a device I use only when I don't have my laptop nearby, which is rare). Didn't notice immediately that the default search was startpage but did notice that the relevant search results took some scrolling to get to with the first results being (can't remember what they were) something I didn't want. Being lazy I continued with startpage and continued noticing the irrelevant results and only this week got round to changing the search to google whereby normal search resumed.

Starlink tells the world it has over 150 sextillion IPv6 addresses

Re: Talking telephone numbers

Which part of IPv4 allows for country codes?

Oh that's right, none so you'll need IPv4.1 which is 100% not backwards compatible with IPv4. OK so a country code + IPv4 would be simpler to remember than a 128 bit number, so all you've done is add another byte to the address making a not very round 40 bit length. But dividing by country isn't very efficient, compare say Lichtenstein with China.

There is truth they could have simply added a byte or two to make an incompatible IPv4.x, but if you're going to break everything then why not start from scratch and try and design something functionally better?

Major AWS outage across US-East region breaks half the internet

Re: HMRC Down

Funny that, your favourite BBB used to be my favourite BBB when he was creating videos about, well, barrister related stuff. Then he realised there's money to be made pandering to a certain section of the population who seem, how to say, anti-establishment (not sure I'm using that correctly, but hey). Then he started pumping out daily videos about nothing much, filled with sponsored segments.

Similar to how the venerable Dr (PhD) John Campbell was giving sound advice at the beginning of the pandemic, then again realised where the real money is to be made with his wink winks, and threw all the published science to the side and misinterpreted plenty of non-sensical fringe-science.

Anyway enough of reviewing YouTubers. So BBB is scared that it's outsourced to Romania, a country which adheres to GDPR legislation. When does BBB know the first thing about outsourcing and IT? Sure he knows law, he's a black belt, but no mention of being anything related to IT.

The alternative is to not outsource it and keep it all in house - back to my last statement, the government is hardly competent when it comes to IT (well perhaps a lot more than IT but I digress). So how would keeping it in house be better. Is there any information who this Romanian outfit are? Do they have a bespoke authentication product that's used by other companies/countries? Are they just some guys bedroom PC? More information would be good before one starts speculating about insecurity, but BBB is best when there's no actual information and plenty of speculation.

Re: HMRC Down

Well if Bob enrols Alice's biometrics on his device, or shares his passcode with Alice then sure Alice can pretend to be Bob if Alice has Bob's device. Is Alice Bob's mum, you didn't specify?

Meanwhile when Balaclava Boy swipes Bob's unlocked phone, the digital ID app still requires the same biometrics to be opened so Balaclava Boy is unable to identify as Bob.

Re: HMRC Down

As for ID theft, that will be rather harder with a digital ID. The process of acquiring a digital ID should be secure enough that should a re-application come in for the same person, then flags will be raised requiring further verification.

As opposed to today where you can whip up a fake ID, some fake bank statements, fake utility bills and hey presto you now have credit in the name of Bob.

Re: HMRC Down

"like why aren't passports or driving licences secure enough"

Ask country X why their passports are easy to forge. Not everybody is eligible for a driving license.

The thing with (a properly implemented) digital ID is that it is simply an authentication mechanism, in this case run by UK.gov. As much as it would be possible to log when and where said ID has been used (and it would make sense to do that, whereby you yourself can view your history), that's the most that should be done by UK.gov. It's up to whatever organisation wants to participate in digital ID to perform authorisation on whether they allow digital Bob to use their services or not, the government simply provides verification that digital Bob really does represent real Bob.

Re: HMRC Down

Well you've proved the point, Digital ID will make zero difference to how you access your money today (which sounds like you go outside and visit physical branches or cash machines).

Digital ID is unlikely to be used for getting cash out (although it could be used to verify you are the card holder rather than entering a PIN). It's just another way of identifying yourself, supposedly more secure than a passport or driving license.

Re: HMRC Down

That's exactly my point, that which works now without digital ID won't suddenly stop working or degrade if/when Digital ID arrives. The nay sayers that jumped on Kier's "make it easier to access your money" seem to have turned this into it somehow would be harder to access your money without Digital ID (if/whenit exists) - well yes comparatively, but no harder than it would be today.

Re: HMRC Down

Might or might not do, but everything you can do now without Digital ID would still be do-able (or not thanks to AWS).

Re: An Age Thing

And that's how the 'Internet' works today.

What has changed is the definition of said Internet, from the original interconnected network(s), to meaning the applications which rely on the Internet to function. In this case the Internet didn't suffer any issues, however an application which uses the Internet to work did have an issue.

Hyundai: Want cyber-secure car locks? That'll be £49, please

Re: Why is it so insecure?

Not a bad idea. My thoughts are to essentially measure roughly the RTT. Difference between half a metre and 20m should be easy enough to detect. Communicate with the key to set up a pre-configured encrypted 'ping' packet which the key loads into its transmit buffer, then the car says 'go' and counts the ticks till the reply is received.

Re: Why is it so insecure?

The exponential 'blocked' would be a nice DOS, unless you still get a physical key to open at least one door.

Also would likely be triggered if you just parked for a while in a busy car park.

Re: Keyless ignition

For Volvo at least a single press gets you to 'ignition 1' mode. Took me 10 years to discover it was possible to have the headlights on without the engine running (for alignment) - press and hold the start button to get to 'ignition 2'!

Problem PC had graybeards stumped until trainee rummaged through trash

Under normal circumstances one would dispose of said rubbish appropriately, not in drawers. Disposing in drawers indicates a likelihood that said person had things to hide, such as their (hardly destructive but OK this was Windows...) casual games.

Apartment living to get worse in 5 years as 6 GHz Wi-Fi nears ‘exhaustion’

Isn't this a use case where 60 GHz would shine? It's attenuated by almost everything so no issues with noisy neighbours, the only downside is you'll need a AP in every room and as such new builds should be designed with a comms cabinet in each flat that features CAT6/7 to every room*.

That's the spec anyway, cue the builders seeing it and translating to ah this telephone wire we've got oodles of should be good enough, looks similar, made of metal, twisted...

Techie diagnosed hardware fault by checking customer's coffee

Re: Dog barking when phone rings

A bully?

New SSL/TLS certs to each live no longer than 47 days by 2029

Re: Why not...

When I was a rather fresh sysadmin I got asked to install a local Kerberos/LDAP login system for a few Linux machines. This involved generating certificates and keys and whatnot... I set the certificate age to 10 years and thinking that was about 35% of my current lifetime it would be good forever (ahem *cough* 10 years). Cue a few years back suddenly reports of logins not working, which seemed weird as I hadn't changed anything lately. After a bit of debugging it became apparent a certain 10 year certificate had expired - cue grasping around for my notes to make a new certificate. Except this time I've set the expiry shorter, made better notes and aim to refresh the certificate annually so as to have the procedure 'fresh'. So yes, shorter certificates get my vote.

DIMM techies weren’t allowed to leave the building until proven to not be pilferers

Re: "Details simplified as the culprit was convinced of theft."

Smarter than my current employer was back when I was still in primary school.

Got raided for the RAM.

Bought replacement RAM for all the computers.

Week later, got raided again for the (new) RAM, as obviously the never-do-wells knew it would be replaced.

After this security was upped.

Well this was Sweden where back then people were surprisingly trusting (and society worked well based on that), compared to these days...

Man who binned 7,500 Bitcoin drive now wants to buy entire landfill to dig it up

Whilst true, my very basic knowledge of gases is that whilst helium is incredibly slippery and escapes almost anything, the point of the helium being there in the first place is it offers lower resistance to the spinning platters compared to regular air. Once the helium leaves, it's going to be a vacuum assuming the drives are sufficiently sealed to not let anything else in - but would helium really want to leave an area of lower pressure (the now leaking drive) to migrate to a higher pressure? That's not what gasses like to do.

Tiny Linux kernel tweak could cut datacenter power use by 30%, boffins say

Re: If you're pushing data out 100 GbE ethernet interfaces

You can flood a 100 GbE interface with a single core, but this requires kernel bypass techniques - DPDK or libVMA to name a couple. At high packet rates the context switching between userspace and kernel is a significant overhead which these schemes avoid, with various disadvantages on the way so they aren't completely plug in replacements.

Wonder how this compares to good old interrupt moderation? Sounds like a similar idea - instead of interrupting on every interrupt, wait for either X interrupts before the application is interrupted (heavy traffic) else if Y time has passed since it was last interrupted (light traffic) fire an interrupt.

Devs sent into security panic by 'feature that was helpful … until it wasn't'

A (Swedish) remote desktop application Thinlinc 'helpfully' translates the dialog to whatever country it believes you're in, not by locale in your computer but based on geolocating your IP. So good luck should you say visit South Korea and need to fire up Thinlinc (OK the dialogs are predictable so you can guess what it's saying). The daftest part is there is no option to configure this!

Cards Against Humanity campaigns to encourage voting, expose personal data abuse

Re: "We formed a Super PAC and bought the personal voting records of EVERY AMERICAN CITIZEN..."

But without voter ID was it really you who used your vote or did somebody else use your vote simply by pretending to be you?

Did you hear the one about the help desk chap who abused privileges to prank his mate?

Ahh sometime in the early 90s my dad had a jar of coffee in his cubicle. Over time he was suspicious that there seemed to be less coffee in it when he opened it in the morning than there was the last time he closed it the previous day. Not one to let the mystery continue unsolved he placed his camcorder somewhere out of sight, with a view of his coffee jar and left it recording one evening after he left.

Mystery solved, it was the cleaner that done it!

Showed the video to his boss and wanted something done, boss was obliging but his managers said that as the evidence wasn't captured on company equipment there was nothing they could do. Strangely though the coffee after this stopped disappearing on its own...

Re: Early days

These days that mistake in the UK would see you locked up!

Honest guv, was just meaning to nip to the pub for a bevvy.

AMD reverses course: Ryzen 3000 CPUs will get SinkClose patch after all

I've got a few AMD systems at work, Threadripper and Epyc. From investigating this it seems the Epyc chips have patched microcode available now for Linux which can be loaded via the kernel at boot. Anything not Epyc needs to come in the form of a new BIOS. Thus it's all well and good AMD supporting the 3000 series with a patch, but how many manufacturers are going to have a BIOS update for this?

Does Windows fair any better in getting microcode updates for the non Epyc chips?

As of now, Supermicro have no recent BIOS updates for my AMD systems.

Core Python developer suspended for three months

Re: Bad journalism

The CoC writers best not ever visit Sweden via rail lest their train terminates at a terminus, which is called in Swedish, slutstation. They'd be scarred for life!

Angry admins share the CrowdStrike outage experience

Re: I never heard of CrowdStrike

Ditto despite having just realised they sponsor Mercedes F1, having watched every session for I don't know how long, it seems I never registered the perhaps odd name "CrowdStrike" on their livery - is that what ISIS call a suicide bomber's job?

Re: Who, me?

And after being sacrificed at Boeing, given the golden shower (OK can't remember what the correct giolden thing is for this) with a job at Spirit AeroSystems as QC manager.

Re: Holidays

It's not Grub that keeps old kernels around - Grub simply offers whatever kernels it finds during grub-mkconfig. It's your distribution that keeps a (typically) previously working kernel around fot Grub to find and offer to boot from.

Game dev accuses Intel of selling ‘defective’ Raptor Lake CPUs

There's broken and broken. Celerons were (initially) fully working CPUs identical to the PII but where the on-slot cache had failed and thus was disabled. Result being a lesser CPU due to lack of cache but 100% functional, and priced accordingly.

Julian Assange pleads guilty, leaves courtroom a free man

If it was so water tight, why was he not detained when he asked wether he was OK to leave Sweden? The simplest option would have been to say you can't leave Sweden, and if he left he would then have an arrest warrant served for leaving when not allowed. That's not what happened though as they clearly said he was free to leave.

Re: "certain types of journalism won't be tolerated"

Better go look at the facts before telling a good story. He was questioned whilst in Sweden and asked whether it was OK for him to leave Sweden, to which he was told that was fine. He left, as per his pre-scheduled plans. Sometime later the Swedish prosecutor decided she wanted to formally interview him and so issued an arrest warrant at which point Assange moved in to the embassy.

Volvo recalls all of its 72K EX30 cars due to software bug that obscures speedometer

Re: "Sweden-based car manufacturer"

Volvo (cars) still have their HQ in car-hating Gothenburg, in the same location as one of their main factories and where most of their R&D happens. Sure Geely owns the brand and has input but on the ground it's stil very much Swedish.The recent-ish change on the interior (knobs to Ipad) could be blamed on the changing demographic of Sweden, all these touch-screen Ipad loving foreigners influencing the Swedish design hmm.

Re: I am SO happy to have a classical speedometer

My 2013 V40 has a digital instrument display, and smallish (it's the larger option) infotainment display. I've set my infotainment to show the speed in the corner, and I guess it's more a me thing (takes a long time for me to read an analogue clock such that the time one processed is no longer valid :) but I always glance at the infotainment for the speed and ignore the actual speedo.

When I first heard about this I thought "so what", assuming the instrument display existed, but discovering that IS the instrument display, well like most people I hate touch screens in cars with dynamic menus and screens. If I want the volume up or down, there's a button or knob that does that job and that job only. For heating, cooling the same, no need to look where my hand is, my hand goes roughly the right place and can feel to get the correct button. Try that on a touch screen.

Indeed who actually designs these things? (I should ask some of my former colleagues that defected to Volvo...).

Two cuffed over suspected smishing campaign using 'text message blaster'

Re: S P A M

Oh the days when you could safely text whilst driving - you could feel you were on the right button, press it sufficient times to get to the letter you want, pause, repeat, send. Obviously reading replies wasn't very safe...

Recycling old copper wires could be worth billions for telcos

Re: Financially viable?

£FreedomUnitsFTW

Oh wait should I be using a hash tag or a pound tag? Completely confused.

It's all about the Reg units anyway...