Posts by Crypto Monad

Airbus keeps an A350 flying for 24 hours

With the cruise speed of an A350 being M0.85 (according to Wikipedia), then you're only looking at a 13% time saving these days.

That would be 90 minutes off a 12 hour flight (with ~11 hour cruising). Nice to have, but I don't think many passengers would pay extra for it. Most aren't bothered by the longer flight times from having to avoid Russia and Ukraine these days.

Flying in the tropopause would be cool though. I once flew in a commercial airliner at 43,000ft and the curvature of the Earth was quite noticeable.

Re: No Standing Forward of this point

ISTR there was originally a proposal for having a standing configuration on the A380 to pack in 1000+ passengers, albeit for short-hop flights like Bangkok to Phuket.

Re: Military is used to In-Flight Refuelling, but...

I wonder how long until some civilian passenger carrier decides AAR is a reasonable decision some day and everybody must be trained to perform it.

The cost of providing the tanker plane and pilot, and the fuel burnt in its own takeoff and landing, means it will be much cheaper just to land and refuel.

An extra hour or two on the ground is the passenger's problem. An extra hour or two of crew duty might be more problematic, but actually it's an opportunity to change crew anyway, as well as restock the lemon-soaked paper napkins.

Dev who gave HashiCorp its name returns with a faster terminal multiplexer

Sounds rather like mosh

Mosh lets the application write into a remote text screen buffer, and then syncs it to the client. The client can disconnect and reconnect, even on a different IP address, and the screen refreshes and continues where it was.

If the mosh client notices keystrokes being echoed then it starts doing speculative local echo - which can be undone automatically with the next screen refresh. This means that it feels very fast for interactive use on long-latency connections. Also, if the server splurges large amounts of data to the console, you can hit ctrl-C and it finishes immediately, because you're not having to wait for the whole stream to catch up.

The main downside of mosh is that the remote screen buffer doesn't support scrollback, so you're basically forced to use something like screen or tmux as well - in which case you might as well just use that instead. The feature request has been open for 14 years.

As far as I know, mosh does not support GPUs or AI. Thankfully.

Dev accidentally commits Copilot binary to FreeBSD ports repo

Re: VCS Wars

There's another XKCD which could apply to this proliferation of gitalikes: XKCD 927

Lessons from the VMwars – nothing virtual about the Broadcom vs Tesco slugfest

And you get Clubcard points too.

Torvalds challenged the haters to fork Linux. Someone said 'hold my beer'

Re: Inquiring Minds Want To Know...

I wonder why 0.11 in particular was chosen as the base?

If they'd ported Linux 1.2.13, that could have been really interesting - it was arguably the most stable Linux kernel of all time. (But for single core CPUs only - no SMP).

Prominent Haskell defector pilloried by anti-AI purists

Re: "I Can Code More Functionality in Less Time Using Language X!"

One of the benefits of Haskell is that if you can get the damned thing to compile in the first place, it almost certainly works correctly. I would have thought that was perfect for AI use: AI writes something, gets an error from the compiler, fixes it or tries a different approach, repeat until it works.

Getting an AI to write Python is like creating a ticking time bomb. Errors lurking in a line of code generally aren't detecting until that code is actually run - and some of that code may only run in rare circumstances, giving you latent bugs which are also hard to reproduce.

Yes, there are optional type annotations in Python, but even if you use them it's still not as robust as Haskell.

If the AI is so good, why not ask it to work on speeding up the Haskell compiler?

It's looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns

"According to Lorenc, 95 percent of the code in any of these codebases is open source."

Don't forget the obligatory XKCD

Portuguese bank sign's storage is about to cash out

Re: Anyone else?

I don't know why the downvote, this is definitely broken (presumably Javascript or webasm). You can get the image directly here:

https://image.theregister.com/5263199.webp?imageId=5263199&x=0.00&y=0.00&cropw=100.00&croph=100.00&width=1412&height=1216&format=webp&width=2118&height=1823

Researchers drop checkm8-style BootROM exploit for A12 and A13 iPhones

Re: Sounds like a good thing!

And so will law enforcement and border security who confiscate it.

I don't see how that makes a difference: law enforcement and border security can in any case compel you to decrypt your device, or throw you into jail if you refuse. (In many places anyway, including the UK).

If that's your threat vector, then use a burner phone for travel, and/or be careful what you store on your device.

Sounds like a good thing!

Owners of these particular devices will always able to jailbreak them, and therefore run whatever software they like, regardless of what Apple tries to do to stop them. Meanwhile, the risk of an "evil maid" style attack remains very low.

Use of HMRC's taxing IR35 status tool drops 71% in two years

In 2022, the Public Accounts Committee Committee (PAC) found that central government was spending hundreds of millions of pounds to cover tax owed for individuals wrongly assessed as self-employed. "Government departments and agencies owed, or expected to owe, HMRC £263 million in 2020-21 due to incorrect administration of the rules," the House of Commons spending watchdog said.

If the government is paying tax to itself, what difference does it make?

macOS 27 beta boots Asahi Linux off Apple Silicon

Re: Bad Apple

It's more arm-twisting than that: "you will contractually install Windows on *every* PC you sell, otherwise we won't sell you *any* Windows licences"

Re: Bad Apple

A retail copy of W11 Pro will set you back over 200 of your favourite major currency, so what margin is a cheap PC maker making?

A cheap PC maker pays a tiny fraction of that for their Windows licence. That's why you can pick up "OEM" licences dirt cheap on the grey market (they're not supposed to be resold to end-users).

Angry devs vow to flee GitHub Copilot as metered billing takes hold

And therefore, if it saves them even 1 hour per month, it's got to be worth at least $100 per month - that I guess is the selling point. People buy multiple monitors or fancy keyboards to make themselves even a tinier bit more productive and/or comfortable in their work.

Personally, I'm more comfortable with an editor that just accepts my keystrokes verbatim.

AI eyes scanning for bugs create a worrisome Linux security trend

Tannenbaum was right. Running 18 million lines of low level code in one privileged space is silly and we should stop doing it.

Indeed. The obvious question is, "why could some random crypto module modify data in the VFS page cache?" and the answer seems to be "because it's too hard to protect one part of the kernel from another".

At least there is now modulejail to block autoloading of the thousands of kernel modules you almost certainly don't need.

Cloudflare to fire 1,100 staff whose jobs just aren’t AI enough

ISTM the senior management are the ones that should be worried. If an AI can make rational, evidenced-based decisiions directly in the long-term interests of the company and its investors, whilst staying fully within legal constraints, then it can do a better job than most managers with their prejudices and blinkered vision.

The people who are safest for now are those who work directly with the real world: plumbers and electricians, cleaners and carers, nurses and paramedics.

You too can build a nuclear battery from junk you have lying around the house

The article did say "wrap them in tin foil to block out the light"

And I wondered "why?"

Surely, any extra incident light is a bonus, not a drawback?

IPv6 carried half of internet traffic – for one day, according to Google

"Dominant"- for whom?

"Google’s result is therefore notable, and nice, but not solid proof that IPv6 has finally become dominant."

It's only "dominant" depending on where you look.

The Internet has split into two. One side is a TV broadcast network, with companies that use the last-mile ISP connections to deliver their content to end-users (Google, Apple, Facebook, Spotify, Netflix, X). Most of these have implemented IPv6, and because they account for the majority of Internet use by traffic volume, this handful of companies can make IPv6 usage look significant.

This is combined with the fact that many mobile access networks have gone IPv6, using NAT64 to access any IPv4-only sites. These operators have such huge numbers of users that they're going to have to do carrier-grade NAT anyway, so they might as well do NAT64 rather than NAT44.

However, the original side of the Internet is arguably more important. It's where you'll find thousands of banks, shops, news sites, and enterprises of all sorts. These are the ones which are not deploying IPv6, and with rather good reasons:

1. Having IPv6 in itself offers zero benefit, because the whole Internet is reachable on IPv4 anyway.

2. However, running two networks side-by-side carries a real and ongoing cost, with real security and management consequences.

3. Dual-stack and happy-eyeballs can degrade the user experience through timeouts and failover, basically because IPv6 problems never get properly noticed and fixed. If you can deliver a faster and more reliable experience on IPv4-only, that directly translates into more customers and revenue.

Or to put it more succinctly: dual stack is the problem, not the solution. If you were to use dual stack to migrate *from* IPv4 *to* IPv6 (i.e. add IPv6 to your network this week, remove IPv4 next week) then it would be fine. But as a "forever" proposition it's horrible. You can't migrate fully to IPv6 without cutting yourself off from the IPv4 Internet, which is still where you'll find the vast majority of sites by number, if not by traffic volume, so you end up having to keep running both.

Aside: as I type this into The Register, my IPvFoo plugin tells me it's IPv4-only. And that's on the *content provider* side, where dual-stacking is a doddle, relatively speaking. And from an organisation which has a specific interest in technical issues. Clearly, it just keeps getting pushed to the bottom of the pile.

SaaS-pocalypse chatter is doomster pr0n. It would be nice if enterprise IT were boring again

I am confused why Microsoft is down 30%, it's not like anyone is going to vibe-code their own in-house Teams/Office360.5/OS

Perhaps because Microsoft itself owns a large chunk of the AI bubble? When Amazon made a large investment in AI, their stock went down markedly too.

It's an interesting read, but I can see several weaknesses in their arguments.

1. Every business starts to write their own software instead of spending $500K/yr on SaaS fees. However, the Anthropics and OpenAI's of this world who make this possible will be looking to capture a substantial portion of that $500K. You replace SaaS with AIaaS, and the more you're hooked, the more they'll take. Also, when your AI-software breaks, or screws up a high value transaction, there is no accountability - you are on your own to support the resulting mess. (Or you need AI to do that for you too). Liability is the brake against in-sourcing; it's one of the reasons people have been outsourcing.

2. AI agents will act purely in the interests of consumers, and hence destroy the sellers. Why would they? Surely the purveyors of the AI agents will make them act in their own interests, in the same way as Google results are skewed by advertising: the agents will send customers to the seller that makes the agent the most commission, not the one that offers the best deal to the consumer. After all, the consumers are unlikely to pay for the agents, any more than they pay for search.

3. Visa and Mastercard will fail because blockchain is cheaper. There's nothing about blockchain which makes transactions fundamentally cheap: indeed, quite the opposite. All that Visa and Mastercard do is to record transactions in a database. It's possible that more challengers will spring up, in the way that Paypal, Wise and so on have already done. But much of that 1-3% credit card transaction fee goes on fulfilling legal requirements, consumer protection, covering bad debts and so on. You can in any case do bank-to-bank transactions essentially for free today already.

Open source devs consider making hogs pay for every download

The problem is laziness.

"git pull" is almost free, bandwidth-wise; to update a local copy of a respository, it only fetches the differences from your local copy.

The problem is these people are building CI/CD pipelines which start from fresh state and do a "git clone" from scratch, every time. Not only are they fetching the latest version of everything, if they omit to do a "shallow" clone then they're also fetching the entire version history.

The solution is simple:

1. Keep your own git copy of the code you use, and refresh it via "git pull" periodically.

2. Point your CI/CD at your local git copy. Clone it as many times as you like, nobody is affected.

IMO there's no need for a pricing model. As the article says, the offenders are the big hyperscalers; they easily have the resources to do (1) and (2). In principle then, the solution is simply to block out the big consumers who keep cloning over and over again.

However, this still requires users to register, and there's a risk of some people using throw-away registrations as a way to work around the blocks.

Attackers have 16-digit card numbers, expiry dates, but not names. Now org gets £500k fine

> "DSG acknowledges that it, as an organization, could make the link between the card data and real individuals, but says the attackers could not."

And by Curry's logic: if they had also lost your National Insurance Number, your date of birth, your telephone number, your E-mail address, or your shoe size, none of that would be personal information either.

Google's dev registration plan 'will end the F-Droid project'

Re: Now Google starts _exactly_ the behavior that made me avoid Apple ...

It's not lack of decent programmers, it's risk-aversion.

Google scares them by saying "if your app runs on a rooted phone, then the app can be compromised and made to fake transactions". So the banks respond by intentionally making their apps detect rooted phones, and refusing to run on them.

OK, so Anthropic's AI built a C compiler. That don't impress me much

Re: 'Devs aren't nearly as won over'

Alice can tell him to keep quiet.

Cisco looses Splunk to probe and tame its growing agentic menagerie

Re: The only secure AI...

Cisco on the one hand sells you AI agents with super-admin rights to manage your network; and then on the other hand sells you tools to protect yourself from these AI agents with super-admin rights that you have let loose within your network.

Anthropic's Claude Opus 4.6 spends $20K trying to write a C compiler

I think this is only possible because there are existing standards documenting the C language in reasonably formal detail - and many existing test suites which (I expect) would be re-used.

Using vibe coding for some vaguely defined task like "build a business automation system" is likely to be much harder. SAP need not worry just yet.

How the GNU C Compiler became the Clippy of cryptography

-O3 being dangerous strikes me as somewhat absurd. If the compiler is building code that does not implement the as-written source's functionality, then it's not acting as a C compiler. Instead, it's acting as a nearly-but-not-quite C compiler that goes wrong in exciting and arcane ways.

It doesn't "go wrong". It transforms your code so that it does the same thing but faster. That's unless:

(1) you're doing something which has "undefined" behaviour in the C spec (which is quite a lot). In those cases, the compiler can make the code behave more or less however it likes. But then, the behaviour is undefined with or without optimization.

Some examples: https://mohitmv.github.io/blog/Shocking-Undefined-Behaviour-In-Action/

(2) you're doing something which depends on timing, which is the case here. The C spec has nothing to say about timing of the generated assembly language, and as long as it gets the same results according to the spec, it can shuffle things around.

Note that this is not limited to gcc. Clang can give equally surprising behaviours:

https://research.swtch.com/ub

To reiterate, this is *not* a bug in the compiler. If anything, it's a bug in the language which explicitly permits your code to be transformed in ways you don't expect.

IPv6 just turned 30 and still hasn’t taken over the world, but don't call it a failure

Re: Optional

> Since Google sees more than 49% of its users connecting via IPv6, and that doesn't include China, it's more of a success than a failure.

The Internet has split into two.

There's a TV broadcast network: Google, Apple, Netflix, Spotify, Facebook. These sites account for a large propertion of total traffic by volume. These install CDN nodes very close to the customers - often inside the ISP networks. For them, Internet is just "last mile" content delivery; they often have their own private links between data centres. And these are the sites which have deployed IPv6.

Then there's the rest of the Internet: where you find banks and shops and restaurants and other businesses. Most of this part does *not* run IPv6.

So it's not surprising that Google see a substantial proportion of IPv6: it reflects that a sizeable proportion of Youtube watchers have dual stack at home (usually without realising it). But offices, hotels, enterprises ... not so much.

Re: Backwards compatibility

"And that notional committee made one more critical choice: IPv6 was not backward-compatible with IPv4, meaning users had to choose one or the other – or decide to run both in parallel.

For many, the decision of which protocol to use was easy because IPv6 didn't add features that represented major improvements."

That's not the reason at all. The reason IPv6 is not used is because IPv6 was designed to *replace* the Internet, instead of *extend* it. And the Internet had already become too important to replace.

Network builders don't have a choice between IPv6 and IPv4. They have a choice between (IPv6+IPv4) or (IPv4 only), since IPv4 is where the majority of Internet content is. Even if it were the minority, you'd still want to reach it. A customer who can't connect to their bank will report this as "My Internet connection is not working".

In which case, the choice is obvious: (IPv4 only) is simpler, more reliable, easier to debug and maintain, and therefore cheaper, than (IPv6+IPv4).

It *is* kind-of possible to build an IPv6-only network today and have it talk to the Internet, but you need a NAT64 gateway, and you need clients which are able to use it: macOS/iOS/Android can, but Windows still can't (*), and Linux can't without a load of hacks. Also, you still need an IPv4 address on the outside of your NAT64, which means you still need IPv4 somewhere in your network. In that case, you might as well run NAT44 instead.

IPv6 also changed things that didn't need changing, like replacing ARP with NDP, and trying to replace DHCP with SLAAC (but ultimately being forced to run both side by side); these are minor annoyances that turn people off IPv6. But fundamentally it's a business issue: do you want to run one network or two? If you want to connect to the Internet, you need IPv4, but you don't need IPv6.

Finally, don't claim that you need IPv6 to access IPv6-only websites, because they won't exist, apart from <tt>loopsofzen</tt> and a few cat feeders. Eyeballs equal money, and any site that wants eyeballs must be accessible from IPv4 clients. Fortunately, this is easy and cheap, because CDNs can host an unlimited number of sites on the same pool of IPv4 addresses. And even if you had to pay for a real IPv4 address for your website, this would still be far cheaper than the millions companies are paying for a cool-sounding domain name.

Aside: I am a techie. I do run dual-stack at home. I like having direct access to my VMs from outside, if I happen to be on an IPv6-capable network. But I can understand why the vast majority of enterprises in particular are not bothering with IPv6; dual-stack is significant cost for zero return, and single-stack IPv6 does not work for many important use cases.

(*) Unless you spoof DNS with DNS64, and that doesn't work in all cases.

Stop the slop by disabling AI features in Chrome

Re: Chroming

There's a nice touch from Google. One of the AI mode settings is:

AI Entrypoint Disabled on User Input

Hide the Omnibox entrypoint for AI Mode while user is typing. – Mac, Windows, Linux, ChromeOS

And the choices are "Default", "Enabled" or "Disabled".

So: if I want to disable the AI Entrypoint on User Input, do I need to set "AI Entrypoint Disabled" to "Enabled"?

Memory is running out, and so are excuses for software bloat

Re: Of course Linux users

Around 1994, an 80836 machine with 2 MiB of RAM could happily run Windows 3.11 (a.k.a. Windows for Workgroups), and Linux kernel 1.2.13 would run well on a similarly spec'd machine.

The smallest Linux these days, something like OpenWrt or ddwrt, is unlikely to work with anything less than 64MiB of RAM.

Re: Lovely idea - no chance of it ever happening

Presumably you mean 48KiB, not 48Mb ?

Microsoft wants to replace its entire C and C++ codebase, perhaps by 2030

Re: Why use AI to convert from c/c++ to rust?

The only reference for what this code is *supposed* to do is the code itself. Therefore, the best that can be achieved automatically is to faithfully reproduce all the existing bugs - which may require writing very tortuous Rust code to achieve.

OTOH, if the objective is to write idiomatic and safe Rust, then how will the AI tell the difference between a bug, where behaviour has to be changed to match intent (such as removing a security flaw), and a feature (i.e. some aspect of behaviour which consumers depend on, and cannot be simplified away)?

New Jolla phone and Sailfish 5 offer a break from iOS-Android monotony

Re: Once bitten...

I won't be buying any crowdfunded communication device again.

I bought one of the early Planet Computers "Gemini" devices, with a built-in keyboard (funded via Indiegogo). After a single upgrade to Android 8.1 a few months after initial release, they abandoned all further software updates. As a result, it rapidly became useless for things like NHS, banking apps etc.

Bizarrely, they are still selling trying to flog the remaining few units. The wifi-only version at least appears to be still in stock.

Apple blocks dev from all accounts after he tries to redeem bad gift card

Re: Let the buyer beware.

My guess is: he's one of the refuseniks who has decided not to attach a credit card to his Apple account, which is why he needs gift cards to pay for things like iCloud.

Apple have made it very hard these days *not* to attach a credit card to your account, and perhaps they now flag such non-compliant behaviour as deviant or malicious. We're Apple: you must trust us with direct access to your financial instruments. And if you don't, tough luck: we'll lock you out of the whole ecosystem.

Developer puts Windows 7 on a crash diet, drops it to down to 69 MB

"would it be a problem to run a basic CLI app that only needed the Windows kernel?"

Then why not just run DOS?

AWS admits more bits of its cloud broke as it recovered from DynamoDB debacle

> what is commonly being described under the current leadership as a rouge state?

I would say more orange than rouge.

MX Linux 25 reaches beta testing – complete with systemd

Re: Can't help thinking

Given that the big vendors have pretty much all gone with systemd, you can expect any desktop Linux distro without it to be very niche.

But for people who want a mainstream *nix without systemd, there's always FreeBSD.

Back to being FOSS, Redis delivers a new, faster version

Re: RHEL using Valkey...

Keycloak is now a CNCF project, and as far as I can see, is released under the Apache2 licence which is one of the least restrictive open source licences. What are you saying they're doing to stifle commercial use?

Hashicorp is a different matter, they've gone to BSL.

Linux Foundation says yes to NoSQL via DocumentDB

AWS has a service called Amazon DocumentDB, which is a MongoDB-compatible storage system.

As far as I can tell, this and the Microsoft documentdb postgresql extension referred to in this article are completely different things - which gives much scope for confusion, and/or potential trademark litigation.

Docker Desktop bug let containers hop the fence with barely a nudge

Re: Is there a Docker desktop ? Well I never.

Since Docker Desktop changed to a commercial licence, the CLI is the best bet anyway. (Or Podman Desktop, or Colima, or... well, just about anything else)

VirtualBox 7.2 fixes flaky 3D guests and adds Arm-on-Arm support

> virt-manager excels at transparently managing remote hypervisors over the network

FWIW, incus is very good at that too - for both containers and VMs.

The incus daemon needs to run on Linux, or in a Linux VM on other platforms (e.g. see colima), but the client is native across multiple platforms. You just add your Linux incus servers as "remotes". And if you like, running "incus webui" gives you a web interface, via a secure tunnel.

MX Linux 25 loses systemd toggling power as Debian 13 looms

Re: It definitely reduces the appeal ...

A wheel with square corners?

Apple will sue!

Make Redmond angry by setting up Windows 11 with a local account

Re: The next challenge: backup up Microsoft Authenticator WITHOUT giving personal data

Google Authenticator now has an option "Export codes" which lets you export one or more TOTP seeds as a single monster QR code. You just need to scan this into some other device (even just take a photo of it)

Patch now: Millions of Dell PCs with Broadcom chips vulnerable to attack

Re: The biometric elephant in the room.

The problem with fingerprint security is that you leave a copy of it on every object you pick up or touch, so its worse that leaving your password on a sticky note.

The difference is that passwords can be used remotely, whereas fingerprints only have local significance to a device where they have been enrolled, and can only be used by *physically* presenting something that looks like your finger to that device. In other words, fingerprint readers don't accept images of fingerprints sent over the Internet.

Of course, the risks of secret keys unlocked by fingerprints, versus regular passwords, depends on your threat model - but IMO, in almost all cases, passwords suck way more.

If you're paranoid, you can require a fingerprint *and* a PIN or password to unlock your secret keys. Just don't let anybody watch you type your PIN.

Re: The biometric elephant in the room.

So just how do you change your fingerprints once their data is compromised?

You don't need to change your fingerprint, because the fingerprint isn't being used as a key.

The crypto keys are generated and stored inside a "trusted" secure enclave. The secure enclave does all the crypto operations, like signing and decrypting things, without allowing the keys out.

Presenting a fingerprint to a fingerprint reader is just a way to authorize the secure enclave to perform its actions, when it sees a fingerprint which matches a previously registered one. You could just as well require a PIN to be entered. To avoid brute-forcing the PIN, the enclave will usually enforce increasing delays between attempts, and (for the truly paranoid) the key material is destroyed after too many failures.

Now, if the secure enclave is compromised (as the article says is possible), then it's not your fingerprint or PIN that's compromised - it's the secret key material inside the enclave, and the data which is protected by those keys. Which is the actual valuable thing. Note that it doesn't help the attacker attack any *other* system which is also authorized by your fingerprint.

Of course, "gummy bear" style attacks are still a thing, and they're still a weakness of fingerprint-based systems. Like all security systems, there's a tradeoff between convenience and risk. But that's not the risk being discussed here.

Oracle VirtualBox licensing tweak lies in wait for the unwary

Re: Is it for virtualbox or for the extension pack?

Unless they've changed the main Virtualbox download to bundle the Extension Pack - which as far as I can see, they haven't - then this doesn't make any difference to the status quo.

The rule always was: download *only* Virtualbox (which is GPL). Don't touch the Extension Pack with a bargepole.

Scientists spot massive black hole collision that defies current theories

Re: Forbidden

Ergo a colliding pair in the 50 - 100 SM range will result in in one of 100 - 200 SM range. We keep observing collisions. Nothing forbidden about any of that.

Sure. But if these collisions are frequent wouldn't we expect to see a continuous distribution of black hole masses: some in 100-200, a bit less in 200-400, less again in 400-800 etc?