Posts by doublelayer

As Uncle Sam continues to clamp down on Big Tech, Apple pelted with more and more complaints from third-party App Store devs

Re: Another reason why

Not all of that is correct:

"You should check out the Libren brand of smartphones"

Brand is Librem, not Libren. Also, they have only one model of phone.

"by Purism of India"

Purism is based in the U.S. San Francisco, to be exact. Manufacturing for the phone is done in China (or optionally in the U.S. if you're paranoid, have a ton of money, and haven't actually considered whether built in the U.S. fixes your paranoia problem).

"that have a physical kill switch to turn off the phones GPS chip, cell chips and camera chips when those functions are not in use."

Actually, the killswitches work on the mobile chip, WiFi and Bluetooth, and cameras and microphone respectively. GPS is disabled by a separate software-controlled circuit when all three switches are disabled.

Re: These developers seem to forget what some users want

I like Apple's software (some of the time), but let's be honest about it. The comment here is not honest.

"I kinda like how I have a device where I’m able to block third party ad servers comprehensively by default across all apps without having to sacrifice security or vendor support (for example)."

Implying that Apple makes this easier? They don't. I can do that on anything. On device or not. Android has firewall apps. Any desktop OS gives me a lot more control than either popular mobile OS. Apple doesn't even write that software, so why are you giving them credit for letting you run software that runs everywhere?

"I also like how I don’t have to give my card details out to every Tom, Dick and Harry and how I can see every subscription in one central list with the ability to cancel without losing immediate access for the rest of the period."

It's so terrible having to give payment details to people when you want to buy their thing with money. There are one-time credit card numbers you can use to ensure they can't charge you unexpectedly or lose data in a hack. I'm sure it's nice having everything in one place, but just because it's convenient for you probably doesn't justify to others paying Apple for the minor convenience when the heavy lifting is done by the developers.

"Do these greedy developers ever think that as a user, I might want centralised controls?"

Let me ask you a question. Why are the developers greedy? Because they don't want to pay Apple a big chunk of their revenues? When it's the developers who make the apps which make Apple phones valuable (some competing phone OSes received good reviews for OS design but failed to sell because apps weren't there)? The app developer writes the code, makes the content that makes the code useful, maintains the infrastructure that the app uses, all of that. Apple provides a place to download the app package. That's all. No, Apple can't claim that they're charging developers for all the work on IOS, because the users are paying for that when they buy IOS devices. The users get those advantages, not the devs; a new IOS feature doesn't help an app developer as much as it helps a user.

"Besides, people can say what they will about App Store practices, but their approach does have some serious advantages as a result of Apple pushing developers to use consistent development methodologies."

They don't really do that all that much. There are so many different frameworks in use to create IOS apps. Most of them are popular because they allow a GUI to be created once and run on IOS or Android. Apple doesn't prevent anyone from using those, nor has it done anything to improve them. An app can look nice or not as its developer likes, and it will get through review equally well.

The rest of your comment, talking about security, is pretty good. I think that's a fair area to give Apple credit. In almost all cases though, none of those security benefits come from restrictions on developers. IOS can get security updates equally well whether they let in an app that accepts payments or not. Mac OS can sandbox data on disk just fine if the apps get downloaded from the internet. I give credit for those admirable accomplishments to those who accomplished them: the OS developers. Not the App Store review team.

Re: Its about the money

However, that's not how breakups work. They don't say "You're a big company and you abused something, so we're going to bring in some wedges and break it into chunks along existing boundaries". Instead, they find the places where abuse occurred and break along those boundaries. Separating AWS from Amazon shopping would happen if, for instance, Amazon didn't agree to sell a product if it used a different cloud provider for its support system, but that's not how that went. The abuses that are most often used as ammunition are that Amazon's shopping system gives Amazon a bunch of data about other sellers which Amazon then uses to compete against those sellers. The boundary where the break would happen should a case on that basis succeed is the boundary between the Amazon store system and the part which makes products, including Amazon basics and a few other lines.

The same general rule applies with other breakups too. If Apple gets broken up, they're not going to make iPhone Inc and MacBook Inc. They'd make Apple the hardware and OS people and a separate App Store runner. Or maybe they'd leave Apple as it is, with App Store intact, but demand that others can also run stores. Or maybe they'd accept Apple's arguments about the single App Store being a feature but make them change rules and tactics that were abused before. If Facebook were broken up, it wouldn't be small social networks with subsets of the previous members. It would be into Facebook, Instagram, and WhatsApp as separate entities. It all depends on the argument being used to prove an anti-competitive abuse of market power; if the courts agree, the action taken is designed to stop and prevent the abuse in the argument.

Re: Idiot dev

"This is why Apple do not allow it. This is why they make it clear in the license."

I'm sorry, but they don't forbid a trial period. Here is a section of the article:

"The creator was told he had to roll out a payment system to make users input their credit card details before signing up for the trial period. There must also be a specific time limit to the pro version of the app, and once that period was over it must charge its customers money. To get out of it, users would have to explicitly cancel their subscription or else it would keep billing them."

This section outlines what Apple accepts. As you can see, it includes a trial period. Trials are not what they object to. What they appear to object to is that the user would have several chances at a trial. Perhaps instead it's that the app isn't using a subscription model which would earn them revenue. Either way, Apple doesn't seem to have a problem with the trial model as long as it only happens once and customers are enrolled into a subscription beforehand. The second part of that could easily be seen as self-serving.

You might not like trials in software which expire. If Apple forbade them, you might have a leg to stand on. They don't. In my opinion, there is no good excuse to forbid that anyway, but we don't have to have that hypothetical discussion, because that's not what happened.

The curse of knowing a bit about IT: 'Could you just...?' and 'No I haven't changed anything'

Re: Firewall vs router

At the office, the network admin is someone who was hired specifically to do that, the computer I'm using isn't mine, the information I'm processing on the computer is information the company already has, and there's a way to deal with a malicious admin by firing them. An ISP has none of those conditions, so their stuff gets a data stream from a single downstream device which does everything else. Also, any ISP which lets me bring my own equipment without anything from them gets a leg up if I have a real choice to make.

Re: Sorting other people's stuff

Good advice. I can definitely recycle them if needed, and if it's old enough, I do so. The problem for me is the ones that are new enough that they'll run modern software (very well if it's Linux, but Windows 10 will work well enough until too many other programs are added) but old enough that the specs don't sound modern. I don't like to recycle something in such good working order until I've failed to find anyone to reuse them.

Re: Sorting other people's stuff

This is a very good thing to do when people want to get rid of things. Although it helps to have plans for how to deal with the machines afterward. I've recycled machines so often that the charity I used to donate them to has had to tell me that no, they don't want any more computers. It probably doesn't hurt that I've been maintaining the ones they have too so they're also lasting a lot longer. I need to find a new place that wants them. I've tried selling computers on occasion, which sometimes works, but the older ones don't always go as fast as I'd like.

And now for something completely different: A lightweight, fast browser that won't slurp your data

Re: Not Free

Private browsing and Tor are not defenses against JS. Only blocking JS is a defense against it. Depending on the level of worry, it isn't necessary to always do so, but let's quickly review what each of the defenses does and why they're not doing anything about the risk of dodgy JS.

A private window isolates the loaded page from certain data the browser holds. It prevents the server from getting cookies or other browsing data, and it prevents the loaded page from persistently storing that stuff. It doesn't do anything else. Cookies are a server-side tracking thing, not a JS tracking thing. Most fingerprinting techniques implemented with client-side scripts access information which isn't stored in the browser. For example, fingerprinting a device based on system state or capabilities. Blocking it from cookies won't do anything to prevent that.

Tor is even less a defense against client-side scripts, although if you're using it, you probably want to avoid JS too. Tor is a way to redirect traffic through a network of relays such that the place you contact doesn't know what you're looking at, the final site doesn't know who you are, and most observers don't know what you're doing. It protects data in transit, but it will protect that data equally well no matter what it is. Crucially, it does not protect data on a computer. If a script is part of a site, Tor will not prevent it being sent. If that script collects information from the system, Tor will not detect or prevent that collection. If the script contacts a remote server to upload the collected information, Tor will happily pass it through. Tor is a network-protection system, not an endpoint-protection system. If you want privacy enough, go ahead and use Tor and also disable scripting when possible; the former does not do the latter for you.

Re: Not Free

I agree with you about most autorefreshing pages. They're quite annoying when they don't need to refresh. Sometimes, however, it is important that they do so. If any application is written with dynamic information, it probably needs to update or at least warn people about the fact that it hasn't.

Consider a simple system I wrote for someone. There is a form for user requests which includes various details including the time when the request must be completed. The backend lists all known requests, sorted by time, color-coded for urgency, with a field for time remaining, and buttons to mark the request as in progress or resolved. This needs to update itself so that new requests are seen, urgency is updated, and multiple users can mark requests as resolved and have all the participants know about it. If it didn't stay updated, people might duplicate requests, ignore one which has become urgent but wasn't when the system originally loaded, etc. Now it doesn't have to be a website, but something this simple might be done that way just to make things easier.

Re: Folded content in raw HTML

Yes, this is a thing now. This makes it easier to do that particular example. What's worth keeping in mind is that this set of tags is rather new, and for many years, it wasn't available in plain HTML. For a similar reason, HTML5 can embed video really easily, but it still took a while for competing video embedding to die because HTML was so late to the party. JS used to fold or unfold sections will probably die eventually too, but it was necessary so long that it has taken over other things.

Re: Not Free

Sort of, but not really. With CSS scripting, it's possible to get a browser to collapse a section for you. However, it takes many lines of CSS and many sections for each collapsable area. Do it wrong and browsers will get lost. For example, one way I've seen it done will trip up anything automatic reading a page. That includes bots, which you might not care about, but also includes accessibility software. Don't care about that either? Depending on how it's done, it can also find its way into things if your user copies and pastes from the page or converts it to a PDF. Meanwhile, JS code that can collapse areas is really simple. Three lines of source at the top makes it available, and a single link or button can be dropped in to do the job.

Re: Not Free

JavaScript is really useful in some cases. Without it, pages can't do some things that users expect. Then, since the developers already learned JS so they could do those useful things, they try to write everything else in it too and create a monstrosity. That's the short version, but if you're interested, the slightly longer version is below.

Without JS, HTML is basic and static unless the user fills out a static form and submits it for a new page. A lot of the internet can work like that. News sites like this one, for example, really don't need much else. However, there are some things that aren't very complicated to implement but can't be done without scripting. A basic example is dynamically showing or hiding content. Having a button which allows a user to collapse or expand a region means that the page can have lots of things on it without requiring the user to scroll past irrelevant things, but HTML itself doesn't do that. JS can also provide basic data checking for forms, so it prevents users from submitting invalid forms all the time. And if you've ever used a table which can be sorted by clicking the column headers, that's JS doing the sorting*. Initial site developers wanted to do things like that, so JS took off. Later on, JS could also be used to keep a page updated even when data changed at the remote server without making the user refresh the page all the time. As you might imagine, users were pretty happy that they could have tabs open and see updates without having to remember to refresh them manually.

These uses for JavaScript are not necessary, but without them, some sites would be less organized and inconvenient to use. Users would prefer a control panel which is on a single page which can unfold sections when desired and updates dynamic information automatically over one which uses fifty subpages so the interface can fit on a screen and requires the user to refresh every five minutes. However, devs who knew how to do that started trying to do everything else in JS too. Why do the work of writing the HTML so that it at least renders when the JS doesn't run? They instead used someone else's library to do the rendering. The library, trying to be generic, was written in JS and writes most of the HTML when initialized. Without it, a framework page is all that's left. Or they realized that a JS page allows them to collect more information about how people view the page than a static one, so they include tracking scripts as well. It also allows them to embed things from other places by dumping in a convenient script; the other places are usually happy to do so because that gives them the ability to add in their own tracking. In a few quick years, JS had changed from something allowing a page to move around content to better serve the user to something slowing down every page and making it impossible to know or trust what was being done on the computer.

*Table sorting: Making the server reload an entire page just to sort a table is possible but rarely done.

Everybody's time is precious, pal: Sometimes it isn't only the terminals that are dumb

Again, seems unlikely. It's possible that this had happened, but there are several good reasons in my mind to think that it did not. First, the modem has to be near the terminal anyway, so there's a limited amount that can be done. Turning it around helped in this case, but if that wasn't helpful, there's not really another good option available. Second, the content of the call does not lead to that kind of solution. The caller complained that the network had failed. Not that it repeatedly failed requiring a long-term solution, that it had failed this particular time. If I have to solve a "this broke" problem, my solution is "fix it now". If I have to solve a "this keeps breaking" problem, my solution is more likely to be what your idealized client would want.

In any story like this, where the user is always stupid and the IT person always figures it out, it's always possible that people are lying. Maybe the user figured out the turn-around procedure and IT is taking credit. Or maybe the call never happened and someone made it up to tell the story. These things don't sound likely to me though, because we've all experienced people who act like these characters. I've seen people who didn't understand seemingly basic things, or who got irrationally angry at someone solving their problem. I've also seen IT people break a system through incompetence and blame the client. Both happen. The general story therefore doesn't sound implausible to me, so I'm likely to consider it genuine. If I assume that the information we have is truthful, I must conclude that the client is entirely at fault and could easily have stated the problem differently and politely if they knew it (which I doubt they did).

"I'm not going to put the blame completely on the user for this one. Particularly if the user hadn't been allowed by management to move the modem, and by having IT show up and move it he actually got the problem resolved in a more durable fashion."

This strikes me as very unlikely. Sure, IT can be annoying about telling people not to do things ("No, you may not come into the server room and move the wires around even if you think you know that it will help", "No, you may not open the network cabinet and force a power cycle by pulling the power cable just because something sort of network-related isn't working and that works at home"), but I don't really think anyone in management would have a regulation about turning a box on your desk around. They might suggest you not do it in case it made things less organized, but it's not hard to do it anyway and claim an IT person did it. Also, I don't think anyone would notice or care.

Meanwhile, the call described in the article is a very stupid way to handle a hypothetical situation as you propose. If you want IT to confirm that the box can be turned around, it would be much more helpful to remember this and ask them when they're already there. Ranting at the IT person who is suggesting how to fix the problem just makes the caller look like a jerk. If I had been called out like that, I certainly would not have turned the box around; I'd have flipped the switch and left. Problem resolved for now. No reason for me to make things easier for someone who won't do what they've been told (correctly) will fix their problem, shown me profound disrespect, and didn't even think about the inconvenience of making someone come in a rainstorm to do something unnecessary.

Yes, Microsoft Access was a recalcitrant beast, but the first step is to turn the computer on

Re: I'd be shocked if ...

And what would that have been? No matter what database server you use, the machine running it has to be turned on. There are two good solutions to this: a server in a place where you can't easily turn it off and a redundant server which can withstand one being turned off. Either approach costs money and causes extra complication. A standard small business has tons of single points of failure. The network connection to the office might get severed. Power to the office might fail. A water leak could force an evacuation. Someone might forget the key to unlock it while the person with the other key is off on holiday. Each and every one of these will borke the workflow more than a database going down, but somehow the database needs to be more resilient anyway?

My website has raised its anchor and set sail into the internet oceans without me

Re: Nether web

Of course it's not. It's a basic bot that only collects pages in a certain order if it can find accesses to them, sometimes forgetting something or following a zombie link and filling the database with garbage. But you find me anyone else who does anything remotely as good. Google might have it, but I can't exactly use it for my purposes. Similarly, I have some pretty intensive crawls of a couple sites which were important to something I was doing at some point, covering about 0.0000003% of the internet (only static files). Only the Internet Archive really has anything like it available to the public and offering general coverage.

And you thought that $999 Mac stand was dear: Steve Wozniak's Apple II doodles fetch $630,272 at auction

I can't say I have. Among other things, I can see a diagram of a proto-submarine on a monitor with equal clarity to the paper. I can't do that with a painting or tapestry, which is why I consider them different. Also, that is a diagram which the general public can easily grasp. The papers in this article are very different, and include such details as "five pages of circuit schematics and notes on sheets of graphing paper; six photocopied pages headed 'Bus Sources,' 'System Timing,' 'Display,' 'Sync Timing & Adr. Gen,' and 'Timing,' featuring several annotations; and a 12-page handwritten programming instruction guide consisting of 28 detailed steps." Those things, to me, don't sound special enough that the original is any more special than a copy, especially as a quarter of it is already copied. That's just my opinion, but if I were setting up a museum, I wouldn't be at all concerned with getting the originals and I might not put all of that on display at all, instead opting for the suggested exhibit in my previous comment with a web address available for interested people to read them at their leisure.

I see the point, but I don't know if that matters all that much. A museum holding an original painting can at least show something beautiful to its patrons. A museum holding an original circuit board doesn't look very different from a museum holding a reproduction of the circuit board, which shouldn't be that hard to make. Better yet, a museum holding a reproduction of the circuit board in a glass case and an emulator of the running system next to it, perhaps running software from the time. That would probably be more interesting and educational to patrons.

It's even less necessary when the item is a bunch of papers that had engineering documentation on them. Most patrons won't want to read all of that anyway, and even if they did, are you going to post them all on the wall? I'm guessing we already have pretty good scans of those which can be published online (or if you insist next to the reproduction and emulator).

Elon Musk says he tried to sell Tesla to Apple, which didn’t bite and wouldn't even meet

Re: Offered to sell the company for 1/10 current market value

Sort of true, but limited. Apple's cash did bail out the commercial failure that NeXT was going to be, but Apple also did that because they needed something that basically only NeXT could and was willing to provide. Their OS was too limited and, in their mind, in need of replacement. Writing a new one from scratch would have taken too long to finish, so they shopped around for companies which already had a new OS they would view as an improvement. NeXT's eventually won out for various reasons including its Unix compatibility. So Apple was looking for what NeXT could provide at the same time as NeXT was looking for a bunch of needed cash. In Tesla's case, they were the only one looking around; either Apple wasn't really building a car in which case they didn't need Tesla, or they're already working on their own so they didn't need Tesla. Either way, this one is a lot more one-sided.

Search history can calculate better credit ratings than pay slips, says International Monetary Fund

Well spotted. I wasn't very familiar with SNI's details and got that wrong. Thanks for the correction.

A few other methods of identifying a site I didn't think about last time include checking for differences in transfer sizes that might be connected to cookie usage, tracking frequency of requests to identify how much active content is on the page being accessed, checking packet latency and overall transfer speed to get information about the server and whether it's under load or not (this may make it easier to identify), or cross-referencing with other users' traffic which may be less secured.

For now, they know:

1. The DNS queries for the specific domain and all the domains it pulls in. Until DoT or DoH, they'll keep having that.

2. The SNI requests which contain the domain name and the first page URL you request. If you type in a domain name, they get it and "/". If you click a link from a search engine, they get the whole thing. Until ESNI or one of the other suggestions takes effect, that will be available to them.

3. The destination IP. This may be a CDN, but not always. Plenty of people use a server dedicated to network requests which makes it obvious who runs it. Others will run multiple sites on a single server but not on all the other servers, meaning that only that server needs to be interrogated to figure out what the possibilities are.

4. The size and timing of requests. They probably don't go this far, but if they have a server to test, they can try certain likely pages until they identify the one requiring the right number of assets from the right locations. Sites that bring in images and scripts can fingerprint themselves in that way.

Trump administration says Russia behind SolarWinds hack. Trump himself begs to differ

Re: "Or do all Russia-based hackers sit in the pocket of Kremlin?"

"'Fingerprints' is very vague and hand-wavery. An example or two would go a long way..."

Examples of how attribution is done include things like these:

1. Does the code look like stuff you've seen before? At a basic level, is there an exploit that someone has used before but few others know about? If so, it's more likely to be them. At a more detailed level, drill down into the assembly and look at modules. Stuff gets reused or updated. Even a pattern of names may be illustrative. There is usually not a need to go to sufficient effort to change your entire coding style to frame someone else. If you've developed a great file spider that can quickly identify stuff of interest for exfiltration, you might decide to put it into multiple malware distributions rather than rewriting it from scratch; if your obfuscation isn't good enough, that may link them both. Attribute one to you, and the other connects too.

2. How did the code get onto the victim's systems? Was an exploit used? How about a botnet? Who do we know who has done that before? If we have a location of the source, what do we know about it? Who purchased the server? Do we have any information from historical network scans? Sometimes people are careless and information they didn't think about ends up coming back to name them. For example, people who set up fake servers sometimes forget that, even though they change the information later, the provider has the ability to recall the information they put in originally. The original silk road Tor drugs market was partially taken down due to its founder putting his real name in a related account.

3. Once it was there, how was it controlled? Do we have logs showing a human acting? Maybe it crashed and restarted from a manual command. What do we know about the location of control? For example, some government-backed APT groups operate on local business hours. While it's not impossible for someone else to only work 9:00-17:00 Moscow time and take off Russian holidays, there's little reason for them to disrupt their schedule. When you notice that it happens, chances are you've at least located the attacker's time zone and that it might be an organization doing it.

4. Who has used the malware for benefit? Not necessarily always available, but have they extracted data and used it somewhere we know about? for example, if you were attributing an attack on a website to a group, finding the database's contents for sale at least gives you two targets to investigate, the attacker and the seller. They might be the same, but even if they're not, they probably know each other.

5. The old-fashioned return the favor--someone knows what APT29 is up to, and I'm sure the NSA would like to hear about it. We don't know how hard the NSA has tried to gain access to various places where such information is available, but they must have tried and probably have access to some of it. This isn't available to everybody, but in a government hack, there will be a lot of government investigation of what happened.

Re: "Fingerprints" is very vague and hand-wavery.

Of course false flags are possible. They're tried all the time. They can be fiendishly difficult when it comes to an attack on computer systems because you are dealing with lots of variables and you don't know what others know about you. It's been done before, but it usually gets figured out fast enough. For example, when the 2018 Olympic games were attacked, it was first believed that a North Korea-based group had done it. A few days later, it was actually discovered that the first clues pointing to North Korea were shallow and didn't stand the weight of investigation, and most likely Russia had done it and attempted to frame the North Koreans. Further investigation substantiated those theories to the extent possible without anyone taking credit.

Attribution is tricky, but there are people who put a lot of time into getting it right. They can recognize little techniques or snippets, trace through records of systems used, and make a pretty good hypothesis. When one person releases a preliminary report calling out someone, they could easily be wrong. When several places all agree on who it was, they likely know quite a bit and have done their homework. While they could be wrong and eventually they will be about something, they're often right.

This product is terrible. Can you deliver it in 20 years’ time when it becomes popular?

Re: Infra-red

But again, in that situation, it's the box on the television, not the remote, that's of concern. Whether the remote you use uses IR, Bluetooth, a custom RF protocol, or loud beeps for a microphone doesn't matter; only the Android TV box has the connection needed to snoop on them. The risk and therefore any remediation steps need to happen on the receiver end and the remote's implementation is meaningless.

Re: Infra-red

"The best thing about line-of-sight remote controls is that they don't upload your button presses to a server in California."

That's what you think. Unless you have a WiFi remote control, the thing that you have to worry about is the device receiving the commands from it. Nothing prevents a television relaying your IR remote commands any more than it's not prevented from sending commands sent over an RF protocol.

GitHub will no longer present a cookie notification banner – because it's scrapping non-essential cookies

Re: All websites don't really need third party trackers and services

"You can maintain state across a session using post or get variables."

But if you do, it gets painful. Whatever variables you use will end up clogging everything, from the user's history to your databases to all the HTML you send to them.

If you use get variables, the users' history, bookmarks, or shared links will contain a bunch of expired URIs which contain old session data which a) doesn't work anymore unless your server filters it out and redirects them to somewhere new which still works and is at least sort of like where they were at that point in history and b) may contain information that a user shouldn't be storing in their history. The second point can be thought of as the user's responsibility, but part of system design should be keeping data private even when it's not yours. If you instead use post variables, the user who returns to one won't have the issue of persistent storage of data but would likely get a warning from their browser that a post action will be repeated with possible consequences. This also doesn't fix the issue of having to handle links with inaccurate or missing parameters.

Meanwhile, you also have to have your system modify every element on every page to send the required data onto the next one. Turning every link into one which consumes parameters and passes them on and including hidden inputs which ensure all your parameters are in every form can be a large task which consumes resources, complicates the page, and makes your backend CMS a mess. If you don't do it, then a user who clicks on a static page which doesn't need the parameters but continues on from that page will find their session data has been lost.

Stony-faced Google drags Android Things behind the cowshed. Two shots ring out

Re: A thought

"Is there any point to Android other than on OLED/LCD touch screen phones and tablets?"

Yes. The reasons differ depending on what you're building, but there are a couple good ones. One is app portability if people other than you are going to write apps for the thing. This could be library services or ebook stores which write an Android app that runs on an ereader and supports their format or can download from their service. If all the ereaders use the same interface, they only have to write the app once. The ereaders likely don't, which is why there aren't that many apps like that, but it's a similar model with streaming video on smart TVs.

For TVs, a general smart TV platform is more likely to get support than a specific one. For example, one of my family members has been asking for my assistance because they've lost access to a television channel on their old satellite system and they want it back. They have a smart TV running some probably awful proprietary system and they also have another proprietary streamer stick which they can use. Neither of these does apps, so I've been attempting to look up whether either has a manufacturer-supplied app for something carrying the channel concerned. With something running a generalized platform like Android TV which can receive apps from people other than the manufacturer, the likelihood that there is something of use is higher. Certainly not guaranteed, but nobody's waiting on the Samsung television feature department to fix a smart TV eight years old.

Another benefit (this one for the manufacturer, not for you) is that Android has a bunch of developers and existing libraries. Linux does too, but for devices using a single screen and basic user interface, the Android developers are already familiar using Android's tools to write apps with that type of interface.

These don't make Android a requirement. A general Linux-based open TV or ereader platform would work well too. But we don't have those. Well, I think Kodi is kind of like an open smart TV platform but as I recall it has trouble with a lot of streaming services because of DRM problems. Nothing is perfect, and in this landscape often nothing is very good, but some things are less bad than others and Android can sometimes get things to the less bad point.

How to leak data via Wi-Fi when there's no Wi-Fi chip: Boffin turns memory bus into covert data transmitter

Re: Better computer cases?

That sounds nearly untenable. For one thing, a smartwatch that can be used for the attack needs to be thoroughly reprogrammed. The controlling firmware needs to control the wireless receiver, Bluetooth or WiFi, with sufficiently granular control to make it use a completely different protocol. That's much easier to do with a watch you control rather than someone else's. It's also not easy to replace firmware on a device you can't compromise yourself; firmware updates for nearly every brand of smartwatch are signed binaries uploaded through an encrypted BLE connection. While not inconceivable, actually finding someone, identifying their device, writing firmware which can use the hardware and leave the device functional enough to fool its user, and uploading it without controlling the device itself or the phone talking to it are rather difficult tasks.

The real problem though is that, if you succeeded in doing this, it might not help very much. Watches are really small, so their antennas are short and their batteries can't withstand much use. This means that the range to receive or transmit from a watch is quite low. Also, frequent use is going to kill that battery. An attacker who knows that the watch is supposed to listen to a machine can place it close to the machine and remember to charge it frequently. Someone who doesn't know that is likely to be out of range a lot of the time and become very annoyed when their fitness tracker's battery life suddenly drops (it would be very noticeable). Even if they do succeed in receiving the data, the attacker needs to get it back from the watch. Their only hope is to keep meeting the person with the compromised watch so they can get a daily download, but because of the range limitation, they will have to be physically close to the person with the watch quite frequently. That makes getting the data out hard if there's any information to get after the user unexpectedly went out of range for most of the day.

Re: Better computer cases?

That would work rather well as a listener. Even low-end devices can have enough storage to cache data sent to them over a workday. The open-source PineTime watch has 4.5 MB of flash, and the proof of concept can only transmit at 12.5 bytes/sec. That allows for four straight days of collection on a watch which can easily sync back as the attacker goes home. If you wanted to execute a plan like that, your idea is a good one.

However, it doesn't change the requirements. If you consistently work in the secure building and were able to install malware on the target computer, you can probably also go to the secure computer and make it do things. Especially so as you need to be very close to it for the transmission to be received by your sneaky watch. If you do have access, it might be easier just to make the computer disclose information a faster way, whether that's copying to media, converting to QR codes displayed on screen, or just bringing it up for you to peruse.

Re: Maybe Typewriters should make a comeback

This exploit already requires that you can get access to the computer. While you can theoretically do that in the supply chain, it also requires that you can put a listener next to the computer, which requires you to be in the same place where that's used. If you have that level of access, you can also copy papers stored under similar levels of security. Theoretically, this is potentially useful if you can only get access once (but your listening device continues to work unnoticed while you're not there and get information out to you somehow), but it's not markedly different from stealing papers; you have to have physical and unsupervised access either way.

Re: Better computer cases?

"With everyone using laptops for WFH rather than proper metallic-boxed towers, I think arguing about cases (and cables) may be moot. Not sure what's underneath the plastic shell, if anything."

Doesn't really matter. Anyone using a laptop to work from home isn't trying to airgap said laptop, nor would they be taking any of the other security precautions that this is intended to get around. An attacker can attack that laptop as they use it to read emails or participate in meetings or just walk in and take it. Airgapping is useful for devices that need a lot more security than that, and usually the place that wants it airgapped will decide not to put it in an employee's house unless they very much trust that employee to keep it secure.

It's useful to keep in mind that this exploit only works if you meet three conditions: a) you can get to the airgapped machine in the first place to install malware on it, b) you can put another device near it to pick up the transmissions and relay them on, and c) you can't just steal what you want when you're installing the malware. If a machine is easier than that to attack, the attacker doesn't need something this complex to do it.

Google Mail outage: Did you see that error message last night? Why the 'account does not exist' response is a worry

I fail to see the confusion. The message speaks of accounts, the article of users, users have accounts, on Google users are identified entirely by their account as there is no independent username available to them, hence if an account doesn't exist, the user doesn't exist either. Therefore, the message which was sent should only be sent if a user has not set up an account with the specified name or the user's account has been closed. That wasn't the case, so we have a problem.

Google told BGP to forget its Euro-cloud – after first writing bad access control lists

Re: Clouds are great!

Running a life-critical system on a cloud system, with no local backup, in one region only, would be negligent to the point there would likely be penalties for the hospital. The same is generally true of any other system where downtime is potentially harmful. It's system design.

You have to keep in mind the ways that exist for making a problem like this less likely. If you run your systems in house but you run the servers from one computer room, what do you do if the UPS in it fails and kills the power. If it will take you long enough to recover from that that you can't withstand the harm caused, then you need a redundant UPS. And possibly you'll need two computer rooms for redundancy so a flood in one doesn't take out the other. Or maybe you even need multi-building redundancy. It all depends on how long you can withstand a failure and how much you're willing to spend to make that failure less likely.

The same is the case for cloud deployments. There's a reason that every cloud has different levels of redundancy, because they have problems. In this case, only one region was affected, so having redundancy across regions would have prevented it. A sufficiently-interested user should have set that up, just as a sufficiently-interested admin should have done for systems running locally. If you're worried enough about a global outage for a cloud provider, then you would either need two cloud providers or to run the systems yourself, but if you're worried enough about a global cloud outage, your systems have to be really well-administrated and redundantly set up to make the risk level the same.

Twitter scores a first for big tech after being fined €450,000 by Ireland's data watchdog for violating the EU's GDPR

How impressive

So, the story is that Twitter had a bug which was clearly not intended and affected a subset of their users, failed to report in time, and got a fine so small they've already forgotten about it. Meanwhile, other companies do deliberate things which impact all of the customers, don't hide it, and get no consequences. Why would any company be worried about this? If this is the size of fines being handed out, they have nothing to worry about. If this is the only kind of investigation that gets done, one which can be completed by a simple program*, they have nothing to worry about. Any Irish out there who can petition their government to make their data protection office do more things?

* if ((reportTime-report.discoveredTime).days >= 3*mercyRatio) { report.company.fine(); }

Right-to-repair warriors seek broader DMCA exemptions to bypass digital locks on the stuff we own

Re: Yes, but ...

I have no problem with the business model. Others will, and it's clear to see why, but I think it's the right of a company to intentionally weaken a product just as it's the right of a company to produce one that's built from lower-power components so it's cheap. As long as they don't build it specifically to fail fast, I am fine with it.

As for a user tweaking it, they should definitely have the right to do so if they wish. The manufacturer doesn't have to make those options easily available to them. Your employer doesn't have to give the firmware source out to the users, or put the settings in the standard interface, or anything else, but if a user finds a way to make use of the components by changing something, that's their right to do. Just as it would be their right to disassemble the thing they own and use the parts in other devices, they can change one of the parts out for something else they own. You don't have to support a modified product, and I'm sure your warranty specified that you didn't support it if they had opened it up and swapped components. Similarly, you could forbid any such modifications for a rented unit.

Companies want to make it hard for people to change how a product runs. I get that. Sometimes it annoys me, but I feel they have the right to do it if they want to. What I don't think they should have a right to do is to sue me if I succeed despite their obstruction, because it means they're making it illegal for me to go against their wishes with something I own.

Ad blocking made Google throw its toys out of the pram – and now even more control is being taken from us

Re: The rise of Facebook and the slow death of journalism is due to online ads

Depending on how it's done, it can be a bad thing. To minimize costs can be done by finding the costs and identifying ways to not have them, which is good. It can also be done by identifying costs and pretending not to notice them, which is bad. If costs to others, I.E. externalities in economics, are taken into account for the reduction goal, then it's good. A lot of companies try not to ever consider that and dump those costs off on us; now their costs are lower and they haven't done anything.

Maximization in profit can be done badly too. Places that attempt to maximize profit now usually don't pay any attention to what they're going to do later; when that roles around, they'll just try to maximize again. Sometimes, it's necessary to invest in something now, thus getting less in profits, in order to get more profits in the long-term. If profit maximization of this type is done by some company which doesn't push its costs off, then it can only harm that company in the long-term. That's their business. Unfortunately, it usually doesn't. The company maximizes profit instead of investing, extracts that profit until a crisis, then pushes the costs it can no longer manage off on other people.

This is harmful to everybody. It's harmful to the people who have to clean up the mess created by someone who only thought about the short-term. It's harmful to anyone who invested in the company after previous profit maximizers drained the resources that could have produced long-term profitability. It is harmful to other companies who haven't done this because it causes stereotypes that a lot of corporate entities are going to act like this, which is the stereotype the person you replied to was espousing to some degree.

Write it. It's not complicated. OpenWRT has OPKG, so a user can install it if you write it and put it in the repository. I'm sure you can find people to support the codebase with you.

To answer your question though, the primary reason that people don't is that routers running OpenWRT often have very little storage and/or memory. A lot of them have 16-64 MB of flash, which isn't very big when you also need to store the firmware image in it, and they have 64-256 MB of RAM, where they need to store packets and information about connections, so that fills fast too. PiHole works by having a bunch of blocklists stored internally. Sure, they get updated by pulling from the web, but they don't get pulled in their entirety each boot. The Pi can store those on a larger SD card and also always has at least 512 MB of RAM to cache them. Furthermore, most people who choose to install OpenWRT already know enough to use something else as a PiHole, so the size of the userbase isn't dramatically increased by making them both run in the same place. None of these issues make it impossible to do it, and writing the functionality might be worth the effort to someone, but those are the reasons it hasn't been worth it just yet as far as I know.

Google Cloud (over)Run: How a free trial experiment ended with a $72,000 bill overnight

In many cases, they don't. Storage is often charged by the month, not by the hour. Operation is charged by the hour. Therefore, the storage is already paid for and the operation is cut off. If the cap is also a monthly one, the user could in fact continue to store the VM without running it perpetually without exceeding their cap. Retrieval requires certain other charges like bandwidth, but that only happens after the user has deactivated the services creating the unexpected expenses, after which they may increase the cap to run other things during the month.

Re: Not so free after all

I'm not sure it works that way. If they issue you a bill and have your name, they can send a legal threat at you until you pay it. In your situation, they had to back down since you canceled the account, but if you didn't, they could sue you and win. For a place like a cloud provider, they can argue that you intended to operate the services and that you know the costs, which is probably not exactly true but they can likely get someone to accept it. Just because they don't have a payment method that they can bill automatically doesn't mean they're out of options for ways to make you miserable.

Re: From the article

They could have gotten their system to not result in the bill, but they did set up that billing budget thing. Theoretically, such a feature would mean that you don't have to change all the other settings to avoid a massive bill. You might reach your limit quickly, and if you set the settings right you wouldn't have, but you should be fine. In a case where that feature worked as people expect it to, the user without special access would have to pay a bill for a service that only ran for half an hour, but they wouldn't have to pay a bill four orders of magnitude over what they were expecting. Imagine how it would have gone if other such limits were sometimes considered optional. You could end up in situations like this:

1. You set a caching server to keep copies of your files which expire every ten minutes, but it decided that the ten minutes was optional and instead used the value infinity. All your customers are getting days-old versions of everything. If you had only set the server to erase itself through a hidden task, it would have done what the TTL value is there for.

2. You used a programming language's thread pool and set the maximum number of worker threads to equal the number of processor cores because your task is compute-intensive. It decided your maximum was unimportant, so it spawned a bunch of threads which slowed you down immensely before eventually swamping the OS requiring a forced reboot. If only you had also made the OS restrict the number of threads, the defect in the thread pool library wouldn't have caused a problem.

3. You were filling a car with fuel, and you requested the pump to continue filling until the fuel tank was full. It decided to just keep going, so now your car is at the bottom of a flammable pond and you have a fuel bill more often associated with aircraft. If only you just measured the empty volume and specified the exact amount of the fuel, you wouldn't have had this problem. On second thought, that's also a number so you would be in the same situation. Too bad for you.

Re: Surely though...

Google suggestions has received your suggestion. We will not implement this suggestion because cloud users would be impacted negatively by any abrupt termination of their services. A terminated virtual machine may have been running important tasks, so we can't do that until the user says so. Similarly, if we blocked reads of a database, the customer wouldn't be able to get their content out of it. If we just blocked writes, then the user's system could [PRBot error 1004: could not think of convincing-sounding argument, please assist]. An abrupt termination of any service could cause a business customer to lose revenue for each second that clients are unable to make use of the services, and inconsistent termination, where some services are blocked but others which don't incur charges, could cause chaos when [PRBot error 1093: attempting to rephrase message "user could decide they didn't need it after all and stop paying us money" to sound diplomatic, couldn't manage it, please assist]. A user would never accept us pulling the rug out from under a service which they rely on for their livelihood, unless it's the Play Store, in which case we'll shut them down without a second thought [PRBot error 1015: sentence appears to contain data that should not be referenced, but module do_not_outright_lie requires it, please assist]. Also, adding the feature would be expensive for our developer resources for a very small number of users and hence is not an economical decision for us PRBot warning 1093: believe previous sentence is a suitable translation of "we're not a cloud monopoly player, so we don't have to do anything for our customers. Ha ha ha." However, a translation error has already occurred in this message, so please check anyway].

Supposedly, and sometimes, but when it's not, it's really not. They can often manage to add so many possible billable things that it's hard to figure out what you will pay. Worse, it can be mind-numbing to attempt to compare different providers for their prices, as prices are never clearly displayed together and some providers (well, one in particular) go to extreme lengths to hide the price lists and suggest you use a calculator instead. For example, I recently attempted to compare prices for bandwidth egress from various clouds and various cloud CDN-type features as an exercise to see how much it would cost to use them to handle a spike in demand for static files. The results of my survey can best be summarized as follows: what on earth do cloud companies do to set their prices.

Dedicated VM's egress charges are usually easy to understand, but they vary quite a bit between providers because I don't know why. The big three are in the same range (approximately 20% difference between minimum and maximum) and each include the first 5 GB egress per month with the VM. Fine, they're relatively similar and could be compared. Then, I looked at Oracle cloud, which costs a tenth of what the others cost per gigabyte and provides two thousand times as much free bandwidth. I don't get it. Either Oracle has a much cheaper system, is much worse, or is very desperate to get new customers. Still, I'd have expected that Oracle wouldn't be eager to make bandwidth a loss leader, and that other providers would compete that price downwards. But then comes the CDN options. Every single one manages to bill for cache hits, cache misses, bandwidth (completely different prices than VMs), and reading from wherever the CDN fetches data. Some of them also charge different prices based on the CDN endpoint location to the extent that it would end up being cheaper to set up VMs on their service for some regions and use their CDN for other regions to minimize bandwidth costs for the same activity. Before you ask, they usually don't let you restrict which regions you use.

This complexity means that, although cloud can offer price benefits for specific tasks, it can only really do so if you've paid close attention to all the things that can get billed. As pointed out by this article, don't necessarily trust that the limiters on an account will necessarily work like you think they will. The answer you seek is in the documentation somewhere. It may take you days to find it, but it will end up being better for you to spend the time.

British voyeur escapes US extradition over 770 cases of webcam malware

Re: Only pervy malware not killing

That is really not how international law works. This is not the decision of the U.S. alone; it is also the decision of British courts. While the U.S. could have complied, and I would prefer that they did, the U.K.'s high court concluded that extradition treaties do not place that requirement, just as they don't place a requirement on the U.K. to comply in this case. Each request from extradition is constrained by various limits, including each country's permission to decide they just don't want to comply. In the case you reference, there is the additional issue of diplomatic immunity, for which the relevant law provides. You will likely be happy to know that the law has been adjusted to remove some of those protections should this ever happen again, and I think that adjustment was a good idea, but it would not be legal under the law of the U.K. to apply this new law to the old situation. It is unfortunate, but it shouldn't be the everlasting excuse that prevents unrelated cases from proceeding.

Ad-scamming, login-stealing Windows malware is hitting Chrome, Edge, Firefox, Yandex browsers, says Microsoft

Re: OS?

That depends on your settings, and the best answer is "not intrinsically, but they probably help a lot of the time and certainly can't hurt". If you just block scripts, you can still get an ad with a misleading download link. Javascript didn't play a part in getting the malware onto the computer, so an HTML ad that looked convincing would have been enough. They might not have used plain HTML, in which blocking JS would help, but they could have done so.

An ad blocker is more likely to help, but it's not foolproof either. It won't necessarily get all ads, nor would it detect things like fake sites hiding in search results. If you ever found a link leading to the malware, it wouldn't protect you from the file. The best it can do is prevent you from seeing such a link injected from an ad server.

Re: End of the world.

This isn't Javascript. It's a native binary attached to software installers which replaces a browser binary with another native binary. Where did you get Javascript from?

Re: OS?

The article specifies two things that your comment questions. First, the malware has only been seen on Windows. Second, it doesn't modify the DLLs through the browser, it installs a native binary which does it. That native binary is launched during an installer, which makes it easy to determine how the binary got elevated privileges to do it.

You've got to be shipping me: KatherineRyan.co.uk suggests the comedian has diversified into freight forwarding

Re: Can somebody explain the economics?

I wonder if some of them are hoping that the expiration was in error and that someone will come to ask for it back. They might redirect it for a minor ad or SEO benefit so that a nontechnical user can't find their contact information. This means that many users would use one of those domain-negotiation services to ask for its return, which could be more likely to result in a sale. That's supposition though. Some people may think they have a foolproof plan and instead found a foolproof hole into which they're throwing their money. I note that the last domain I let expire hasn't been purchased at all and could be easily obtained by anyone. It seems the squatters realized correctly that I have no intention to pick it up again.

China bans 105 apps, eight app stores, and says it’ll swing the hammer again

Re: Which appstores?

It depends. They could crack down on those as they have been doing to some success in the past, or they could just push an application to phones that does a little audit of what the phone's used for. Russia's going that way; China must have considered it. Of course, there's also the possibility that they don't have to; just analyze the user's network activity and, if they use any of the apps you don't like, decrement the credit score accordingly.

Cops raid home of ousted data scientist who created her own Florida COVID-19 dashboard

Re: Step away from the keyboard

Why is that a problem? In fact, isn't that an asset of computing? The person who works as a statistician needs to know how to do statistical analysis and how to make the computer do the heavy computation bit. Their most important skills are knowing how to process data in a useful way, how to modify the processing to get useful views of data without corrupting the analysis, how to get data that represents reality, all that stuff. Why should they also know how the computer is going to go about calculating something once they've told it to? If they want to, they should learn. It might help them, so a lot of statisticians I know are good at programming, though they're mostly programmer-statisticians, so that's not a good sample. Still, if you don't need to know that in order to do what you're doing, it seems strange to assign some demerit to not knowing it anyway.

Do you say the same thing about other computer users? Should the people who know how to make GIMP edit a picture in complex ways also know the different utilities their GPU contributes to the task? Should the person who writes a book in a word processor know how the kernel relays input from a keyboard and how the word processor's text system interprets their keystrokes into characters and commands? In the same way, since I'm assuming you mostly work on computers, should you have to know the way all your equipment was manufactured, down to the logic gates on your processor? If you work in that, should you know how the rare earth elements that are used in it were mined and processed before they got to the factory? With all of the above, there's no reason that someone should be prevented from knowing that if they want, but also no good reason someone should be required to know it when they never deal with it.

Re: Overwhelming force

Against someone who is clearly thinking about a violent response but still values their own life, maybe. Against anyone else, dead wrong (often literally). If you put six people with weapons in front of someone, you have six times as many chances that they'll misinterpret something peaceful as potentially dangerous. They're already holding the weapons, so the usual response is lethal. Also, going into a situation where you're in a large group of armed people increases stress, which has proven in various experiments to reduce the ability to recognize small details and act in a calm and peaceful manner. This means it's even more likely that something gets interpreted as dangerous when it's not.

Bringing a lot of force can be of use when your goal is to make someone put down their weapon and come quietly, because you've destroyed any notion they might have had that they can shoot everyone in the way and get away. In a situation where you need to show up and take some computers, you don't need to do that. All you accomplish by doing it anyway is to make the people in the home more stressed because there are many armed people nearby and the officers more stressed for the reasons in my first paragraph. That can only make things worse, even though we may know incidents where it managed not to end tragically.