Posts by doublelayer

You had one job... Just two lines of code, and now the customer's Inventory Master File has bitten the biscuit

Re: Who in there right mind would...

Usually, someone without a lot of extra space, such as someone on an old 1970s-era computer. I don't know what the disk situation was like on that, but I'm guessing it was not easy to find twice the disk space to make a backup of the database file and that, if you did, it would take quite a long time to make the copy. Now depending on the size of the file, it's possible they could have made an extra external backup onto other media, but that also might have taken a while. When faced with a situation so seemingly easy (a single SQL statement does it in modern times) with a backup requiring nontrivial effort, someone might trust their intuition for proper coding, which probably worked just fine the last hundred times. Then uh-oh.

What happens when holes perfect for spyware are found in the engine room of millions of Qualcomm-based phones? Let's find out

Re: Why do us customers bother?

It didn't, but nor is the AMD64 architecture responsible for Intel's many failings. It's not the architecture, but the design. I believe the original post here is responding to comments of the type praising the benefits of ARM when Intel security vulnerabilities are discovered. Those comments, while technically correct in the sense that ARM is not the same as Intel, are making two large mistakes. First, they make an apples-to-oranges comparison between Intel's design and ARM's architecture. Second, they ignore the possibility that an ARM manufacturer might do a similar thing. I interpreted the original post as pointing out these errors and cautioning the writers of such comments that nothing is foolproof.

Whoops, our bad, we may have 'accidentally' let Google Home devices record your every word, sound – oops

Re: Or more likely ...

Really? Amazon offers advertisements too. They want to sell things, but they don't care whose things they're selling as long as they don't make one of the items concerned. In order to get you to buy all those things, they need to advertise items to you, meaning data collection, and in order to maximize their profit, their advertising arm will be happy to sell that opportunity to the most motivated merchant. Your description of Google's usage of the data applies to Amazon in every particular. You may have underestimated their appetite for data or how they will be using it.

Android user chucks potential $10bn+ sueball at Google over 'spying', 'harvesting data'... this time to build supposed rival to TikTok called 'Shorts'

Re: Do end users have standing to sue over this?

That may be, but although we knew it was very likely, I don't think we had proof that Google had that level of spyware in their code. It would make sense that they did given their previous attitude toward our privacy, but it's also not a very useful method of violating our rights. If their code does provide them enough information to identify apps to compete with and tactics to use when doing so, it also offers the proof of what we assumed. Given that proof, it's time to use it to attack Google for their privacy problems from all fronts.

Re: Do end users have standing to sue over this?

No, they have reasons to sue over the other things and this too. You've described the data as what apps and how long (I.E. when). There are several good reasons I don't want Google to have a log of what I do with my phone, including when it was in use for each thing. And there is no good reason for them to collect said information. I as a user would feel this alone violates my privacy.

Now, if the allegations made here are correct, they have a lot more data than that. If they are analyzing how I interact with apps, it's probably not just seeing whether I use them a lot, but instead seeing how they are used (E.G. which utilities of each app I am using), how active I am during use, etc. This has all sorts of potential to contain personal information, and I can't know it's happening, let alone see what data is collected or control it. This is deeply concerning. The only potential reason not to punish Google intensely for this is if they can prove that it doesn't do what the allegations say it does. I haven't yet found a good technical analysis of this, as most of the coverage of the topic has happened in the past few weeks. If they can't release a comment that can disprove the allegations, I predict numerous complaints worldwide, and those complaints will be justified.

I got 99 problems, and all of them are your fault

"It's the attitude towards the person they have asked to fix the problem that matters."

A thousand times this. I have no objection fixing things for my friends or family, even if it's an annoying problem and it's all a result of their actions. I may get a little annoyed if it takes hours to fix it, but my grumpiness is directed at the machine, not the user. That is, I don't have a problem fixing that if they understand that my efforts are helpful and they are benefiting from my work. It's when they complain about my help when I consider saying "not my problem". For example, when I need something from them to finish my recovery and they just don't want to provide that right now because they're doing something else on their weekend, I consider informing them that I too have some ways to spend a weekend so maybe they can find someone else who doesn't mind performing IT work for free. If someone requesting help doesn't do that, they usually get dedicated assistance from me.

National Crime Agency says Brit teen accused of Twitter hack has not been arrested

Re: Victim shaming

"As for victims the way I see it (my view) is that the victims are the ones who lost money and the people who had their accounts hacked."

You are correct, they are. There are a few crimes with which this could be pursued:

Obtaining access to a computer system without permission: Victim is Twitter.

Accessing protected data without authorization: Victim is account holder.

Theft and fraud: Victim is person who submitted bitcoin.

So all of these crimes can be pursued, including by other countries. The one currently being discussed most by law enforcement is the first one, so that's why the U.S. has gotten into it. That doesn't stop other countries requesting to charge the perpetrators on the others though. Probably the reason for the first crime to receive more attention is the value of the crime; the damage to Twitter is valued highly, while individual victims who lost some money is a smaller thing. I would expect that to also get handled in the upcoming trials though.

Re: Victim shaming

Your concerns are valid and they are often taken into account during extradition hearings. In many cases, if country A does not think the event was a crime, they will refuse to extradite. If country B's punishment for the crime exceeds country A's, it is common that country A will only agree to extradite under some conditions including a limit on punishment. These considerations are often seen in such cases, and there have been cases where country B decided not to meet country A's requirements and country A refused to extradite and charged the suspect themselves.

As for your discussion on where Twitter is located, that is somewhat clear. The company is located in the United States. They may own other entities, but the entity which controls the servers which were broken into is the main company based in the United States. The crime that is mostly being discussed here is accessing those servers, meaning that the locations of the people impersonated is not at issue. The location of the people used during the attack is similarly unimportant. In this case, the U.K. and U.S. both have jurisdiction over this particular suspect, so the U.S. may request to have the suspect tried there. If they do, the U.K. will be free to refuse that request and they will consider points such as yours when they do. It is worth keeping in mind that, should the U.S. make a request, it is not only legal but very standard for cases such as these.

Re: Victim shaming

"Then again why should Mason Sheppard be tried in the US, British citizen in UK when it happened, surely subject to UK law."

Crimes can be tried either in the country where the perpetrator resides or the country where the crime took place (for digital crimes, this means the country of the victim). For this reason, it's rather normal that there would be the potential for this crime to be tried in the U.S. and extradition requested. The U.K. of course has the option to refuse extradition and try separately. The U.S. might want to extradite to the U.S. rather than wait for the U.K. to try the suspect in the hopes that information from all suspects might lead to more effective trials; for instance, if the same investigators get to question all suspects, they are more likely to get information against others involved.

Geneticists throw hands in the air, change gene naming rules to finally stop Microsoft Excel eating their data

Re: other excel woes

"Still no easy way to cycle thru sheets via keyboard (hint CTRL-TAB would be nice)"

In mine, CTRL with page up and down does that. it isn't great if you're at one edge and want to go to the other one, but otherwise it's pretty useful. Maybe that will work for your situation?

Re: I must be missing something...

"I don't know why you think scientists who are experts in their field, should be any better at office software than they are say at plumbing or arc-welding."

They should because the office software is part of their job. Now probably it shouldn't be that big a part, but if they insist on using Excel for their database, then they need to know how to use it for the database-style things they intend to do. Column typing is one of those things.

I'm a programmer. I only need to know how to write code, so I shouldn't have to know very much about infrastructure which I don't administer, right? We probably all know programmers like that. Yet that knowledge is crucial to understanding how my code will be working and therefore making my products useful. It isn't a thing specifically named in my job description, but if I don't know how to do it, I am not as good an employee.

Re: They are creating a database ...

Some people have this very strong aversion to databases. They don't necessarily provide a reason, and if they did you wouldn't understand it. I've seen lots of people do this, including several types who know about databases but still use spreadsheets. Part of it might be that they don't want to have to write the UI around the database and the only reasonably common portable database format is SQLite*, but that's not a great reason.

*For example, the MS Access database format isn't easy to open if you don't have a license for Access. Dumps from other databases might need tailoring if you're using a different server, or people just don't want to run servers. I view an SQLite file as a perfectly valid way to send a dataset, but I'm comfortable issuing SQL queries. I don't know if there are good GUIs for that which allow viewing, sorting, adding, and all of that without needing to learn SQL, but if not maybe we should write one for the biologists. Anyone want to collaborate on that open source project?

By the way, XKCD has been prescient as always.

Call of duty, modem warfare: Taiwanese Qualcomm rival MediaTek teams up with Intel for first stab at 5G laptop chipset

Cellular laptops really that useful?

I wonder whether others find cellular connectivity much of a factor when thinking about laptops? I tend not to. Although I can get some utility from having the connection available and I'm sure there are people who work outdoors more often for whom this is even more useful, I've always used my phone's connection for that instead. The primary reason for that is that, in my experience, mobile providers don't really care about people who want a connection that will stay down most of the time. They all seem to charge an amount that is required just to keep the line in service, either a fee explicitly for that or a bill for a data allowance that didn't get used. So if I need the laptop's connection only occasionally, I end up paying an extra service fee even when I don't use it. Meanwhile, my phone already has service and I don't have to pay any more to use its connection for tethering. So is it just me or is this feature one manufacturers have cared about for many years while users mostly don't?

USA decides to cleanse local networks of anything Chinese under new five-point national data security plan

Re: Human Rights

"Does China have greater surveillance of its citizens than the USA? I very much doubt that it does overall."

You may think this, but that is incorrect. China really cares about surveillance, and they have it in spades. They have software to track communications over phone or internet. Software to monitor movements using vehicles, and increasingly pervasive camera surveillance with some of the best facial recognition technology. But these only cover the cities, right? Wrong. They cover a lot of the area, and they link people based on any metrics they need. When they decided to repress a group that was annoying them, they rapidly expanded their surveillance to cover the Xinjiang province and areas near it in other provinces. But you had another point to make:

"Far more Chinese citizens live in extremely rural areas where there is no CCTV, just for starters."

Nope. Those areas are indeed poor, without many of the nice conveniences for life which also make surveillance easier. Want to know what they still have? They have cameras. There's another reason for this. China has had a long history of trying to keep tabs on their population. Going back to the 1950s, it was critical to know who was doing what. Back then, cameras weren't really an option, but a strict hierarchy of power and responsibility was. China built that. Now, they can use technology to support it, but they still have that hierarchy. Part of that is responsibility to watch people for certain activities and know things about them. It's inefficient, but it works.

Countries like ours are dangerously willing to surveil us. They have powers that we need to curtail. They have been taking advantage of anything they can think of to increase their capacity. But we can still do things that China has prevented. A lot of the reason for that is that our countries don't use their surveillance powers against us very often. China is better at it because they use it all the time, while our countries may have the capability but by leaving it unused they don't have as much ongoing data.

Our governments may be interested in ideas like a social credit score, automatic checkpoints requiring constant confirmation of a person's identity and status, or elimination of encryption, but it is China that has already successfully implemented them.

Ever wonder how a pentest turns into felony charges? Coalfire duo explain Iowa courthouse arrest debacle

Re: There's more..

But in order to make that decision, we have to ask why those professions get those privacy benefits. Lawyers make sense, since they are ostensibly the protection layer between people and their accusers. How about doctors? Why do they get that protection? According to this article on the subject, it's designed to ensure that patients tell medical professionals enough information that they are treated properly. On that basis, you can make an argument that security testing is similar to medical--they are also ensuring that the person or organization who is using their services is healthy, and you can draw coherent though tenuous connections between tasks performed by security testers and doctors. The argument isn't the easiest to make, but in my opinion the argument for medical privilege isn't particularly convincing either.

"Just because someone has been arrested and then released without charge if the case is still open do you delete everything"

In this case, charges were dropped. This basically means that the case isn't open. It's possible for someone to decide to file new charges, but unless that happens, the people concerned are not subjects of any charges and not arrested. The case is effectively closed, not open.

"do you delete everything e.g. the interview. Do you delete everything when the case is closed and say someone else is convicted. Surely you still have to keep the info just in case there has been a miscarriage of justice."

You can keep that if you need to. The point under dispute is whether you keep a public record of an arrest. You can keep the interviews and evidence in private without allowing the names of the people who were released without charges to be inextricably linked to something that is now viewed as not criminal.

"Personal information like photo/mugshot finger prints dna should be deleted."

I agree, but when they don't do so, they will use the same argument you have just made.

"Of course there is bugger all you can do if it is reported in the press."

Well, you can do some things. In Europe, this is where the right to be forgotten might be used. People will argue about that, but we can skip it for now since this is in America. Still, a newspaper story making clear what happened offers more context than a record that simply says "arrested on felony charge, no trial occurred". Someone doing a background check who reads the article and understands the context is more likely to make a reasonable decision than an automatic system that looks for felony charges in a database and counts people out on that basis.

We Kana believe it! Raspberry Pi Foundation launches Japanese keyboard

Re: Why make keyboards

If you're looking for somewhere where it's really hard to find electronics and the road is a day's walk away, Japan might not be it. Japanese is spoken elsewhere, but not so much that you'd expect to stock many Japanese keyboards for the general public there. If they want to create keyboards for languages that aren't well represented at the moment, maybe they should focus on those which haven't been well-established in computing for five decades. There are languages covering millions that fit that bill.

Google to pull plug on Play Music, its streaming service that couldn't beat Spotify, in favour of YouTube Music

Re: Disabled person

Are you willing to build the system yourself? There are a few things you can do to get that working. Various projects exist allowing a Raspberry Pi to relay audio to such a service, so you just have to replace the recognition on their servers with recognition running locally (CMU Sphinx has proven to be an effective library for me). Of course, you then have to provide your own list of commands and actions to take when commands are heard, so it's not labor-free.

There are also some open voice assistants that run using local software. I've seen types that use a Pi as the brain, which are more open and configurable but sometimes less powerful. This one is probably the most famous, but I have never used it and I don't know whether it's capable of everything you want. I've seen others that use an Android device to power them because by doing so they can use Google's dictation function (requires an additional download but then can recognize offline) instead of building that themselves. That would also work, but initial configuration or recovery should the host device shut down isn't as straightforward as with a Pi. If you want to investigate those options, try searching for voice assistants on FDroid or Github. If you set up either option with a speaker of high enough quality, this should work.

NSA warns that mobile device location services constantly compromise snoops and soldiers

"My God, if they're spooks then they ought to be about paranoid enough to only use a crappy little GSM type phone while at work."

Antiespionage report, section 12: mobile device usage among clearance candidates

Most candidates for this position are using off-the-shelf smartphones. They will be treated with normal scrutiny. Four candidates are using phones without smartphone capability. Two of these are old and are using old devices. While it will be assumed that these people dislike smartphones, these candidates will still be treated with elevated scrutiny. The remaining two are using newer devices without that functionality and will be treated with severe scrutiny. Two candidates are using atypical smartphones, namely candidate 280 is running a Linux-based mobile OS on a device from Pine64, a known provider of secure devices for technical users and candidate 393 is using Lineage OS, a variant of Android with additional privacy features. Candidate 393 will be subject to severe scrutiny. Candidate 280 will be denied clearance and will be further investigated for potential criminal tendencies.

Sometimes, if you want to blend in, you have to do things that everyone else is doing even when you don't want to or they're dangerous for your attempt.

Re: How terrifying

Well, most states have proven that they have and like that tech. There are also cases where someone was operating it, but the police never found out exactly who it was. Most of those I've seen were presumed to be state actors, but since we can't prove that, it's always possible that it was someone else. Since the hardware can be built by a nonstate person, it's not that surprising that some people have done this. It doesn't have to be a concerted effort for some new concerted effort to pick up the practice.

Re: Talyrand: they forgot nothing and learned nothing!

Your biggest problem isn't 5-7, it's just 5. Spies can always place calls from public areas without CCTV, well not very easily but we'll come back to that, but where will their recipients be? The person receiving the call won't know they need to receive a call, so they'll be wherever they were before, which is potentially exposing. They will have to keep their burner phone turned on to receive said calls, meaning it will be able to track their location if someone ever identifies that phone as a device of interest. If you were planning that the conversations are always preplanned, so both ends can go to a public place, how does spy A indicate to spy B that spy A has urgent information that spy B needs to know when they don't have a scheduled meeting for several days?

Now, a public place to make a call without surveillance cameras. I really hope no spies ever go to London or most cities really. There are cameras everywhere. If you find a place without cameras, someone could check feeds for the cameras near the place to find the person who spent the right amount of time in that place before leaving. The other problem is that, if you make a call in public, you have to say all your secret stuff in public. People can hear your conversation which either includes incriminating things or cryptic things, which might cause your listener to report you or listen in.

"does not mean that it is impossible to prevent tracking."

But in effect, it's really hard. To demonstrate this, let's see if your ideas work (not as well as we'd like).

"As the most obvious way, just prohibit people from bringing phones into the area."

This assumes we are talking about a specific secure area, but we can go with that assumption. Other comments have already explained the dangers of collection outside secure areas, so I'll limit myself to the secure ones. If you make people leave their phones outside the secure area, then a tracker can do several things. If they don't know where the secure area is, it's that place where lots of phones suddenly go offline when people put them into those isolation lockers. If no lockers, it's that place where a bunch of phones go to not move at all--if you have your phone on you, even if you're just moving around a room, the signal will change slightly. Not as much if it just sits on a table. Assuming they already know where the secure area is, they know now who goes there and when. They may not know what they do once inside, but they can track the phones as people travel to the secure area. This means you know when the area's personnel are away from their homes so you can search them, or when the area has most of its people so you can attack it for maximum destruction, or when the area is sparsely populated for some other type of activity like trying to plant bugs.

"Another way would be for the people running the secure area to set up their own base station which is made secure so that nobody can get location data from that base station."

So the area has its base station, and the data can't be intercepted. This doesn't necessarily mean that phones will switch to said station or that they won't also contact others. A lot of tower data comes from towers other than the primary one, which mostly comes from phones verifying that they're still on the best one. What happens if the station is on one side of the area while an attacker drives by the other side with a more powerful malicious station. They could easily convince several phones on that side to trust them instead. Of course, by that point, you may not have such a need for location information, but it could at least tell the attacker who works on that side of the area rather than the other side. If they have floor plans of the area, that data might be useful.

Apple re-arms the iMac with 10th-gen Intel Core silicon

The Pro iMacs have Xeons. All of them are Xeons. The article says this.

"So, one would expect the Osbourne Effect to be rarer these days."

There are three main reasons why it's not. First, people fear obsolescence of older devices, not because they're actually obsolete, but because the manufacturer drops support. The more locked the device is, the higher the fear. I have little fear with a standard computer because I have confidence I can find drivers and boot other things. I have less confidence with an ARM-based computer because their drivers have proven to be a nightmare. I definitely feel this with phones, because the chances that someone will find a way to break the bootloader and give me extra software is rather low.

Second, pricing is a little crazy. I may not have a problem buying older hardware, but if the manufacturer is releasing an update, I may wait for them to do that before I go to buy the older version. I'm hoping the prices will get brought down, which is mostly true because when it was the current model it was ridiculously expensive. If you do intend to buy computers or phones from well-known manufacturers, expect the quoted prices to be inexplicable and the sale prices heavily discounted and yet still a lot more expensive than you would have expected from a few years ago.

Finally, there's exactly the point you brought up. In the 1980s, people waited so they'd get a better product. Now, they wait because they can't get a better product. If my phone is a little annoying and I'm considering a replacement, I might buy something now. But if someone says that there will be a better model in a few months, I can wait; I'm not losing out much. For example, someone I know who likes iPhones and small phones was looking to replace their device early this year. I advised them to wait because there were these rumors of a smaller iPhone to be released. They put up with their old device for longer based on that recommendation.

Google reveals washable phone case, plus the new midrange Pixel 4a that goes inside it

Not voting on either comment, but in my case, I don't want that. My case protects the screen, but it doesn't cover it. It protects it by going over the sides, so if the phone falls onto its screen, the case keeps the screen from touching the ground. That combined with a cheap protector over the screen and not dropping it very hard has served me well so far. The case also goes around to cover other sides so it can absorb some shocks from a fall in any direction.

Meanwhile, a case that does cover the screen either makes me use the device with an annoying hanging component or causes me to remove the device more often to avoid the cover element getting in the way. I may want to hold the phone to my ear or have it positioned in various ways in front of me, and something that doubles its area doesn't help in those cases.

China requires gamers to reveal real names and map them to frag-tastic IDs

Re: Good move

Not as many as you think. For one thing, family names are common but there are still a lot of options for given names to increase the numbers. For another thing, this just plugs in on top of the existing tracking of IP addresses, meaning you don't care how many people with a certain name are in China, but how many people with that name live in each building. If you can track people by their address when they set up their account, you can do two things with that information. First, you can track them even if they move because you know for certain who it was who set up the account. Second, people aren't very original when thinking up usernames, so you can possibly identify people by names on other things that haven't complied with this policy.

Amazon gets green-light to blow $10bn on 3,000+ internet satellites. All so Americans can shop more on Amazon

Re: Global Internet

"Having assets in the EU is what gives the EU power. If they were not there and yet they could still provide services without the need for an EU ISP would it be as clear cut?"

The only way that would work is if they offered free internet as long as you get the hardware yourself. If they sell you the hardware, they operate in the EU. If they sell service, they likewise do so. To have the ability to do things like that means they would have to have at least some assets in that area, if only a warehouse full of satellite dishes and the account that people pay into before it's routed to the main account elsewhere. The EU could cease those resources if they needed to. The companies can do only so much to have nothing there, and if they do, there's less and less benefit they get from it.

Re: Educate me

Neither the ITU nor the FCC is dealing with the elements mentioned by the original post. Each concerns itself with telecommunications and radio frequencies, which are important, but not the original point. It's easy to turn off the radios when the satellite isn't orbiting over the right place. FCC happy, ITU happy enough, other countries' regulations not violated. Problem solved.

The problem mentioned, however, namely whether there's any controls on who can put what above us, is not solved. Neither organization has any stated goal of keeping space usage feasible let alone caring about what someone else should be allowed to do. And every other country with a space program similarly has no restrictions. If some country decides that it is useful for them to send up millions of satellites despite clear risks, they can do so without any restrictions. This could be a problem, especially as large countries aren't well-known for caring much about what happens to people in other ones. Then again, should a better space treaty include that provision, it probably would get ignored if needed; nobody's really sticking to the "no destroying other people's stuff and keep others in mind" parts.

All the way to Reno: Oppo's latest mid-ranger going global but lacks 5G compared to similarly specced models

We have different expectations

"If you're going to spend nearly £400 on a new phone that'll last you for the next two years, you might as well get one that works with the latest high-speed networks, right?"

At least for me, not right. If I'm buying a phone and expecting it to last for two years, I don't expect 5G to be generally available for most of that time, so I don't care. But also, I wouldn't be spending that much. If I buy a phone at a similar price, I expect much more than two years out of it. I upgrade my technology under two conditions. Either the one I was using before is now broken or the new one offers new features that I want. New phones haven't offered new features I care about very much for eight years or so, so I replace phones when they're broken. This means that I care more about longterm software updates and price and less about most other things.

First rule of Ransomware Club is do not pay the ransom, but it looks like Carlson Wagonlit Travel didn't get the memo

Re: In re tracing cash...

True, but there can be logs of which serial numbers were placed into the ATM before they were printed. Especially when using newly manufactured banknotes, the stacks are consecutively numbered. This is useful to catch people working for the bank who see a large stack of cash and think of the potential to pick it up and run. Going in is another question. I don't think they OCR those bills most of the time, but there is a facility to do so elsewhere and it is done on occasion. Having never worked in that area, I don't know how the scanning is done when it is deemed necessary or how routine it is.

Re: In re tracing cash...

Sure, that can be done, and it is done to detect known theft of bills with sequential serial numbers because such lists can easily be passed around. However, it doesn't provide you the same kind of information that bitcoin does. Cash can be spent several times before it ends up in a bank, and so even if you know that a criminal obtained such a banknote and it returned to a bank via a deposit from a retail store, you don't know that a criminal was the one spending it at the store. If the criminal doesn't steal it from the bank, but instead steals it from somewhere else which probably doesn't catalog serial numbers, then even when it ends up in a bank, you don't know that it was ever connected to a crime. Meanwhile, we may not know who spends each bitcoin, but we can track an individual one through every transaction short of just giving the wallet key over to someone else.

Infosec bod: I've found zero-day flaws in Tor's bridge relay defenses. Tor Project: Only the zero part is right

Re: The problems continue

"Pedantically, for something to be a "zero-day" it has to be actively exploited in the wild, before researchers discover it, or the provider is informed."

Even more pedantically, that's not it. The zero-day doesn't start counting up until there is a solution--something we know about and it's being used but there is no patch is still a zero-day. Now you may be correct about requiring an active exploit; the researcher claims that a zero-day exploit can be something that could be used but isn't yet known to be, while something that is known to be used is a zero-day attack. I'm not sure I buy that logic. Either way, if he is correct about these being exploitable and someone starts to exploit them while the Tor project hasn't accepted and patched them, they would become zero-days.

Re: The problems continue

Which is what the researcher is claiming. Whether they already do so isn't known, but he alleges that it is feasible. Given the level of expense the Chinese government has already taken to provide censorship, they clearly believe it is useful to perform such scans. My guess is that they either already are taking actions to block or identify Tor usage or they believe few of their citizens use it. I'm not sure which it is, but the former makes more sense to me.

The problems continue

This researcher has started to demonstrate various problems in Tor, including the ones mentioned here. While the Tor project may have a pedantic way to argue that these aren't zero-days, they aren't doing very much to describe why they aren't problems. For example, I notice that they spent a lot of time stating that the researcher read a paper wrong, but don't spend very much at all showing why the algorithm he provides for detecting traffic doesn't work. They've provided a few arguments for why it might not work at scale, but they have neither disproven his methods nor proven their defense.

It's worth reading the full blog entry, linked from the article, to see the details on detection. I also found a previous entry covering problems in the browser and direct connections to be enlightening. I don't always agree with the severity of things this researcher says--for example, in the previous entry he describes how to detect direct Tor traffic as very problematic when there's already a much easier way to do that, but it also has caused me to be more skeptical of things the Tor project says.

'I'm telling you, I haven't got an iPad!' – Sent from my iPad

It may be, but unless there's someone else doing the real work on it to make sure it stays working, some of the students might get caught in the trap while it's still in operation. An environment through which students must submit work is a very important thing in education, and when it breaks there can be large problems.

I am young enough that I've used such systems during my own schooling, and two events of problematic failures come readily to mind. First, there was the time when the system simply refused to accept uploaded documents. Every week, starting around 10:00 in the morning and ending at midnight or possibly later. The homework was due at midnight. I don't know how many students were thrown by this, but I had to email my professor with the documents and promise to try again later and that the files would be identical (fortunately this was accepted). The second time concerned a system for automatically detecting plagiarism which reported, on our class's final papers, nearly universal plagiarism. In fact, we had all committed exactly the crimes of which it was accusing us, namely we had copied, with only slight modifications, large chunks of other documents. Those other documents were our drafts for the same paper, which also got submitted into this system's big database. Worryingly, it seemed we had also plagiarized smaller sections from certain works which all seemed to be between quotation marks. Funnily enough, I don't remember that system being used for many other courses.

Humble-bragging ServiceNow CEO tells anyone who listens: 'Our destiny is to become the defining enterprise software biz of 21st century'

Bill, you may need my help

“[W]e're humble and we're taking nothing for granted. We’re on the move to our destiny to become the defining enterprise software company of the 21st century.”

Oh, Bill. Here are definitions for humble, take for granted, and destiny. Read each of these and get back to me. You have one or more of them wrong and we need to make sure you have a good understanding of them if you're ever planning to use them again.

If you own one of these 45 Netgear devices, replace it: Kit maker won't patch vulnerable gear despite live proof-of-concept code

From the reports, it sounds like it's only LAN-accessible unless the user has done something really stupid. Still, there are too many ways of getting LAN access and too many worrisome ways of exploiting root access to the network device, so it's still important.

Reply-All storm flares as email announcing privacy policy puts 500 addresses in the 'To' field, not 'BCC'

Re: Flash is dying, why not e-mail?

That is true, but unfortunately most of those things are worse. Email may have too many security problems to count, but you can pretty much guarantee that an email sent from one place will get to another one, and if it doesn't there are only a few reasons for it. More modern communication apps require a lot more configuration. Ones designed for companies often make it hard to communicate out of the company. Those designed by big companies require sending unencrypted data through their centralized system. Those designed by hardware manufacturers lock you in. And some others require phone numbers or email addresses and essentially provide an overlay; while the features are good, you still need the other mechanism for that one to work. Email and to a lesser extent phone calls and SMS are global and compatible. Most other things aren't.

Huawei claims its alternative ecosystem to Google Mobile Services has 1.6 million devs, 73 million Euro users

Re: I'm a bit confused by this.

Because the code is developed in the U.S., meaning that they're not allowed to supply it, even indirectly, through any entities they control or which control them, or through an independent entity which they know will be used to violate the sanctions. If they do, they can be penalized by the American government for trying to break their regulations, which is investigated on a when-they-want-to basis. This means that Google would be handing ammunition to cause them problems to any U.S. administration which has some reason not to like them.

Google allowed to remember search results to news articles it was asked to forget. Good

Re: Why I love the Right to be Forgotten

Google is not allowed to collect and store such information from other parts of the law. The fact that the right to be forgotten had to be enacted as a separate section, rather than coming organically from other sections, clearly indicates that it is a separate thing. Among some of the details that make this different is the fact that Google's database does not specifically say any of this; it simply knows that a certain page happens to contain those words; the entry for a page stating "Person X declared bankruptcy", "Person X presided over a hearing for declared bankruptcy", and "Person X fought against creditors who declared bankruptcy" look rather similar. In addition, if they are required to remove access to the page, they are not required to remove it from the database. In fact, they are required to put it in another database so they know not to link to it. The parts of GDPR regulating personal information would have required deletion, which this does not.

Re: Why I love the Right to be Forgotten

You're misstating the points you're replying to.

"This is not about the US Constitution or American law. This is exclusively for the other side of the pond. In cases such as this the database entries must only be removed for EU territory, Google can still legally show them in other jurisdictions."

Not only was the U.S. not mentioned, but this is a comparison. Countries in Europe do it this way, other countries do it a different way. The comment you replied to was contrasting these approaches and stating opinions based on this comparison.

"This is not a government forcing anyone to unpublish anything."

Wrong. You seem to have two parts to this argument. Let's look at each:

"Firstly, this is a purely private case between a private citizen and a private company."

No, this is a case between a private citizen, a private company, and a national government using a national law which is interpreted by a national court. The law decides what that private citizen is allowed to demand. The law allows the government to penalize the company if it doesn't comply. It is that law, and the government that created, interprets, and enforces it which makes this a governmental matter. It is true that the government isn't making unilateral demands, and in this case they refused to support the citizen's demands, but the law gives them power and it is that power which we are talking about here.

"Secondly, the RTBF is not about publishing. It can not be used to remove articles or force corrections. It is limited to the storing of personal information in the databases of search engines."

Wrong again. It is not about the storing of personal information in their databases. It is about storing of impersonal data, namely specific links. Which they are going to publish if it's in their database in the search results area. Which this law would make it illegal to publish. Your second phrase is wrong, and your first phrase is only technically right based on a limited definition of "publish". We have had many an argument in this forum about whether deciding and sending search results is publishing, and some of us think it is. Even if it isn't, it limits what Google is allowed to write to their search results pages. Not about personal information.

You can argue against the point in many ways. I would agree with some possible arguments. The points stated in that comment are exaggerated and not well-argued. There are lots of legitimate avenues for dispute. You did not choose to take any of them.

Google extends homeworking until this time next year – as Microsoft finds WFH is terrific... for Microsoft

And there you have the problem. If you know you will always be working from home, you would probably enjoy doing exactly that. If you knew you would be coming back in six months, you could try to liberate yourself from your agreement to rent and find somewhere nicer to be for those six months. If your workplace might bring people back, but nobody knows when or whether, then you don't have as much freedom. And the worst possible outcome: your workplace might bring people back and hasn't committed to a specific time by which you have to return. Google has done a good thing here just by giving a date well into the future. People can actually make some decisions based on this without fearing that they'll have to cancel plans at short notice.

Re: Anecdotally

I think your attitude towards shifting from office to home work depends a lot on what your office and home are like. I preferred the office, but that's mostly because the office for me was rather nice. We had separate offices, meaning little sound pollution or barriers to impromptu meetings, and my commute was a relatively short walk which I quite liked unless it was raining particularly heavily. I wouldn't be surprised to hear that people like home working a lot more when their office is in a really expensive place to live, meaning long commutes, or where the office involves a lot of distractions or is in some other way hampering productivity and enjoyment. Similarly, I'd expect working from home to be less popular for those who live with others who are frequently disruptive or for those who have other things to do in the area around their office.

Chinese tat bazaar Xiaomi to light a fire under Amazon's Kindle with new e-book reader

Re: Bazaar?

Yes, but given that the sentiment, phrasing, and timing was so similar between the posts, I figured it was likely. Especially as the idea was both wrong and rather unrelated--after all, Apple doesn't make devices like this, so they're not that relevant to the discussion.

Re: Bazaar?

You really had to post that sentiment twice? And by the way, it's not really true. Apple designs all their equipment, then subcontracts the manufacturing. Xiaomi does some of that, but a lot of their stuff isn't done that way. For example, they are somewhat well-known for their wearable fitness trackers, and they don't design any fitness trackers. Instead, the company called Huami does that, both for their own brands and for Xiaomi. Neither of these models of doing business is necessarily bad; whether it's Xiaomi or Huami making the trackers, people seem to like them, but they're not the same strategy.

Companies toiling away the most on LibreOffice code complain ecosystem is 'beyond utterly broken'

Re: "Slapping a "Personal Edition" label on a product implies..."

"Sorry, there are sentences like "Slapping a "Personal Edition" label on a product implies you can only use it for personal use, which would be against the license." which are utterly wrong."

Maybe you would accept it if rearranged. Here's what I think it is trying to say:

If a project said that you can only use it for personal use, that would be against the license. Slapping a "Personal Edition" label on a product implies but does not really mean that.

The sentence occurring immediately after the one you quoted makes it clear that they understand that the implication is not true. They are not claiming license violations. They are claiming user confusion.

Raytheon techie who took home radar secrets gets 18 months in the clink in surprise time fraud probe twist

Re: Did he not

Comment was written somewhat tongue-in-cheek, hence things like claiming he knew what he was doing and recommending that criminals pay attention to environmental considerations. However, it is good security practice to erase disks even when discarding the hardware, so I only had to joke about what his intentions were, not what is a good idea.

Re: Did he not

It looks like he wanted to follow good security practice. Even if you're going to toss the machine, erase the disk first. If you don't, an attacker can get the computer out of the bin and extract the data. Of course, if you're planning to discard the hardware entirely, secure erasing the disk is more easily done by using a hammer, but remember to still do it.

The instructions above are meant for example purposes only. If you truly are planning to erase your disk to avoid legal prosecution, at least you hope, you should not bin your machine. It is more environmentally friendly to have the diskless shell brought to an electronics recycler.

Re: Editing

I really don't mind the typos. It happens to all of us. My suggestion would be to turn the tips and corrections feature into a form rather than an email--sometimes I'm on a machine without email configured or with accounts I don't want to use, so I try to remember to send a message later and likely fail. I'm guessing it was done this way to deal with spam, but you already have our logins so you can associate reports with those for blocking purposes.

Russia tested satellite-to-satellite shooter, say UK and USA

Re: Sitting Ducks

Exactly. If you can have enough weapons to be able to take out satellites with a 12-24 hour lead time, that's pretty good. Preparing a ground-based attack might be able to go faster if you rush things, but it's not markedly so. Also, if you attack a satellite from something near it, you can do so in such a way that relatively little damage is caused to other things. If you have to fire your offensive weapon from the surface, you don't have as many options--either you launch what is effectively what you could launch already, or you go for a blast it to pieces approach. If you do blast it to pieces, there's always the chance you might damage something you didn't intend to damage, either causing problems for you or angering someone who was formerly neutral. Even if you still think surface-based attacks are useful, it doesn't hurt to have both options available. If you can stand to wait a few hours, use your orbiting disassemblers. If you can't, bring out the big laser.