Posts by doublelayer

Sudo? More like Su-doh: There's a fun bug that gives restricted sudoers root access (if your config is non-standard)

Re: @tfb - Already patched in Slackware.

"It is not you alone that decides who is to be trusted and who's not, business has also a word to say."

Methinks you misunderstood the main point. The main point was that giving unrestricted root access lets everyone with that access do anything. The business wouldn't want that. Nothing was said about the admins making all decisions; instead the admins would be better implementing a security policy limiting users' access to run stuff with root privileges.

"Also, may I remind you the not so few cases in which a trusted sysadmin locked down networks and systems and denied legitimate users access ?"

And how did they do that? By running commands as root. So if you give ten times as many people unrestricted root access, you have ten times as many people who could do something like that. And your disagreement with the original point was?

Re: I suspect that most didn't even know it was an option

However, that usually allows a user to sudo to only one user, I.E. whitelisting rather than blacklisting IDs. I haven't read the details, but it sounds as if that configuration would have prevented this attack.

Lies, damn lies, and KPIs: Let's not fix the formula until we have someone else to blame

Re: KPIs

And that's often because I know any score below a nine (or sometimes a ten) is seen as an indicator that someone has failed. Even though eight out of ten is pretty good, I know there will be a discussion about why there weren't two more points there. Maybe this will cause a lot of problems for the person concerned. Maybe they'll send me a dozen more surveys to try to extract the reason for my withholding those two points. And I succumb to laziness and just assign nines and tens if the thing was fine or above.

I'm not sure that would necessarily have been the case. The data was wrong, that's true. But the data was also untested. It could be argued or inferred that the managers were responsible for at least attempting to verify that the data was correct, and that they had failed to do that. If someone in HQ was of a suspicious type, they might assume that management had specifically engineered the script to function improperly and was trying to blame the person who caught them, or that management and the developer conspired to do it incorrectly and could both be held responsible.

Blame is a complex substance; when it's dropped from the ceiling it never just falls straight to the floor. Every time, it splatters everywhere.

Re: Building entry log

That's why a system actually used for safety purposes would need to have a remote backup. If there were multiple sites, a mirrored version between the two would help. If not, the records could be stored in any number of remote places. It's quite doable. However, it's quite unlikely ever to be considered a priority despite the required tech already having been installed and the real benefits it could provide.

Tearoff of Nottingham: University to lose chunk of IT dept to outsourcing

Re: And this means

"When the only upwards path is into management you end up with management by people who weren't recruited for managerial talent but could do the technical job"

Sometimes, but usually I find that if that's the case, the people who could do the technical job got promoted into management, and because they either weren't good at that job or just didn't like it, they left. So management is made up of some random people who actually like but aren't necessarily any good at management, while all the technical people who were good at the technical work left because they wanted to keep doing technical work. Meanwhile, anyone that gets hired and can do the technical job well will do so, but they see what's coming and they're just biding their time until a different job comes along.

From Libra to leave-ya: eBay, Visa, Stripe, PayPal, others flee Facebook's crypto-coin

Re: Good reasons for virtual currencies.

Well, the theory is that it's harder to commit fraud with a crypto wallet than it is with a credit card. With a credit card, they need a relatively short number which will authorize any transaction whatsoever. With a wallet, each transaction needs a separate signing with a private key, so you can't just steal part of the data traffic from a previous transaction and start making new ones. That's the theory.

In practice, we all know how that ended. If you have a great way of keeping the private key private and secure and not known by anyone and easy to get to but also not easy for you to lose, then you're great. Otherwise, you can still lose your money and now you don't have a way of getting it back.

Re: The cost in kW

"And how is that any different to Barclays seeing and notarising all my transactions, as at present?"

I can't believe you're really asking that, but let's do a few comparisons:

Banks/money in government-issued and controlled currency: Strict regulations on what they're allowed to do with money. Not perfect regulations, and not always obeyed.

Facebook/money Facebook makes: Almost no regulations save for data protection (data protection regulations offer valid in EU countries and U.K. only). Facebook has a terrible record obeying even that.

Banks: They are not permitted to sell personal transaction history to anyone.

Facebook: They not only are allowed and are definitely going to sell transaction data to someone, but they already know the people they're selling it to and have customers eagerly waiting for it.

Banks: In most places, value is insured against a bank collapse.

Facebook: Hahahahahahahaha.

Banks: Multiple available. Should it turn out your bank has not been sufficiently protective, you can choose a different flavor of not that great, but at least competition exists and is enforced.

Facebook: Hahahahahahahaha.

Banks: Should you want to prevent them from knowing what transactions you do, you have the option to make a large withdrawal in physical cash and then spend the cash (offer only functions on some transactions, notably smaller ones).

Facebook: If you think getting a different currency out of their system without a lot of paperwork and paying quite a lot in fees is going to happen, you might not have read their documentation.

Banks: They are owned by many different people, and those people are interested in the profit of the company. So they aren't super happy to incur massive fines or lose all their customers and will change policies to try to prevent that.

Facebook: They are controlled by one person and he is already a billionaire. He doesn't need any more money and he will do whatever he pleases.

Government-issued currency: Supported by the government of the country. As history shows us, this is no guarantee that it will definitely retain its value, but it is somewhat likely to do so if the country is run democratically and has a large-enough economy.

Facebook: They can pretty much decide at any time to reduce the value of their currency and have fun trying to stop them.

Government-issued currency: The government of your country of residence has the ability to ensure this currency can be used to pay people; sellers can increase prices but must accept payment.

Facebook: Should Facebook stab sellers in the back with high fees, sellers would be completely in their rights to stop accepting it abruptly. This makes Facebook's currency less reliable.

Nobody is saying banks are great. We can all get together later and compete to complain the loudest about banks, and we have plenty about which to complain. But that doesn't stop Facebook from being worse.

Re: But today I'm a reformed character

I don't think you have the right handle on monetary policy there. Let's take this point by point:

"The notes that are printed by the treasury cost about 7 cents or about 6 pence to make...subtract that and the "usery" that the central banks charge for essentially loaning the money to a government who issue's the paper money and you have what the treasury/government make on actual currency."

That would only be the case if the treasury simply ordered notes printed up and started spending them. But they don't do that. The supply of physical currency is strictly controlled by various instruments of the government. Not that they couldn't start doing that, but the U.S. government, the one under discussion, doesn't and hasn't. If they did, then trust would indeed be lost, inflation in dollar-denominated markets would spike, and people would start using other currencies for international trade.

"However this is less than 10% of "money" the rest is virtual and is worth more or less what people want to believe its worth.... And are alluded to as financial instruments..."

No, it's worth what people as a whole have decided it's worth. If I decide my investments are worth ten times what they are actually worth, I won't get any more money. People disagree on the actual worth of the things, but that's why we sell things we think are worth less than other people think they're worth.

"As an example there is now. More "money" in derivatives than all the currency ever made, minted, printed or bartered for what there's a record for."

That's true. But many of those securities are in some way tied to things that aren't money. For example, stock in a company technically is backed by the assets of that company, including things that aren't money, like code written by the company or the physical items owned by that company.

"The reason the dollar is "believed" to have "value" is because energy can only be bought and sold in $ as mentioned above... The problem is that this distorts the value of the $ and devalues all other currencies...."

Energy can be bought and sold in any currency you like. The prices are usually stated in dollars because that's convenient, but dollars are not universally used. In fact, there are certain parts of energy markets where the money used is euros, because the participating governments or companies find that more convenient.

"The danger is that a systemic failure of US economy will knock through other markets...

ie the last "credit crunch" which by a large factor the was because of IGI was unable to cover what they had underwritinen in toxic credit default swaps."

That's very true. But that can happen no matter what country was involved. If China's economy collapses, we'll feel it here. And although many American financial companies dramatically worsened the severity of the 2008-2009 financial crisis, companies in other countries also contributed.

"I'm not sure how you perceive value but if you use it as a measure of what you can buy in a store ie purchasing power then the value is about 52 cents as the rest will be taken up in interest, duties, tax and fluctuations in the fx markets"

Yes, we usually decide that value is ultimately purchasing power. And your number doesn't make sense. When you purchase something, the tax and tariffs are part of the price you pay, which they tell you. So although your money goes both to the store and the government, the value is still one dollar. Not to mention that, even if you do decide to determine the value of a dollar based on the amount of the dollar that goes to the seller, the value will be very different depending on where you're spending it and what you spend it on. If you spend it in the United States on an item where the state has no sales tax (E.G. food) and which hasn't been imported or has no tariff, then you pay much less than if you spend it in a country which uses another currency (you pay for the eventual exchange into the local currency), which has a higher sales tax, and which has paid a tariff on the item. This is the reason we don't decide the worth of a dollar by who gets each part of it; we decide based on the price of the item and how many dollars need to be paid to obtain the item.

Re: But today I'm a reformed character

No, but considering that pretty much everything requires at least a little trust, I don't think we should limit ourselves to financial things to put on the don't-let-facebook-be-part-of-it list.

China and Russia join to battle 'illegal internet content,' which means what you fear it does

Re: Satellite internet's a'comin

I just meant to reply to the thread, not a specific post. And while you could put a dish there, it probably won't have the ability to contact the satellite without a very permeable roof. I haven't tested this, but I doubt many houses will allow for it. Of course, the installation of equipment is just one problem that needs to be solved before satellite comms work as anti-censorship gear.

Re: Satellite internet's a'comin

You may be interested in the recent activities of Turkmenistan. The general idea is that, because of urban beauty reasons and definitely not because they wanted to censor, satellite dishes are completely illegal. And that is enforced; if you have such a dish, the police will come by and confiscate it. You will be fined or imprisoned. This applies to every dish; it's clear they're primarily trying to prevent reception of satellite television, but they'll take anything. That wasn't particularly difficult for them to do. That can happen anywhere.

If you think the skies will be free, I'm going to need to see a receiver for satellite internet that can easily be used while remaining hidden and even more easily hidden should a censor come to call. So that will require the device to work indoors, without being obvious through a window, and collapse to a small enough device that it can be hidden inside something else. All existing dishes I've seen are quite expansive devices and need a very precise position, meaning that it wouldn't be all that easy to take it down and redeploy it twice a day. Can you show me such tech? If not, I believe you are badly mistaken in your optimism. Even if you can show me such tech, we've only solved the really obvious problems. Plenty more methods of censorship remain.

Re: Damned Authoritarian Governements

Sadly, both already have. China has blocked pretty much every communication app under the sun. What remains has a direct phone home to a Chinese government-controlled set of servers, and of course no encryption. Russia has mandated the same in law, but because they have less technical capabilities, they haven't gotten it yet. However, they are actively blocking Telegram after it refused to assist the Russian government in decrypting users' messages.

I know you were going for the "look at the west; they're bad too", but the western spy agencies are still trying to get the law to give them the power to demand companies assist them. Russia and China already have. I don't say this to support the surveillance systems supported by the west, but Russia and China are not being attacked by a hypocritical west; they're the disaster we are headed to.

The safest place to save your files is somewhere nobody will ever look

Re: Editing Docs from Email

That's dangerous. The user could edit the document, click the normal save button rather than save as, and have the file saved in the temp directory. And then you have to answer the question "Why didn't it tell me it wasn't saving in my folder?" If you make sure they know to save immediately, thus changing what document is being edited, there's less of a chance they will totally mess up what you said once you've left. Still a chance, but a smaller one.

Is right! Ofcom says Scousers enjoy a natter on the phone compared to southern blerts

Re: I Hope This Isn't True...

As a relatively young person (I have no problem making and receiving calls), I think the opinion of those who don't like to make calls is concern that the person they are calling will not appreciate the call because they are busy or unavailable. I'm not saying this makes sense; we all have a vibrate mode on our phones for a reason. But that's the reasoning I've heard from some people and those people tend not to make calls very often.

Father of Unix Ken Thompson checkmated: Old eight-char password is finally cracked

Re: Not sure...

Sorry, but that calculation is not sufficient. You're getting the combinations of 64 characters that can come from a set of 94 possibles. But since characters can be repeated, there are actually 94^64 options. However, since a 63-character password is not one of the set of 64-character passwords, it becomes that series I wrote instead. Either way, it's a bunch of numbers. But just in case you have access to the biggest hard drive and processor factory ever, make sure you check all permutations and all lengths lower than your limit or your rainbow table will have gaps.

You want to store a rainbow table of up to sixty four characters? Well, among other things, that's:

94^64+94^63+94^62+...+94 = ~1.926*10^126 password options (using the 94 characters from the standard ASCII printables)

Assuming we store a compressed version of that string that takes, on average, 20 bytes and we also store only a 256-bit hash (32 bytes), that's

1.926*10^126 passwords * 52 bytes/password * 1 terabyte / 1099511627776 bytes =

9.112*10^115 terabytes of storage

Using the rough numbers of 600 grams for a 3.5-inch hard drive, which we assume stores 16 terabytes, and has a cost of $200 U.S., this would produce a set of hard drives weighing 3.417*10^114 kg and costing $1.139*10^117.

In other words, your rainbow table would weigh about 1*10^75 times the mass of the sun and would cost so much that, even if you diverted the gross world product to pay for it, you'd need to continue long past the death of that sun to pay it off.

Talk about a calculated RISC: If you think you can do a better job than Arm at designing CPUs, now's your chance

Re: "I did not know that ARM actually prohibited adding instructions"

I don't think you understand what is being said. You are telling us that, if you request and parse the CPU ID before every questionable instruction, it would add a lot of overhead. When you say this, you are right. When you say this, you are missing the point. The ID is not retrieved and parsed before every possible instruction. It is retrieved and parsed (only if applicable), at the beginning of execution. Then, things are updated to use the proper instructions. The overhead is only incurred once, and that is a negligible time cost. You ask for examples of things doing this. I would direct you to nearly every program that uses one of the instruction sets that are widely supported but not universally so. Using my example of AES, look at disk encryption programs. They will do exactly this. Other extra instructions are frequently used conditionally by programs such as VM hosts or anything where the marketing includes the phrase "hardware acceleration".

As an example on how this is done, consider this pseudo-assembly, with AES acceleration as the example:

#function that does encryption in hardware:

run_cpu_aes_instruction parameters

return

#function that does encryption in software:

bunch_of_normal_math_instructions parameters

return

#main function:

encryption_function = do_it_in_hardware

//Note: I've written this like a variable. I do know about computers, so I know this would be implemented by storing a number in a memory location or register. I wrote it like this for simplicity of reading

Retrieve CPUID

Parse CPUID

if (CPU can't perform hardware AES):

encryption_function = do_it_in_software

#rest of program

In this simple case, the only thing that's changed is the value of the pointer encryption_function. The rest of the code merely jumps to it. In the real world, there would be more complexity because they'd probably write the code to avoid the function-calling overhead too. But I hope you get what we're trying to explain.

Re: "I did not know that ARM actually prohibited adding instructions"

It really depends what you're doing. In many of the cases mentioned in the article, the unknown instructions are probably very manufacturer-specific, and therefore little care needs to be taken because the code will only run on chips made by that manufacturer. But there is code to check CPU IDs and change what instructions are run. Perhaps the simplest example of that is CPUs with an AES acceleration capacity. It's frequent to have a check performed at the beginning of the code to determine if the processor executing the code has acceleration instructions for AES. If it does, a branch using those instructions runs. If it doesn't, a branch that has the functionality implemented in software and compiled into traditional instructions is run instead. It's not checked immediately before running the encryption; instead it's checked at the beginning and the result determines what code is run for minimal overhead. The same could be a factor depending on what manufacturers choose to do with the ability to create new instructions.

Twitter: No, really, we're very sorry we sold your security info for a boatload of cash

Re: If something is free, YOU are the product being sold

This is far too general. In some cases, it's simply not true. Plenty of software is released for free without expecting data or anything else of value. And, in many other cases, people pay for a product and have their data stolen regardless. To some extent, you could say that "If there are ads on it, you are the product", but that's not necessarily always the case either.

I know what they mean. They mean that the phone numbers weren't simply packaged up and emailed to the advertisers, I.E. no data was "shared", deliberately on the basis of "let's share this big list of numbers". However, the data was, in fact, shared because the advertisers got matches. The matching software ran on Twitter's servers and not the advertisers', that is all. From the perspective of the users who had their numbers stolen and given to an advertiser, there's not much difference. I would cheerfully accuse Twitter of almost a lie in this occasion. They know what this means but they were deliberately deceptive to try to make it sound like less happened. Definitions of "lie" can change, but it was clearly less than honest.

Geographic coverage

We now need to find out where this applies. If it applies to European users, they may be in for quite a fine, as this is a pretty clear GDPR violation and they probably didn't disclose any of this as they were required to do. Why do I have this sinking feeling that it applies to everyone but the European users (just check, investigators, you'll clearly see that the server says "everywhere-but-europe.twitter.com" and why would we lie?) or that those with the power to hand out fines will consider it and then forget?

Android dev complains of 'Orwellian' treatment as account banned after 6 years on Play store

Re: It exists

And that's a very good store. But a lot of devs don't want to release their app as open source and do want to sell it. FDroid has support for neither of these desires. I nearly always check FDroid for an app before I'll go somewhere else, but it's almost by definition going to lack the apps of any corporate entity.

"they should have seen that this was a possibility and planned for it"

Sorry, insufficient information was supplied. You're going to have to specify how, exactly, someone could plan for that eventuality. The only method I can think of is "follow Google's conditions". Most of the people who get articles written about them seem to have done that, or at least attempted to. What else could you do? Try to take out an insurance policy on your developer account? I suppose you could have a separate account for each app that gets produced, but that is actually against Google's conditions and wouldn't help all that much when they start delisting apps.

What? No way. Apple? Censoring iOS 13 to appease China? Gosh. How shocking. Who'd have thought it?

Re: Maintain the rage; it works!

I think that was because they really had no good excuse for withdrawing that app. This probably won't get changed just because people tell Apple that human rights are kind of, you know, important to them. I think they considered whether political freedoms were important to them a while ago when they implemented that change and they decided they didn't care all that much. Sadly, I cannot think of any large enough company in a better situation; all have terrible records when it comes to China, and many have other terrible records on similar issues.

Iran tried to hack hundreds of politicians, journalists email accounts last month, warns Microsoft

Re: Flock of Seagulls

"I find it hard to get worked up about email hacking."

Then maybe you should think a little more about what email hacking lets you do. First, it lets you target specific people and look at their communications, including those that might be private. We're talking private because they contain sensitive information, not necessarily because they reveal unethical activity. For journalists, that might be the identity of a source. For Iranians living outside Iran, it might be the name of someone inside Iran they care about. For politicians, whether they are likely to support laws the hackers don't like. For a candidate in a campaign, the strategy they're planning to use to challenge their opponent. There's a lot you can do with that kind of information.

But there's a lot more you can do with an email. You can impersonate that person quite easily. You could of course have spoofed their address without having to access their mailbox. But with that access, you don't have to do that; anyone who checks thoroughly will still think the message came from their mail system because it did. Having read the messages they send, you can better imitate their style, making your message more convincing. And you can intercept replies to your message, hide them from the actual user, and reply to them at your convenience.

Have you considered that the more strenuous attacks you mention probably have an email attack as one of their components? It is always possible that [insert group of evil people] have found a device on the internet that they can access and it lets them turn the power off. Given the security of these systems, it's likely there exist a few things of that nature. But you still have to find them, gain access without arousing suspicion, and understand how they work. Meanwhile, it might also be a little useful to gain access to the email of one of the engineers of the company and watch for technical documentation. Now you know how the system works. If you don't have access to the system yet, the credentials you just stole from the email probably help. And if the system either doesn't have an insecure thing online or you haven't found one, your access to the internal email gives you the option to get some malware in. Many targeted attacks begin in just this manner. Usually, it's by spear phishing for credentials or malware installation, but then it immediately turns to email compromise.

If you can't see that email attacks can be quite dangerous, you might need to think about it more.

Google sounds the alarm over Android flaw being exploited in the wild, possibly by NSO

Re: re: Google Play Store

Nobody said there was a good alternative. Sometimes, we can say that "X is bad" without saying "We have a good alternative to X, and X is bad so you should use our alternative". In fact, we're often more vocal about it when there isn't a good alternative, because it's not easy to abandon the bad thing.

As for actual alternatives, FDroid is probably the best in that it doesn't have a bunch of malware on it. It also doesn't have many apps that the standard non-reg-reading user wants, because they want things from corporates who in turn don't want to open source their stuff. The Apple app store may have a bunch of problems around monopolistic practices, but they are at least much better at keeping out malware. Of course, that locks you in to using an Apple device, and those are getting far too expensive, so that's an option of tradeoffs. Another alternative is that Google get their act together and fix their store. Oh, sorry, I seem to have accidentally pasted in a line from this science fiction story I was writing.

Here's that hippie, pro-privacy, pro-freedom Apple y'all so love: Hong Kong protest safety app banned from iOS store

Re: Did you ever bother to read Apple's statements for years....

It doesn't qualify as news? For one thing, the article clearly says that it's not clear what law is being considered. And for another thing, just because it is a legal move under Chinese law doesn't mean it's completely irrelevant; they can follow the law and we might still want to know. And given how many people have commented already, we clearly thought it was important enough to read the article. And for one last thing, just because it follows Chinese law doesn't mean we have to agree to it. Plenty of things that are legal get lots of disagreement. Frequently, that's the first step to having a law changed. Sometimes, it's just people who hold an opinion about what would be nice.

Deciding that something is "not news" is hard. If 1) it happened, 2) people care, and 3) it's unusual or new, it's news. Number three can be optional. In this case, 1) the app was taken down, I.E. it happened, 2) many people have proven that they find the story interesting enough to comment on it here and on other sites, I.E. people care, and 3) the app in question was an unusual one having to do with a protest and interactions with police and the decision to take it down was made on an unclear basis, I.E. it's unusual. It's news.

How much is your face worth? Google thinks a $5 Starbucks gift card should be good enough

"Google said the data would be retained for 18 months."

And it will. It will be retained for eighteen months. Then, it will be retained for another six months. Then, it will be retained until the end of time. They never said it would be deleted after eighteen months.

Come on, Google. If you want to do the misleading statement thing, you'll have to do better than that. Your spokesperson undoubtedly has a degree in PR, and I'm a software dev. Until they can come up with a statement I couldn't have, they're not even trying hard. I know you don't think you have to but...

FBI softens stance on ransomware: it's (sort of) okay to pay off crims to get your data back

I think they can do two things, though only the first one is guaranteed to be available:

1. Check what ransomware strain was used and see if it's on a list of ransomware known not to decrypt. If it is, don't allow the company to pay. This can catch some old ransomware, but most strains that don't decrypt and are used nowadays are relatively new.

2. Try to negotiate with the people demanding the ransom for proof they can decrypt. This can be done by giving them an encrypted file and asking them to decrypt it. Anyone with the decryption key can decode that file and then the decryption key can be purchased with more confidence. Of course, only the nicest of ransomware criminals are likely to put that amount of effort in to gain the confidence of a victim.

In general, even with competent technical assistance, a ransomware attack can only be partially rewound by paying the ransom. Instead, get competent technical assistance now, create a backup system that works, and you won't need to pay the ransom at all.

Just for the record

It's still a very, very bad idea to pay. The reasons are many, strong, and extensively detailed here and in many other places.

Microsoft has made an Android phone. Repeat, Microsoft has made an Android phone. A dual-screen foldable mobe not due until late 2020

Re: Surface?

According to the article, these devices are running standard Windows and Windows on ARM, both of which can run win32 applications. They're not making that terrible mistake again. I don't know how well ARM Windows can run these programs, and it's quite likely that certain older ones or ones that need lower-level hardware access will not work, but the devices should be able to run many of the traditional Windows programs.

Re: Apps?

I have no idea whether it will ever get released or how long it'll last, but I think the reason for special apps is that the screens may move around and depend on one another, unlike the traditional two monitors on a desk setup. For example, a web browser would want to show content across the entire screen if the two screens are simply placed flat but might want to separate the page into two self-contained sections if the screens were positioned like a book, so the experience would be more booklike. Similar considerations could apply with various methods of sending input, as there are two touch surfaces but they are not necessarily independent. I cannot really imagine attaching a keyboard without having the device be ungainly, and there will probably be several apps that have what they think are really clever touch controls.

Landmark US net neutrality decision reveals that both sides won and lost out

Re: I wish the Internet wasn't so thoroughly controlled by the US

In practice, that couldn't happen. If the U.S. government decided for some reason to take control of IANA and reallocate all the IPV4 addresses to point to different places, let's look at what would happen. First, we would start with the question of why they'd do something like that. There isn't any conceivable benefit to messing with IP addresses because it would break lots of stuff. But we're assuming that they do so anyway. Immediately, the regional NICs would complain. Their word would be considered strongly by traditional IANA personnel, but we'll assume that the U.S. government has replaced all those people with people who don't care. Even in that case, the remaining NICs would probably immediately decide not to honor the new routing rules, and stick to the former system. The only country outside the U.S. that would be affected would be Canada, and I think their diplomats would have something to say about it.

There were stories of politicians saying that ICANN specifically should be made a group under the authority of the federal government. However, it was clear that they had no idea what ICANN did or any intention to change its operations. Instead, they merely heard a news story about the group gaining some independence and freaked out. Expecting technical knowledge from a politician is doomed to failure.

Another system you mentioned could be at risk is DNS. Here, however, you have little cause for concern. DNS is decentralized, at least enough that no national government can mandate changes. Many providers of root servers are based in America, but many others are not. Nearly every country TLD is administered in that country, excepting only the small countries who choose to outsource their domains for sale. The only thing that could happen is that someone in an international ISP would have to change the root server used by their DNS resolver. In addition, even the American DNS providers are private companies and cannot simply be told what to do without new legislation being passed.

An unbearable itch to migrate your OS to the cloud? You might have a case of Windows VD

Re: "run their Windows 7 desktops in Microsoft's cloudy data centres"

But there wasn't a system that allowed you to not hate everything while doing that. If using a CLI, it was just fine. When doing anything at all intensive in a GUI, there would be lots of lags as data got moved around. So computers were made self-contained. With increasing network speeds, it will be possible for people to do more work on a remotely-located device, already popularized by the Chromebook and cloud services from Google, Microsoft, and Adobe. We will have to see how long it takes for users to realize that their remote client isn't really saving much power for them and that it's sometimes really inconvenient to have all processing dependent on something located a few easily-cut network lines away from you.

WeWork, but We don't IPO: Self-styled techie boarding house calls off cursed stock offering

Why do they call it a tech company

WeWork has been calling itself a tech company since I've heard of it, and I still don't understand their logic. Of course, they have some tech workers, but who doesn't? There are lots of companies that have a lot more technical work and yet are never called tech companies, such as most banks, mineral exploration companies, and agribusiness. This company is a real estate business. So what is the tech they keep talking about? Have I missed some supercomputer they have doing something really technical?

Re: Why bother?

In many cases, companies put all their staff in a specific area in the same building, and then it's a lot like an office owned by the company. Leasing from any number of landlords can be similar. In that case, the reason is primarily having staff located close together so they can meet in person. It also lets them provide certain facilities that are unlikely to be in everyone's home. Working from home is great if you choose to do so and have a home suited to it. It doesn't work so well when you need things an office has, including proximity to colleagues.

Chinese sleazeball's 17-year game of hide-and-seek ends after drone finds him on mountain

I'm sure he didn't think about having to worry about an aerial scan for him, but I doubt he was completely disconnected from all people for seventeen years. For one thing, they didn't specify how he was getting food. It is theoretically possible that he hunted for it and that's it, but given the difficulty in doing this in an area near a large Chinese city and maintaining sufficient nutrition to stay healthy, it's probable that he had another mechanism such as entering a nearby location to purchase or steal food. So he could probably have learned of the existence of drones. If he had thought police would have used them to find him, he could have disguised his location or simply moved to another place, as the police could only find him after having a good enough idea that he was to be found in the mountains there. And that's another point that makes it less likely that he never saw a person for that time, as the police had to learn this possibility from somebody.

A new US-UK data agreement is worrisome but it won’t give access to encrypted comms

Re: Telegram

And both institutions have requested just this. So far, the law allowing them to demand it hasn't been accepted. They might have tried, but I doubt they succeeded in getting cooperation from the companies involved without a law. So when this law gets suggested again, make sure you argue vociferously against it..

Re: How do Facebook decrypt messages in a web browser?

I don't use their messenger, but I don't think it's that hard. First, many messages they display wouldn't be encrypted anyway, as the article states, because encryption isn't on by default. The encryption key for those that are encrypted is likely stored on Facebook's servers in an encrypted form*. When you enter your password, it is used to obtain the key. Then, the messages can be decrypted either on the server or by javascript in the browser. Since Facebook doesn't store the plain text password, only the hash*, they wouldn't be able to decode the messages without you giving them the password to log in.

*Although this being Facebook, it's also somewhat likely that they do store an encryption key and your password in plain text, and if they decide they don't want to tell anyone that they're doing that, they simply don't include the key file when they send your messages to a third party. Given their various security disasters so far this year, I wouldn't be using their system and expecting good cryptography on it.

Re: Future trade deals?

They're all using basically the same encryption, not a specifically American algorithm. The export regulations on cryptography were removed in the 1990s when someone in the government realized that they were stupid. That doesn't prevent spy services from trying to break, backdoor, or at least intercept everything they can, but they so far can't mandate that a company start to use an algorithm they've done that to.

600 armed German cops storm Cyberbunker hosting biz on illegal darknet market claims

Re: This isn't the first time

I don't know about the original example, but it is possible they were referring to the "Republic of Minerva". This attempt at creating an independent island occurred in the Pacific rather than the Caribbean. It's unclear whether Tonga already asserted that these islands (underwater islands, but islands nonetheless) were part of their country, but either way they took them by force and they are still recognized as Tongan territory.

Re: Servers in space ?

Lots of logistical issues there. Your issues:

1. Construction of a satellite to withstand the conditions of orbit.

2. Having sufficient power supply, almost certainly from solar, to run the equipment.

3. Provision of sufficient processing, memory, and storage given the constraints of power supply and physical space.

4. Actually getting a launch.

5. The insurance if your rocket blows up.

6. The insurance if your satellite fails once in orbit.

7. Methods for controlling the satellite's orbital path so it won't hit or be hit by another one and people to monitor and use those methods.

8. A plan for what you'll do when the satellite decays out of orbit. Depending on how you've put this up, this might take a while before you care.

9. The method of communication with the satellite, as you won't be granted a monopoly over any frequency and disruption from other comms systems is likely a risk.

10. The method of connecting users to the satellite. Either they'll have to have similar hardware that you use, or you'll still have to downlink to the ground and use the facilities of ISPs, in which case have you really gained anything.

11. The potential that your project won't be seen kindly by your nation of residence, either because they don't like what you've put on the server, they don't like that your satellite is messing up other people's comms, or similar.

12. The potential that your business won't be seen kindly by your nation of residence, which can block your actions just fine while you are operating things from the ground.

13. The potential that either of the above won't be seen kindly by a nation in which you are not a resident but which does have an extradition treaty with your nation of residence. Since your satellite probably provides service throughout most of the world, they can argue that they have standing to prosecute you.

Got a pre-A12 iPhone? Love jailbreaks? Happy Friday! 'Unpatchable tethered Boot ROM exploit' released

Re: Interesting twist ...

I'll grant you that the tone is a bit harsh. It's useful to know, however, that the devices can be exploited, and probably more easily than they can be jailbroken, to brute force a decryption. IOS devices have for several years had a reputation, deserved or undeserved, for being hard to break into, and some people may have purchased them specifically with that intent. This exploit makes it straightforward to create a brute force device decryptor. I fully expect some company with ties to law enforcement will have made one pretty soon. It only remains to be seen which law enforcement we're talking about and how much we trust them.

Re: Who is really installing patches / updates

I'm sure you can find lots of people who don't install updates because it could cause problems. And they're not all wrong, as updates do frequently introduce bugs or mess something up. I think, however, that you'll find those people are also overrepresented in the lists of people who got successfully attacked by malware. For many users, malware is considered only in the abstract, as a bad thing they can't do anything about and not of major concern, and that's why many places have data breaches or go down because they've had a ransomware attack. Security patching is important.

Yes, to some extent we are assuming that. For the record, I usually want full access to things and I wouldn't have suggested Apple lock things down the way they have. But this degree of lockdown could really be considered a feature as a security measure to some buyers.

Your excuse is logical, but limited. It's possible that various evil people have found their own vulnerabilities in every phone and are perfectly able to do anything they'd like. It's also possible that no evil people have yet found a way in. What's most likely, however, is that some evil people have found a way in and a larger set of other evil people would like one, but don't have one yet. Not perfect by any means, but perfection in security is unobtainable. And protection against many might be considered a better feature to those for whom security is a primary concern than openness of software choice.

Margin mugs: A bank paid how much for a 2m Ethernet cable? WTF!

Re: Naievete!

That may be true, but that logic could be applied to almost anything. It could be that vendor B has a better shipping system, which is worth the premium. Or that vendor A is unreliable and frequently drops orders. But without knowing that, our theorizing it is just an assumption. What we do know is that these prices are not logical; both your examples are in the normal price range for a patch cable while the one paid in the real case is not. Even if their choice was based on some factors as you described, they would have to be very strong to warrant the purchase price. Given the many available suppliers of such equipment, and the fact that they probably buy ethernet cable with some frequency, it would in virtually all cases be worth it to find a supplier who can deliver cable at normal prices.

Hey, it's Google's birthday! Remember when they were the good guys?

Re: I remember when they used to say they were the good guys

I did. I'm sad to say so, but I did. It was in the 2000s. I was younger, prone to assigning things to good and evil boxes or at least along a one-dimensional sliding scale, and Google played right into the good box. They were developer focused, or appeared that way. They released a bunch of things as open source. They took action to make SEO less useful and keep search results relevant, and they succeeded quite often. When someone tried to break the internet with stupid legislation or proprietary standards, Google used their influence as a big tech place to inform the relevant parties that that would not be happening. I still don't know how much of their descent was already in action at that time, but I like to believe that they were once the way I remember them. It gives me some nostalgia while I remove more of their current tech from my devices.

Re: I remember

It could be, but frankly I doubt it. It's a pretty easy thing to take an idea you think is good, develop it, and try to push it out. When you get lucky and the idea takes off without a lot of painful effort, you can be dragged along in the tide. I think that Google probably started like this, and it was only when their incoming wave started picking up other junk that they started to realize that this could go in a number of directions. At that point, they found the easy way to make money, and discarded the original spirit that we saw in that whole "Don't be evil" thing.

YouTuber charged loads of fans $199 for shoddy machine-learning course that copy-pasted other people's GitHub code

Re: Why aren't you writing these articles slamming universities?

Your comment starts off reasonable. We have all seen subpar teaching in established universities, and we all know there are very good online teaching materials. I'll gladly agree to that.

And you then turn around and say that, because this is the case, all the material online is better than a university. That's just wrong. The course referred to in this article, for example, started off pretty badly in that it didn't teach the concepts people need to learn. And this guy doesn't get credit for useful code someone else wrote either; I'm fine if he chooses to teach from it, but he should properly credit the original authors and choosing useful Github projects does not a good course make. The internet has a bunch of information, and for every very helpful resource out there, there are at least ten pages with something outdated, incorrect, biased, or useless. Your all-or-nothing stance is misguided.