Posts by doublelayer

FBI warns of SIM-swap scams, IBM finds holes in visitor software, 13-year-old girl charged over JavaScript prank...

Re: Just wait...

A coworker recently wrote a piece of code that had a bit of a problem, and asked for my help debugging it. Its problem was that it tried to allocate about 300GB of memory and didn't check for errors after allocating. In order to debug it, I had to receive it. I think that guy is now guilty of various heinous crimes for sending me his diabolical malware which would have totally destroyed ... well temporarily disabled ... well made me press control C on a whole debugger session had I run it rather than just reading it. It's clearly a lot worse than what this person did. Which law enforcement office do I report him to, and how many decades in prison is he going to get?

Buffer overflow flaw in British Airways in-flight entertainment systems will affect other airlines, but why try it in the air?

Re: BYOE

I prefer having the IFEs, not because I find their features useful (I've never used one), but simply because they usually have the ability to charge USB devices. This can be quite useful after the laptop battery or book didn't last as long as you wanted and you're stuck with your phone for the rest of the flight. Otherwise, you always have to save enough power in the phone battery because you know you'll need it to get navigation or transportation when you land.

To put this in context, he typed in a bunch of characters. That's it. He did not break into the system's hardware or software, and he did not destroy it in any way. He typed into a field whose purpose is to receive input. The same thing would have happened if I was typing a message in but wanted to say more than its input limit. Unless it tells me this before I send (and if it has a buffer overflow it almost certainly doesn't), I wouldn't know when I've hit its limit. The only difference is that my characters would be a natural language message while his were not. If there is a situation where a user error from a user that is not acquainted and should not have any privileges can cause a safety risk, the system needs to be patched. If there is a situation where such error can cause a safety risk aboard an aircraft, then that system needs to be completely removed from aircraft and returned to its manufacturer, ideally by catapult into their security office.

Would you blame me for pressing every icon on one of these to see what they do? What if there is a certain pattern of icons that would cause the navigation system to reroute to Antarctica? What if the movie selector will zap the pilot with a massive surge of current if I watch two separate videos after clicking on the clock five times? What if the engines are disabled if I type in a 257-character message? If they shouldn't be able to do things, don't give the user-facing devices the ability to do those things.

He was faced with a system requesting input. He simply tried some type of input. It is the responsibility of the system to handle that properly. The better analogy is repeatedly locking and unlocking your own hotel door, because that is what the door is meant to do. If it so happens that, after unlocking a hundred times in one day, everyone else's door stops working, that's clearly the fault of the door system. Similarly, he did not try to disassemble the device or access it in some unusual way (connecting strange USB devices to the port to see if they could inject code). He merely entered input into a field that expected input. The same thing could have happened if he wanted to write a relatively long message.

One-time Mars InSight Lander engineer scores $1.5m redress over whistleblower sacking

Re: RE: I'd be a lot less emotionally distressed after than before

Not only that, but this effectively deletes a large chunk of his employment experience. If the company that he wants to apply to sees that he has previously shown ethics and has a problem with that, he won't be hired there. Meanwhile, he won't be getting any references from that company even as most companies want to see references from the most recent employers. Depending how long he was employed there, he may find it significantly harder to find employment, and that's if the company doesn't have a method of putting him on a blacklist. If they do have that ability, he may not get another job for a long time or without making a significant upheaval. That would give me a lot of emotional distress.

No guns or lockpicks needed to nick modern cars if they're fitted with hackable 'smart' alarms

Suggested addition to dictionaries

I humbly suggest the following additions to all dictionaries. I release these definitions into the public domain in the hope that they will be recorded for those who are unaware:

Unhackable:

: /ˈst(j)upɪd/

Adj.

1. Nonexistent or imaginary: We have a normal computer and an unhackable one.

2. Extremely insecure: The company has built an unhackable lock.

3. Destroyed or rendered nonfunctional: The plane carrying the machine crashed from a great height, and therefore both have been rendered unhackable.

My [noun] is unhackable:

Phrase

1. I am an idiot.

2. My [noun] is probably a lot worse than its competitors.

3. My [noun] won't pass a standard penetration test.

4. My [noun] won't pass a non-penetration security test either.

5. My [noun] might not pass a safety, fitness for purpose, or functionality test either, while we're on the subject.

6. Unless you can physically obtain one of my [noun]s, it probably doesn't even exist outside my marketing documentation.

Note: Unlike other definitions which use or logic, I.E. usually only one definition applies to a specific occurrence of the term, the preceding phrase definition uses and logic across all definitions.

Put down the cat, coffee, beer pint, martini, whatever you're holding, and make sure you've updated Chrome (unless you enjoy being hacked)

Re: Don’t you love monopolies?

Why, nothing of course. You see, as the market share of our wonderful rendering system increases, people are showing that they acknowledge that we provide the best, fastest, most secure, and most open engine available. We gladly extend our code to anyone, which is why we have made the Chromium™ engine completely open source and offer it to any user or company out there. We also offer all our services that are built into the Chromium™ engine and can't be removed without tearing the codebase apart to these companies, no questions asked except sometimes when they will need some API keys to distinguish them, but that's clearly a normal and justified thing to do with open source code.

With more and more people using the engine, any potential problems such as a framework that allows extensions that users install knowingly being able to block some parts of their traffic (yes, I know, but it happened) can be fixed extremely quickly. We aren't saying that it will be free of defects, but it will be better than the other options out there because it was developed with a very Googly mindset. We'll have so much data about everything that happens that we can find any risks to users' security or privacy and fix them immediately. We confidently expect that, in the next few years, the market share of our major competitors such as Gecko and WebKit will decrease to zero as competing browsers, which we totally support by the way, realize the superiority of this engine.

Google autocomment software, version 38.159.2581003.627501869274030461957286834

Well, we had to do something useful with our extra programmer-hours, didn't we? Like all google services, this autocomment software is completely open source. You can use it by getting an API key from Google's developer program and calling the three functions available in that interface. That's what open source means, isn't it?

Re: Double standards?

I'm usually in favor of some schedule of release if the bug is not fixed in a reasonable amount of time, but that reasonable amount of time has to be calculated separately for each new bug and take into account updates by the company involved. That release only helps if it encourages a company to work on fixing the bug when they otherwise would not, not as a stick that really does not always provide the same benefit.

While this CEO may be stiff, his customers are rather stuffed: Quadriga wallets finally cracked open – nothing inside

Re: Thank goodness Bitcoin is there to stick it to The Man, right ?

These people weren't trying to use bitcoin or any other cryptocurrency as a currency, which was its original goal. They simply wanted to jump on the bandwagon of thinking it would soar in value once again because blockchain, which sounds technical and people like to talk about on TV. They probably didn't have any specific distrust of government, unlike those who want to replace fiat currencies with cryptocurrencies, for whom trust is a very different issue. Those two groups must really hate one another.

"if the wallets were securely encrypted, how do the auditors know what is in them?"

Bitcoin is public, so you can read all transactions associated with a wallet if you have the ID of that wallet. The key to access the wallet would be the encrypted thing. Therefore, you could see how much was in each wallet but you couldn't spend any of it without breaking the encryption. I'm glad to see that this company is knowledgable enough to figure this out without, you know, waiting three months for some external auditor to do something so simple for them. It really helps my estimation of their competence and trustworthiness.

TalkTalk kept my email account active for 8 years after I left – now it's spamming my mates

GDPR came into force almost a year ago. They're subject to it now, and it requires them. That is assuming their contract doesn't say something about account closure, which many do in order to indemnify the company when they delete users' data after accounts are closed.

Once again, blame is not the correct way to deal with an account compromise. Whether the password was bad or not, the client did not take an action with the intent of allowing an attacker in. Yes, there are good practices that would have helped here, but not following every good practice does not automatically make any problem someone's fault.

In that case, I could come to your house, find a place where you have been too lax with your security, and blame you for the fact that I broke in. Should I do that, the blame for breaking in belongs only to me. Good practices mean that it is less likely that I'll be able or inclined to break in, and as such benefit you because you don't have to involve law enforcement. You may have entered a contract with an insurance provider that requires you to follow certain practices in order to get benefits. Still, I am not rendered innocent if you forgot to lock your door.

Victim blaming. It's wonderful, isn't it? The ISP didn't cancel the account or delete data when they were required, and someone else managed to get in and start spamming without assistance of the original account holder and despite their attempts to stop it, but yet it is the original person who is to be blamed for this?

Re: ridiculous advice

If you're sending me a party invitation by attaching something to an email, you might want to look at doing something else, as that certainly looks suspicious and I doubt I'd be opening that.

In most cases, the sender will include information in the message body about the attachment and why it's there. It's not that unreasonable to read this information closely and follow up with the sender if there is confusion, and many malicious attachments are somewhat easy to spot. Whenever there is doubt (did they really want to send me a random .pdf when the message simply says "Could you take a look at this?"), it's worth checking in, if only to determine what they want me to do with this if they did intend to send it.

Re: Indefensible

What data can and should be kept is another issue, but to correct one of your statements, we're not suggesting that they "[a]llow someone to close down an email address WITHOUT any verification", but that they close accounts that are inactive. It's a good measure for them to take as the account is no longer paid, may be required by a contract which initiated the account in the first place, better adheres to privacy laws, and prevents problems like the one mentioned in the article. When they didn't bother to do that and were contacted about an account sending spam, they could also disable the account, either simply for spamming people which is what they would do anyway or because they've now had their attention drawn to an account that shouldn't be live.

Did you know?! Ghidra, the NSA's open-sourced decompiler toolkit, is ancient Norse for 'No backdoors, we swear!'

Re: If nothing else ...

I think that, in most cases, the problem getting old code to run on something newer is all the old libraries it thinks it should be using that don't work the same, or exist, as they did so long ago. This wouldn't be able to help with that. It might be able to do some things, like taking a binary and making it run on a different architecture, but it's probably a lot more limited than we'd like.

Galaxy S10's under-glass fingerprint reader, quelle surprise, makes mobe a right pain to fix

Why I get disposable phones

This is why I don't consider the repairability of phones when I buy them. I expect that they will work perfectly for some time*, and then they will develop a fatal mechanical problem. Whatever the problem is, the fixing of that problem requires the manufacturer or mall store of completely untested mechanical ability to tear the thing to shreds, substitute a part that always costs more than it should, and put it back together in such a way that it feels like it is coming apart at the seams and is likely to develop another mechanical fault soon.

Meanwhile, if this is an android device, I fully expect that there will be no security updates let alone OS updates after a length of time, which makes the device more dangerous to use online due to all the "It's 2019, and a $something_simple can PWN your android phone" articles that get posted here semiregularly. So when I purchase a phone, I do my best to ensure that it is going to be able to run Lineage OS for continued updates, and that it does not cost enough that I'll be worried when something irreparable breaks without notice.

*In my experience, phones tend not to develop these mechanical problems for quite a while if treated well. I have kept my devices long after the next few models have been released and, for android, all software support was dropped. When they eventually break, it's more useful to find a replacement rather than try to have them repaired.

How to make people sit up and use 2-factor auth: Show 'em a vid reusing a toothbrush to scrub a toilet – then compare it to password reuse

More explanation is required for that statement. We all know about the biometrics problem (can't change them, you carry them with you where people can steal copies, etc.). Those don't apply to 2FA. So what are the problems you're referring to and what are the "simpler, more reliable ways" to fix it?

Re: What would get me to use MFA

If it's a good system that supports FIDO and U2F, you should be able to do that. Naming the individual keys is a bit annoying, but it works and revoking access is easy. Then again, I'm sure that a lot of places don't bother to implement that properly.

Re: The elephant in the room

This is a real problem. I have done this by having multiple auth tokens (one for corporate systems, one for personal systems, and one that I got because you could program it to do different things). I'm planning to change the firmware on the programmable one to hold multiple keys and use a series of button activations to choose the one to use. It seems very straightforward to do, and entirely capable of that. It may be possible to replace the firmware on more typical keys as well, but I don't know for sure. Also, as a bonus, when I finish with that idea, someone who steals it will have the fun experience of trying to figure out exactly what pattern of button presses I've set for my keys. They're very hard to steal and nobody wants it that badly, but I kind of want it to happen just so I can imagine someone getting annoyed trying to use it maliciously.

Re: Wanting to use 2FA is one thing...

"Also, pardon my ignorance, but how would I connect a cell phone to my computers? Do I need to install some kind of USB wireless device? I am indeed interested in 2FA, but it seems that there are different explanations of how to do it, each with a different set of unexpressed assumptions."

There are many ways to authenticate with something physical. A good system will let you choose, which throws out some companies, unfortunately. However, a good system will look like Duo Security (I am not in any way connected with that company. I just use their product to authenticate some places. I don't administer it either, this is purely a user's view).

With this system, you have a few options to authenticate. After you log in with your username and password, you are presented with a list of choices, so you can have multiple active options and use the one that is going to work. The options available include these:

1. Their primary suggestion is their own mobile app. You get a push notification, but it is not connected to your phone number. You have to have an internet connection for that to work, and you authenticate by pressing a button on your phone.

2. A code, also from their app. This is used if you don't have a connection (the code changes every thirty seconds based on a secret known to your phone, and becomes invalid afterward. Duo's is a 6-digit code that you enter on the thing you're logging into.

3. A phone call/SMS to an approved number, meaning you can use a landline. You do have to log in with proper credentials or that won't work, but that one could be abused by a local attacker.

4. A USB token like the ones mentioned in the article, either one that only works with Duo's system which the administrator probably has a gigantic box of, or an independent market one that works with a lot more (what I have).

This does not require that the thing you're connecting to having or allowing a USB device, or your phone having a connection at all times. If you simultaneously don't have a smartphone, don't want a USB device, and don't have any kind of phone with service, then I don't think there are other options. Still, this means you can use the authentication using a number of paths.

Re: Not even El Reg.

You have to log in to post anonymously anyway; the post is just not attributed to your account. The 2FA gets you into your account, and then you still don't have to attribute a post to you. The two seem entirely compatible.

Adi Shamir visa snub: US govt slammed after the S in RSA blocked from his own RSA conf

Re: Terrorists rolling their own crypt

Also, that may confuse cryptography with cryptographic systems. Rolling your own cryptography nearly guarantees that you will make a stupid mistake and your crypto will be broken a lot faster than you thought. Using someone else's crypto that is proven to work but changing the container format and/or transmission protocol means that the people attempting to read your communications will have to pick both of those apart before they can start to crack the key. It prevents them from having a pre-built module for it that they can set going, and you're still using a proven algorithm.

Cheap as chips: There's no such thing as a free lunch any Moore

Re: There's really no need to panic over this.....

I agree that they haven't been a major problem yet. However, there is a place where you don't have that clear a boundary. Case one is on a VM host, where one VM can run its own code and take memory from another VM. You can't block the malicious VM from running code, and you will have sensitive data in memory at some point even if it is only authentication data. The drive-by access by javascript is possible too, but requires more knowledge of the system, so is unlikely as you say. Another possibility is that access to certain parts of memory that are rightly removed from your segment may allow privilege escalation. I don't know where they are or how hard it is to use them, and I don't think people are finding that yet, but if we left them unpatched, it might be worth criminals' time to find out.

WannaCry-hero Hutchins' trial date set, Microsoft readies Google's Spectre V2 fix for Windows 10, Coinhive axed, and more

Re: Monero Hard Fork

I didn't say I agreed with it. In fact, I think it's a shortsighted addition. Still, it's important to characterize it properly. Unlike forks of cryptocurrency projects which cause people to lose value or get confused as to how to use it, monero's "hard forks" do not affect existing currency unless it changes in value as a response (it's massive decline over the past few months was not related to the recent fork, but instead because people have started to realize that long numbers with bunches of zeros are not really worth very much). The mining process is the only thing that is changed, for good or ill. Ill, by the way, by most reckonings.

Re: Monero Hard Fork

I'm sorry, but that is not correct. Monero has the "hard fork" stuff in deliberately. It is how the currency is designed. It was there from day one. The purpose is to defeat people building specific chips to mine the thing; if the method for mining changes every year or so, nobody can build a specific chip that produces good value for a while. Therefore, people mining with GPUs and CPUs that handle more general purpose math get most of the value from mining. The term "hard fork" means that the fork of the code is final, not simply another group making a different version, but the project as a whole changing it.

Argue if you like that it is not a good idea, but don't claim it's a weakness in cryptocurrency when it was built in by design.

Re: Coinhive to shut down

Well, they didn't exactly put the code there so they can't remove it, but I assume any site owner who knowingly inserted it will remove it as it no longer works and replace it with another version that's essentially the same. This almost completely. malicious stuff hasn't ceased to exist. It's just that people switched over to a different implementation of it. Meanwhile, the other cryptojacker malware people are probably updating their own miners to deal with the changes.

Huawei 'to sue US' over federal kit block – report

Re: whats this crap?

Original: "For example, it sees no problem with kidnapping foreign nationals to serve as pawns in diplomacy."

Reply: "China or America are we talking about?"

China. Definitely China. The Huawei thing is a different story where there isn't a clear difference, but I don't remember anyone being kidnapped simply to show that a Western country isn't happy. The Canadians arrest a person for which there is an extradition request. They didn't immediately extradite them, they are putting that through their legal system and are also handling the legal complaint by said person through their local legal system. Meanwhile, China takes a Canadian hostage for no reason. They did not accuse that person of a crime, they did not charge them, they were not complying with a legal request of another country in international law. One country is performing their normal legal process, the other thinks that detaining people for no reason is a legitimate diplomatic tactic. Don't support that by pretending they're the same.

Good news: Congress has solutions to end net neutrality brouhaha. Bad news: Two competing sets of solutions...

The internet has multiple layers

It does. The connection to the internet and the things you connect to are not the same. It is logical to call the sites online information services, but the network that lets me get there is not providing information. These definitions may help:

Information service: A service where the provider has information and sends it to me.

Communication service: A service where the provider allows me to connect to something else and exchange information with that something else.

On that basis, the line that carries my data is communication, as I am requesting to get information from El Reg. El Reg is an information service, but is not facilitating my communication with others. The separation is intrinsic to the protocols of the internet.

McAfee: Oops, our bad. Sharpshooter malware was the Norks' Lazarus Group the whole time

Re: "state hackers weren't smart enough for false flags"

They wouldn't really want to hide unless they had something new and didn't want extra attention, I.E. not what happened here. However, someone else might want to disguise themselves as North Korea, simply because it means tracking down the real them is harder. That was the risk in a false flag. Russia's attack on the olympics in 2018 was disguised to appear North Korean, and you could see a criminal group doing so as well for extra security against attribution, whether they end up getting that or not.

Correction: Last month, we called Zuckerberg a moron. We apologize. In fact, he and Facebook are a fscking disgrace

And this plays right into the ideal strategy to collect children and adolescents. They have a lot of time and nothing else. A little money seems like and possibly is a big deal to them, so they're willing to go through the effort of setting up something in order to get it. They haven't had the experience to know when they're being targeted maliciously. They don't have the technical knowledge to understand what kind of data they've just given away nor what can be done with it. I would not be surprised to hear that even more than 18% of these were adolescents; Facebook created a system virtually guaranteed to bring them all running.

Re: Facebook (inc Messenger), Google (inc Alexa, Android, Chrome and Youtube) and Twitter..

Minor pedantry: Alexa is an Amazon product. Google has a thing that is like it, called Google assistant. It's the one that does even less and constantly sounds angry at you.

Also, even when a consumer understands the "free service means you are the product" idea, they often don't understand "I bought a hardware device but the software on it still treats me badly". Another battle to be fought.

If at first you don't succeed, you may be trying to install that Slow Ring Windows 10 build

Re: Does anyone bother with Windows anymore ?

Yes, people are using it. Whether it's a good idea or not, a lot of places that I've seen are so connected to windows for various reasons that they are not going to switch. These aren't the people who need specialized software, either. Usually, they simply don't have the resources or will to switch their processes to mac OS and buy macs for everyone and don't want to try the Linux desktop thing. Some of them stick with windows 7, but it is going to run out of security patches, which frightens them. Also, they usually get machines by obtaining whatever is cheapest when a new one is needed, and many of those come with windows 10 already on them. The result is that plenty of people and businesses are now using windows 10, problems or not. Given that this is a beta version, problems seen in it are not going to change their minds. I've seen a bit of sway when some windows 10 bug hits them and disrupts something, but they know it will take some time to switch all their users to something else, so they stick with inertia and don't.

It's not your imagination: Ticket scalper bots are flooding the internet according this 'ere study

Re: Too easy to fix

Captcha, maybe*, but not old browsers. Bots may identify themselves as an old browser because their devs are lazy, but it's a five second fix to change the hard-coded user agent and run again. A user who hasn't updated their browser because they aren't sure how or like the older one better will have to spend much longer getting that fixed, and the tickets will have sold out.

* Can anyone build a captcha that works for users? The only one that I see all over the place is Google's, and it frequently accuses me of sending automated queries (I am not). Also, it has a lot of scripts that are very inefficient.

The problem with that method is that it becomes impossible to give tickets as a gift or go as a group purchasing multiple tickets at once. Theoretically, one solution would be to send the price higher so there would be less benefit to scalpers. I can't decide if it's a good or bad thing that this hasn't happened. I suppose you could make a longer reservation system requiring some external form of identification and limiting ticket purchases, but that's another annoying solution. If only every problem was ridiculously easy to solve.

Why are there never free power sockets when my Y-fronts need charging?

Re: Defective laptops

"You can read on an eink screen."

Granted. That's useful, while reading static text. That is fine. However, you can't easily read dynamic text, like fast-printing console output, without delays and the mandatory use of the less command. Sure, we use it all the time anyway, but the screen would be less fluid and more annoying.

"Why should I want video or colors?"

Because the world has decided that those things will exist. Some status things will display important information by changing icons and colors rather than changing text. I would rather they didn't, and it sounds like you agree, but a laptop might be called upon to do that. It also helps if someone wants you to look at a diagram, E.G. of a system they want you to work on or build. They may have used colors, which may be important to them. "My machine will last ten times as long as yours does" is not a useful explanation for why you can't see their document. For that matter, they may have used video as well to explain their point, whether relevant or not.

"I expect a laptop to be a mobile device."

They are, and they will run for a while. However, your concept, mainly the screen on your concept, removes some of the features of a laptop in the interest of power. It's useful to know what you'll lose by doing that, especially as people who just see a laptop will assume you have the capabilities your model has jettisoned. That's why I would prefer a laptop with a lower-power processor and a normal screen that is designed to be powered dynamically (E.G. a low-power low-brightness mode rather than a small saving from brightness reduction).

I would not want to use your idea. That doesn't mean that it wouldn't work for you, but I think it's important to recognize that a scaled-up kindle can't simply take the place of a laptop in all cases. My suggestions are that you get a laptop with lower power draw and a larger battery, or use a device that is designed for longer battery life. Your use case of reading text and writing on a keyboard actually sounds like a kindle would be sufficient for it. Either way, know what your hybrid product will be able and unable to do.

Re: Defective laptops

What would be the utility of that? The screen would take so long to refresh that you wouldn't get a refresh while typing and you could do nothing that requires colors or real time video. If you want low power, why not turn the screen off while typing? Similar power draw with equal lack of feedback. On the topics of processor, all the ARM laptops out there run rather advanced (read power hungry) chips, and are locked down a lot.

It sounds like you would be better served with a mobile device that runs longer on battery and a keyboard.

I also recommend a USB battery pack and a small USB keyboard. I have a keyboard-trackpad-combo about the size of a remote control that seems laughable at first, as nobody would ever want to type anything long on it, but the number of times I've been able to retrieve it from my bag rather than search the filing cabinets in the hopes of finding a keyboard there is surprisingly high. There are other useful devices I would suggest you carry, but I'm going to stop now before you end up having one of everything in your bag.

Re: stuff needs electricity simply to exist

I try to have as many things powered by USB as possible when traveling, because I can power them from a battery if I can't find an available USB charging socket. That works great for most things*, but I have yet to see a laptop that charges via USB, at least the normal kind of USB that doesn't start sending 55W at the device. The computers that expect high amounts of power from a USB socket don't work on any other charger than the one they were shipped with, in my experience.

*Depending on needs, a phone, WiFi access point (for a VPN network), tablet, standalone GPS device, media player, camera, etc. can be found that charge via USB. Go with those. If its cable has anything other than a USB connector on either end, don't buy it if you want it to be convenient to charge on the go.

Foldables herald the beginning of the end of the smartphone fetish

Re: fetishisable glass slab

Thanks for the suggestions. It does not have an IR blaster and nobody bought it when I put it up online, possibly because it isn't a well-known brand. It does run a snapdragon, so I'll look at the process of porting lineage or sailfish to it. It's been a while since I thought about porting a mobile ROM to a device because the experience was so terrible last time (and didn't work after the chaos). Maybe that has improved. I really hate throwing away working electronics that seem to have the capacity for modern workloads, but it sometimes leaves me with piles of stuff left by others who lack that inhibition.

Re: and want plenty of storage (say microSD).

I'd still like someone, anyone, to build a phone that isn't massive. My current phone has a 4-inch screen, and for my use cases*, this is just fine. I don't need a bigger screen, and I don't want a bigger device. The only phone I've seen that is small and runs a modern android is the Google Pixel. The original Google Pixel from two years ago, and even that has a 5-inch screen.

* My use cases:

Phone calls: necessary, very little screen needed

SMS: necessary, not much screen needed

Email: necessary, some screen needed to read addresses and subject lines, but not that much

Navigation: useful, some screen needed to select destination, but the rest is voice nav, so not much needed

I don't browse, edit pictures, read books, etc on my phone. I can get things with bigger screens for that. My phone is a very portable computing device, and that's a feature that is very useful to me.

Re: fetishisable glass slab

"Often a new battery can resurrect an otherwise "replace it" phone, making this easy is in customer interest but not manufacturer interest (as it delays a new purchase)"

In my experience, this happens a lot less than I'd like. By the time I've run the battery enough that it should be replaced, the manufacturer has dropped all the updates and it is becoming insecure to run the phone anymore. Short of lineage OS and its continued security patching, the software* seems to last a lot shorter than the hardware. Maybe I just don't use the phone as much as others, so the battery lasts longer, but I have rarely had a phone with terrible battery lifecycle problems. That said, I'd still rather the battery was removable, because that offers some benefits even if I haven't been using them so far.

* Any ideas on what I should do with an old android device running version 4.4? The hardware is fine, the battery lasts quite a while, the processor is sufficiently fast, and the camera is adequate. Unfortunately, it is so old it doesn't even have a date for security patch level, there is no custom ROM for it, and I haven't even seen a way to root it. It's been sitting on a table for two or three years because I can't bring myself to throw away a perfectly functional piece of hardware even though I don't have a use case in mind for it.

Latest 4G, 5G phone-location slurp attack is a doozy, but won't Torpedo Average Joe or Jane

Re: Not to worry only the State is likely to use this

The point is that you need to know where the person is (roughly, what set of towers) at a specific time and also their identification data for the cell network. Let's assume the government, Google, and organized crime are all after you and are maximally malicious.

Government: Does not need to use this. They can get all the information from mobile providers or their own more sophisticated hardware. Situation unchanged.

Google: If using an android device, they could have the data already. If not, they could attack others' devices in your area to do a scan for your device. They do not need to establish this type of infrastructure when they already have some they could take over if they really were maximally malicious. Situation unchanged.

Organized crime: They could perhaps use this, but they'd need a lot of technical information that is hard to get and a lot of hardware that is tricky to obtain and use. They probably would except they already have a perfectly good way to send a person to your general location and follow you. That's much cheaper, so they'd do that instead.

Re: Not to worry only the State is likely to use this

Not the point. There are a few parts of your comment, but they are not reaching the reality of this issue.

First, the state might do this, but doesn't have to. The state, should they want to track someone for whatever purposes, malicious or not, does not need such a flaky system to do the tracking. They don't need to crack your IMSI because the mobile company can simply tell them, and they can also make the mobile company tell them where you are. Done. If they don't want to do that, they have the hardware to deploy a fake cell tower that your phone will trust, and they have demonstrated that they don't have a problem using it. So whatever you think of a state, this particular attack is not much of a risk.

Secondly, this is not a broad category like "computer viruses" or "data collection". It's a particular attack, and one that requires a lot of knowledge and resources. I couldn't simply obtain all the components and software necessary to do this as well as sufficient knowledge for it to be useful. In addition, the exploit is being patched, hopefully soon, so nobody can do it. If a criminal group wants to track you and has the knowledge, essential for this mechanism, of roughly where you will be at what time, you have much larger problems.

Need a 1TB microSD for your smartmobe? Come April, you can free up storage space in your wallet and buy one

Probably. However, since they are very cheap, and unlikely to fail immediately, you could get a lot of semi-reliable storage in a portable case. The RAID approach prevents a failure of one or two cards causing the loss of data, and they're straightforward to replace. I would not suggest it for internal data storage, but it could be useful for backup or for those who need a great deal of data on them.

The main alternative is a portable mechanical hard drive. This would probably offer a lot of benefits, but it is a single unit with no redundancy, and if the controller fails, it may not be feasible to recover data unless the drive can easily be disassembled to get at the disk. This idea wouldn't be worth a ton to me, but I'd be interested and would possibly buy one if the price was right.

Re: Breaking the 2 TB ceiling

I don't know about the relative market shares between standard size SD and micro SD, but I would assume that micro SD is getting used a lot more, and hence has more has a lot more R&D work done on putting more storage into them. I also have to wonder how many people really want more than a terabyte on a removable, easily dropped, easily cracked piece of plastic. That falls into the too-many-eggs-one-basket zone for me.

I hope this development will mean that people who ship an SD card with their product because they must have a big box of them somewhere increase their default size. Anyone know something useful to do with a bunch of 2GB micro SD cards? I put one in every device that has a slot but isn't using it, and yet I still have a few sitting around.

Who needs malware? IBM says most hackers just PowerShell through boxes now, leaving little in the way of footprints

Re: Editorial question

Not mutually exclusive sets. In many cases, the PS attacks were run on an insecure public-facing system. Sometimes, the PS attack was run on credentials obtained from a phishing attack. The 57% is the number you are looking for.

The point is less "PS is bad" and more "malware in the field is moving to PS, making detection of files on disk less reliable as a method of confirming you're safe". There could be several reasons that a PS script is less secure than a Linux shell script, but it could simply be that more effort is being put into using those scripts. Either way, you have to get in enough to run the script.

Tech industry titans suddenly love internet privacy rules. Wanna know why? We'll tell you

Re: re: Tech giants hate this...

I'm not holding out hope that a company will always be on my side. I am hoping that a company, Apple in this case, will be on my side for unrelated reasons long enough for the protection to be made law. After that, if they switch their view, we could use the same law against them. For now, they're an ally and one I'm glad to have.

Musk is in contempt of court, screams SEC after Tesla boss brags about car production rates

Re: You know, screw that...

False statements can cause share prices to change, cheating people out of money. For example, the original statement of a plan to buy stock would, if believed, increase the share price. If untrue, this means someone can manipulate a share price for personal profit reasons. The proper legal system agreed with this conclusion at the time.

This is not an issue of free speech. He is not being imprisoned because he is not allowed to say what he did. He said and signed a legal agreement affirming that he would run these statements past a set of lawyers, and he didn't. If you would like to argue that the statement wasn't false, the statement could not cause a change in share prices, or the statement was not in the scope of the original agreement, you can argue that the complaint is wrong. Whatever your view on that issue, argue about what is at issue. Know what free speech is and what it isn't.

Azure IoT heads spacewards to maintain connectivity at the edge, courtesy of Inmarsat

Satellite data connection

Have fun with that. The satellite hardware will be larger than whatever is collecting the data, and will increase the bill from the power company quite a bit as well. However, the major problem is that the satellite comms companies charge quite a lot for the hardware to connect in the first place. If places only want to connect up one thing with this, that might be doable, but there is no way they're getting to twenty billion of the things under that model.

I have a feeling that most real use cases for middle of nowhere collection devices fall into one of three categories:

1. The device is located close enough to a place that can provide connectivity.

2. The device is attached to a power line, and there is also old-fashioned telephone cable out to it as well, which will cost less (probably).

3. The device does not send a lot of information, and can get some use out of the long-range, low-bandwidth radio communication systems.

I'm happy for the company to prove me wrong by coming out with a small, power efficient, and cheap satellite connection system that can be connected to anything. I wouldn't wait on it, though.