Posts by doublelayer

US Health and Human Services targeted by DDoS scum at just the time it's needed to be up and running

Re: At Just the Time

Yes, but only if they stood to gain from the chaos. If they wanted to start conflict or disguise another type of attack, a powerful attack on a health system during a health crisis wouldn't hurt. If they wanted to create confusion and terror to affect an election, that might help too. But what do they stand to gain this time? The elections going on now are relatively minor, and some have been postponed. Also, the attack didn't even work. If this was a state actor, they have done nothing useful.

Microsoft picks up Your Phone – unless you're an Apple fan – in a fresh Windows 10 build

Re: Unless....

"Yeah try doing that with an android phone. Oh you can't without a 3rd party app?"

If we're going to get pedantic about these arguments, exactly the same logic applies to Windows. It can work with Android phones. Running the latest software update. Manufactured by Samsung only. Only from two device classes. So for the vast majority of Android users, the feature isn't available without a third-party app. So maybe we can ditch the smugness all around. Apple's only works with all-Apple environments, Windows's only works with a couple Samsungs. Neither works well with anything outside their small device set. However, if you're really wanting to push this particular issue, the Apple people have a slightly better claim to pride about their system than does MS--theirs works with all iPhones going back quite a while, whereas the Windows-Android alternative isn't available except for people who spent a grand or so on their phones in the last six months.

I feel obliged to point out that, if this is a big issue for you, it isn't that hard to get a third-party app. Just find one that works with your phone and computer, which probably exists, and it will probably be fine. KDe has done quite a bit of work on connecting to Android devices, and I've heard it works well. It's not a big thing for me, though, so I haven't tried it.

Fresh virus misery for Illinois: Public health agency taken down by... web ransomware. Great timing, scumbags

"If they decided to get the site back up as quickly as possible, and just used static HTML. Assuming that bandwidth was not a problem, how much hardware would you actually need to serve 200,000 users?"

The answer depends on the following details:

1. How many files are you serving?

2. What is the average size of each file? Be sure to factor in images, local scripts, CSS files, and anything else a user would download.

3. How often does an average user interact with the site at the time of day/week where your site is most trafficked?

4. When they do, how many pages do they access before they end a session on average?

5. How much data can you cache in memory rather than having to read it from disk?

6. How fast is your disk? How fast is your memory?

7. Does your CPU have hardware acceleration for encryption (I'm assuming this site is HTTPS only as it should probably be)?

8. How tasked can your CPU get before it starts to overheat, underclock, etc?

9. What server software are you using? What is its limiting factor (usually either processing or memory).

10. How afraid are you that you will get a flood of visitors that goes above your previous estimation of peak demand?

And these are only relevant if you can easily create static pages, which if you're using a CMS you probably can't. Sure, it can be done, but it's not a quick process.

Websites are complicated.

Re: But how?

Could have been the former, could have been the latter, probably wasn't either. My guess is that they got in with a spear phishing attack. Targeted infections usually start that way. As long as the person who executed the payload had sufficient access, E.G. a person in the IT group, their internal security probably couldn't catch it in time. You could of course argue that there's lots of negligence in that scenario as well, but it would be the fault of different people, so they'll have to figure out what happened before they know who to blame.

Re: Further clarification...

I don't know for sure, but I'd guess that the storage array that was needed for the site and its databases probably got hit. The typical targeted attack will look to find those before going off so as to cause the most damage. They also probably tried to find and knock out any hot backups at the same time.

We checked in with the new Windows 10X build, and let's just say getting this ready for late 2020 will be a challenge

As I read

First, I heard about the desktop being unavailable in the container and I thought "Users won't notice if the desktop icons live outside the container as long as something looks like a desktop. Even if they don't have that now, it wouldn't take long to add. No problem."

Then I heard about Word not running correctly in Win32 and I thought "The users will install the latest Word release which they're undoubtedly working on, which will be some UWP-based thing designed for the two screens. We can't test it now, but there's no doubt in my mind that they have people working on it. As long as the icon's the same, users won't notice. No problem."

Then, I read this: "In the new File Explorer, local files are not accessible at all."

It's going to crash and burn. Really fast. Nice try, guys. Hiding people's files only works when they never use multiple applications on them. It's sometimes functional on phones, but it's not going to work so well on anything bigger than that.

The major reason seems to be connection between the two screens. Current Windows often treat multiple displays somewhat independently and let the user handle things, whereas apps might want to make their experience easier to run on both screens without necessarily using the weird hacks that would now require, especially when handling touch input on both screens. Why that requires a separate version of Windows rather than changes to Windows, however, isn't very clear.

Google to appeal against €7m fine from Swedish watchdog for failing to remove search results under GDPR

"That may be so in US of A, but in the civilised world, the opposite is is true."

Do you have a legal basis to say that? I don't think you do. May I see your papers on that comment?

The Reg produces exhibit A1: A UK court IT system running Windows XP

Re: What logic is this?

If they have a VPN, they're likely at least somewhat internet facing, if only to connect them through the internet to an internal network which doesn't itself have access to the internet. Even in that scenario, if the VPN gets disabled by accident (or on purpose), that could open them to attack, of which quite a few exist. But it's only supposition that the VPN exists for that purpose. Perhaps the VPN exists to protect the machines from access by devices on their local networks, but once it connects them in, they can still go online. In that case, more exploits are available. For example, I've worked at a place that had a rather paranoid VPN setup where it was impossible to disable it, being loaded as effectively a rootkit before the OS was run. But after that happened, I could still cheerfully go online and download malware. Of course they had other restrictions to try to prevent me from doing that, but the VPN didn't do that in and of itself.

Without knowing what people do with them and what exactly the VPN is for, it's hard to tell how vulnerable this is. And similarly, it's hard to know how difficult an upgrade would be without knowing what they're running on them. More information would be useful in this situation, so I assume we'll never get it.

Google: You know we said that Chrome tracker contained no personally identifiable info? Yeah, about that...

Re: Just one question

It's called the user agent string. It tells you what version of browser your visitor is running, and often some extra data about their system. You don't need more than that. And you won't get more than that for the majority of your visitors who aren't using a browser you've compromised. Only Chrome sends those headers, and only to Google. You as an average web developer gain nothing at all from that feature.

Alternatively, use a local script to redirect to a simplified page if a feature doesn't work. Then, check how many times you're getting requests for that simplified page. When it drops to a level you're good with, delete the script and the page.

Check Point chap: Small firms don't invest in infosec then hope they won't get hacked. Spoiler alert: They get hacked

Re: Insurance Risk Management?

Of course you would. All of us would. And all of our companies would probably call us or someone like us to go over anything that technical. The problem is when there isn't someone that technical in the place. Many small places have little or no technical assistance. Sometimes they outsource on a pay-per-request basis. Sometimes they outsource on a less expensive basis but their outsourcer won't just do any technical thing when they're asked, limiting themselves only to the specific things in the agreement. Sometimes they don't have anyone at all. For example, I'm currently the primary admin for a small charity. By primary admin, I mean to say that I volunteer some time, in small chunks, when they ask questions or I remember that I was planning to do something. They don't have a secondary admin. With that scale, unless they also have a volunteer doing it, they have nobody to ask to read their cyber insurance documents. In many cases, the person they'll forward the responsibility to will be their financials person who, without trying to do any disservice, won't know enough about what they're doing to do it properly.

Re: Insurance Risk Management?

Why should we look for a different insurance company? This one is willing to pay out even if we've made mistakes while those other ones keep making these demands about good system configuration. If we went with those companies, we'd have to hire someone to implement all the things they're so intense about. Sure the premiums are lower over there but the salary for that new employee is greater than the difference in premiums, and we all know that second option is just going to nitpick about everything before paying a claim. And what are the chances really that we'll need coverage for ransomware? It's unknown if we'll ever get hit. As for other intrusions, they're clearly unimportant because when have I read about those becoming a major issue as much as I've heard about ransomware. But even if we do get hit with those, this insurance policy is there as our fallback. We don't need anything else.

*The preceding program was brought to you by the finance department or, in the case of a small organization, the financials person.

Why didn't I think of that? You're truly a genius. Let's implement those immediately!

"Make operating systems completely secure, so that you don't need to buy anything extra."

Completely secure means it is entirely impossible for a malicious party to do anything unwanted, no matter what access they have. So, if I can use physical access to read a file that I shouldn't be able to, then it's not completely secure. So we'll have to eliminate all operating systems in existence.

"Severely punish attempts to compromise computer systems, so that no one will dare to try for nefarious purposes."

Your wish is my command, and fortunately for you, I happen to set the laws for the entire planet. Computer intrusion is now punishable by death. Problem solved, no? Well, you're missing one major thing, which is that we can't find a lot of criminals because they operate behind proxies and often across national borders. But I believe you had a solution to that, so don't let me get ahead of you.

"This solution is great, because its costs are borne entirely by the people whose fault it is that we have a problem. (Maybe tax software companies that make imperfect operating systems to pay for the hackers' bread and water while they're in jail.)"

Oh, good. The costs for finding the criminals will be paid by those criminals. Wait ... how? What if we fail to find them? How do they pay. Can we make up a fake bill for finding them and catch them when they come to pay it?

"Cut off internet and telephone connections to countries that don't fully cooperate in prosecuting hackers, like Russia, China, and North Korea."

Sounds great. Who wouldn't want to close the China market to all companies and customers in other nations? Certainly not me. Down with your connections. I'm cutting all your lines immediately. Now, listen here, China. You better not set up any more lines, or satellites, or let any hackers out of your country to use someone else's connections. Also, you shouldn't get angry that we've cut you off and respond aggressively. We wouldn't be happy. And you'd better not form an alliance with other countries we've done this to to replace the internet and effectively turn the connection-cutting policy back on us.

Think your smartwatch is good for warning of a heart attack? Turns out it's surprisingly easy to fool its AI

Re: Says more about their CNN possibly

These are mostly good points, but a few things need to be taken into account when considering how this study applies to technology being used in real life:

1. They managed to trick their own model. They don't know how to trick the models being used in tech, which probably have more samples. Considering how neural networks work, it's probably not difficult to trick the models in those devices, but they still don't know how to do it.

2. Even though they were able to trick the model, they were able to do so because they passed the data directly to the model. How would a theoretical attacker manage to pass misleading information to a monitor that is physically on your body without you knowing they were doing it?

3. What are the risks of devices using neural networks and being fed improper information? For consumer devices (mostly watches), the risk is that they call emergency services. I believe they do alert the user before doing so as well, so the user could cancel that.

4. What motivation is there for a malicious party to fake an ECG reading? It might be an interesting attempt to prove death by natural causes in a murder situation, but I doubt it's easy to murder someone and have it look like a death from heart attack short of certain poisons that effectively cause a real heart attack in which case you wouldn't need to fake the device.

So while the tech could be fooled, it probably is neither as easy nor as dangerous as it may sound. The real issue to consider is how likely these devices are to produce a false positive without someone malicious fiddling with the data. If there is a risk in these algorithms, it will happen when they think that a heart attack is happening when it isn't, or more likely when they miss an attack that really happens. I don't know how likely that is to happen--I don't have such a device--but that's the metric that will help us decide how dangerous or unreliable these devices really are.

NSO Group fires back at Facebook: You lied to the court, claims spyware slinger, and we've got the proof

Re: What laws have they broken?

Not really true. There are two places laws can be applied:

1. In the nation of the perpetrator.

2. In the nation where the crime took place.

If I am an Australian citizen, but I go to India and commit a crime then leave for Australia, I can be sent back to India to face my charges. The same applies if I am in Australia and use a network to commit a crime in India. So if it can be proven that improper access was obtained to computers in the U.S., then the U.S. courts have a claim to jurisdiction about that crime. Now, there are other provisos about that. For criminal matters, you get into the area of extradition, but this is a civil matter. So, if NSO is found guilty, they can manage not to pay the bill. However, if they don't pay, they may be restricted against operating or storing money in the U.S. as the U.S. can then be required to confiscate the money to pay the judgement.

This rule applies in any country pair. If an American company violates a law in another country, let's use GDPR as an example, they can be sued in the courts where the violation took place. It does not matter if they have a local subsidiary. It does not matter if they have anything physical in that country. It does not matter if any of their employees has ever set foot in that country. If they violated the law there, they can be sued there. The same logic applies to this case.

More than a billion hopelessly vulnerable Android gizmos in the wild that no longer receive security updates – research

Re: If only...

Unfortunately, I have to agree with you. We've had many alternatives, some of them good, and all have now died. The closest thing to an OS we can rely on on mobile devices is Lineage OS, which is great as long as your device is supported, which it probably isn't. It's disheartening to have to look at the pile of corpses of Ubuntu Touch, Tizen, Firefox OS, a few old Android mods, and if you just want updates and don't need open, Windows Phone and Blackberry's OS. However, I'm most afraid of what will happen in the future. Over the horizon I see the slow and unsteady but nonetheless present march of Fuchsia and Harmony OS, and I really would prefer that they not make it here. At least with Android we have some chance of breaking through. With things like these, that chance will be lost.

Sometimes, but not really. Just look at the top three manufacturers for having devices on the latest update mentioned in the article. Nokia (TCL) and Xiaomi are mostly using Qualcomm processors and modems. Samsung makes more of that themselves, but also uses Qualcomm. If these three can do it, then most of the other manufacturers using identical chips can also do it. That doesn't make Qualcomm perfect, and I'm sure there are many places where they deny access to important updates, but the manufacturers can't just blame somebody else for their laziness.

Unfortunately, Huawei has not proven itself to be great at releasing updates. While not worse than other manufacturers, they are by no means the best. Even worse, they don't have a great record of allowing users to unlock the bootloader and perform an upgrade manually. For that reason, I'm afraid we'll need to either look elsewhere or keep the pressure on if we would like something more lasting.

Watch this space: Chinese mobe flinger OPPO flexes first shot at the wearables market

If that was a condition, Google has either reversed it or ignored it. I can't say I know very much about the various watches, but I know that many manufacturers have their own skin over it. I think it's at least partially because every manufacturer has a different screen and hardware layout and they want to customize things. For example, rather than use a couple of standard screen aspect ratios as is done on phones, watches will have any shape of rectangular screen that the manufacturer thinks looks good (or can buy cheaply), and sometimes they will go for a circular or curved screen as well. They probably want to make their main screens neatly fit those nonstandard situations so the users don't know how badly other people's apps will look on them.

What's inside a tech freelancer's backpack? That's right, EVERYTHING

My usual contents:

Two laptops (personal and company).

Power cables for both laptops except for the one I needed last night and forgot to put back in the morning.

USB battery for charging phone while out.

USB wall power adapter.

Two micro USB cables: the one I broke a month ago but for some reason I can't ever remember to take it out and the one that was working last time but whose probability of working this time is inversely proportional to how much I need it.

Two ethernet cables, both of which work, surprisingly.

WiFi access point with VPN preconfigured.

External USB keyboard/mouse. Unfortunately, this is the one before Logitech figured out the concept of a power switch, so it might be dead at some point. And of course I don't carry spare batteries.

Bluetooth earphones.

Wired earphones which work only if the wire is bent at exactly the correct angle but I haven't replaced them.

Assortment of display cables which I might need, but rarely do.

Raspberry pi which I have configured as a fallback desktop. I can power this from the power adapter and use HDMI to a screen nearby. The one time I actually tried, I couldn't find a screen with HDMI in and used a remote connection from my phone which was quite painful.

Sometimes that changes, but often these are present.

Re: "my backpack can weigh between 8 and 14kg"

I would use a company provided phone for one simple reason: I don't want the company to have any access to mine. If the company wanted to hand me a SIM and that's it, I'm fine using my device. But they never want just that. They want to use some specific apps. And because they're secure, they want to have some company-mandated control over the host device so they can find it or remotely wipe it. All that makes sense, and I don't begrudge them wanting that access. But I don't intend to give it to them because a) their access could potentially give them access to some of my data which they don't need and b) I'm running a degoogled Lineage OS build and there's a chance what they have planned won't work anyway. So if they want to reach me when I'm not at work, and typical methods of contact like email won't work, they can give me the device with which to do so.

BOFH: Here he comes, all wide-eyed with the boundless optimism of youth. He is me, 30 years ago... what to do?

Re: Want cynicism? Try customer success

I don't think it's just commission, though that undoubtedly contributes. I know far too many people willing to sell things as long as they stand to gain money from it, so if their employer manufactures something that's terrible, they'll cheerfully try to sell it. Often, they manage to memorize enough technical jargon to make you think they know something about what they're talking about only to balk at your first technical question. Often, this is because they don't know the answer, but sometimes they do and they're aware you won't like it. I've occasionally found a salesperson who seems trustworthy, but they're far too rare.

The odd thing is that they could probably cut out any investment on salespeople they send to me if they spent twenty minutes creating a table of specs for whatever thing they're selling. Usually, I can decide somewhat quickly whether I'm interested from the specs table, and if I'm unsure, I read the manual. That table has to include all relevant information though, as I've seen a lot of tables that always seem to be missing whatever parameter you're interested in.

Re: Oh so true

I've seen the same thing with people considering what solution to buy and what level of maintenance to get for it. Some people will look at a business-critical server and say "We don't need any plan for this as it has redundant PSUs and RAIDed drives" while considering a maintenance agreement on some piece of consumer-level tech that we can probably replace easily enough if it really does break. Meanwhile, the critical details about software updates and availability of replacement parts are rarely considered. For example, I once had a discussion with a friend who was working on* an Android-based product for a company. They shipped that product two years ago, and yet they used Android version 5. Their sales documentation honestly said that they chose Android to provide faster access to updates. While this might have technically been true given what they used before was Windows Mobile 6.5 which stopped being developed in 2009, they didn't plan and have continued not to release any updates to the Android on their device, including security updates.

*The friend concerned worked for a place that wrote applications that ran on the device, but didn't work for the manufacturer. The lack of updates and cavalier attitude about product lifetimes are not her fault.

If you're wondering how Brit cops' live suspect-hunting facial-recog is going, it's cruising at 88% false positives

Re: Now you see me

It's worse than that. How many people are required to track down the one person who did get caught? Not that many if they're doing their job. It's called policing and investigation, and we've proven we know how to do it. How many would be required to find thousands of people? A lot more, but the system didn't do that either. Also, if we did somehow come up with enough police to track down each of these people manually, they'd be doing it by investigation of the fugitives and manual tracking, rather than mobbing the public streets and demanding identification from everybody in the hopes of turning up a suspect. In either case, the original argument is just wrong.

Surprise! Plans for a Brexit version of the EU's Galileo have been delayed

Re: Good

I believe the original proposal was for a global system, and it would probably make sense. If anyone's going to be using it, the British military would probably be one of those. so they'd want access wherever there are large military bases, including the U.K. itself, the Indian Ocean (Diego Garcia), and if small bases are added in, the western and southern Atlantic as well. They would probably also want coverage in places they might be expecting to have to fight, such as south and west Asia. That will require much more than one regional setup, and while you could provide coverage in all those areas without a full global system, it would still cost almost as much.

Re: Good

That's technically true, but it's worth keeping in mind two points:

The U.S. doesn't get to decide who they break. Their options are that everyone can use it, only the U.S. military and people they've given the keys to can use it, or nobody can use it. If they decide to mess up the civilian tech, they will mess up plenty of things, including things in the U.S. that rely on it. They can't give the keys to domestic users easily because typical hardware doesn't support them and those keys would inevitably get leaked. That makes it somewhat implausible that they'd choose to do so.

A lot of hardware capable of using GPS can also be used for reception of signals from one or more of the other systems. All of those systems also provide time signals. Therefore, one could ensure that the hardware running these time-sensitive systems supports multiple satellites, and if the U.S. ever goes crazy and destroys theirs, just fall back to Russia's, China's, or the EU's.

Unless we get into a situation where a country decides to invest in massive jamming operations (in which case a dedicated system won't help) or where the U.S., Russia, China, and the EU are all allied against whatever country we're in (in which case I'm leaving immediately), we'll continue to have a usable time signal.

Re: Good

Japan's QZSS is not a global navigation system. It serves eastern Asia and the northern Pacific only. India's serves south Asia and the northern Indian Ocean. Japan is planning to extend their system in the future, but they haven't done so yet.

The only currently-existing global satellite navigation systems are those run by the U.S., Russia, China, and the EU. It's not impossible for some other country to set up their own, but it is expensive. This will undoubtedly lead to many questions about whether it is helpful and worth the price.

Raspberry Pi goes 2GB for the price of 1GB in honour of mini-computer's eighth birthday

Re: Better options

Let's compare your thing with the pi, and see what else we have to buy to make them somewhat equivalent. We're assuming here that what you want to do with it is to use it as a desktop--if you want to have it integrated into another project, the pi's GPIOs, CSI and DSI interfaces, etc. will make it the better option. But desktop only:

Your thing has an internal drive. The pi doesn't. Add a 64 GB SD card to our shopping list.

Your thing has a power supply provided. The pi doesn't. You probably already have a supply, but they did just make the switch to USB-C so you might not. Add one of those to our shopping list.

Your thing has two USB ports. The pi has four. Add a hub to your shopping list. Yes, since you accused the pi of needing one, I'm going to add this. You can do just fine with four ports, but two is harder.

You want to use two video outputs? Fine. Both can do it. The pi needs a relatively uncommon micro-HDMI connector, so let's add two cables connecting that to regular HDMI. And to your list we'll add a VGA to something modern adapter and we'll assume you already have a normal HDMI cable.

And ... that's it. They are now equivalent. There may be small differences in processing speed, but it's hard to know without having benchmark numbers for both, and I haven't found a place that benchmarked both of them.

So let's add up the prices. The pi with 4 GB of memory is £44. An SD card is about £8. The HDMI cables can be found for £2 each. The foundation's supply costs £8, but you could find a cheaper one. Total price:: £64. If you want a nice plastic box, we can make that £70. If you want a nice metal box, £76.

Your thing costs £110. A USB hub is £5 or so. The VGA-to-display port adapter I found costs £6. Total price: £121.

So that's why.

Drones must be constantly connected to the internet to give Feds real-time location data – new US govt proposal

Re: LTE Data Plans

"You can buy a 10MB data plan for only $5/month which should be more than enough for GPS data polled every five seconds."

Let's assume that the data is neatly compartmentalized and compressed so that it can fit into a single 512-byte UDP packet, and that there will be a 128-byte response packet to indicate that the data has been received. If you think the protocol would end up being this light, you are quite the optimist, but let's go with it.

(512 bytes + 128 bytes)/ 5 seconds * 1 minute / 60 seconds = 7680 bytes / minute of flight time

10 megabytes * 1024 kilobytes / 1 megabyte * 1024 bytes / 1 kilobyte = 10485760 bytes per month

10485760 bytes / 1 month / (7680 bytes / 1 minute) = 1365.333 minutes of flight time (maximum) per month

In other words, a maximum flight time per month of about twenty two hours. Sure, the very casual hobbyist might not be up for longer than that. If someone's using their drone for aerial photography, data collection, or simply really likes the hobby, they won't be happy with that limitation. And this limit only applies if no data is sent, at all, other than the GPS check-in. And it relies on the provider using binary megabytes rather than decimal ones. And still costs $60 per year per drone.

In addition, this fails to solve any of the other problems noted in the article, such as requiring decommissioning or costly retrofitting of all the drones in existence today and the problems making this requirement work where cellular coverage is less than perfect.

Vivo's APEX 2020 concept smartphone grabs life by the gimbals to shoot stable snaps

whether it holds up to the typical 24-month phone lifespan

I think you'll find that phones are typically expected to live much longer than that. I'm not just talking about we tech people who expect everything to last for decades and get grumpy when it doesn't. Check with your friends and family and see how old their devices are. I'm guessing you'll find quite a few ones older than three years. Sure, some have new devices, but this is usually because the one they had before it really got too old or, more likely, got broken. When smartphones were newer, the new device would well outstrip the two-year-old device, making people want to buy the newer one to use its new features. Now that this is no longer the case, fewer people have the desire to buy each new product, and while some still do, the average consumer doesn't.

Microsoft's Windows OEM, Surface sales looking a bit peaky as coronavirus takes toll on China supply chain

Overeagerness to predict things

"Antonio Wang, associate vice president at IDC China, said there would be "a positive side" as Chinese consumers become aware of the importance of access to internet information as a result of the outbreak."

That's a rather strange prediction. I'm assuming that it's referring to the widespread and severe censorship of many topics around the virus and its handling, and the prediction is that people will be annoyed with this and ... I actually don't know what they're predicted to do. If the prediction is that people will protest against censorship, don't count on it; Chinese citizens are well aware of the censorship, don't like it, and are aware that open revolt doesn't end well. If it's people taking other measures to evade the censorship, that might happen, but doesn't seem relevant to the prediction quoted above. I really don't know where that prediction came from, but I'm expecting that whatever it is predicting won't happen.

Wi-Fi of more than a billion PCs, phones, gadgets can be snooped on. But you're using HTTPS, SSH, VPNs... right?

Re: A lot of WiFi traffic may be local....

Well, most web traffic is HTTPS now, and most machine-to-machine protocols in heavy use are encrypted as well with SSH having replaced many more classic ones. But you're correct, a lot of traffic isn't encrypted on a LAN. For that reason, we're usually somewhat protective of who we let onto our LANs. An exploit that lets an unauthenticated user read our traffic is much worse than one that lets others on our LAN read our traffic.

Re: Unpopular opinion

As has been pointed out, that's not really at issue here. But also, it's not correct either. Of the various methods of getting attacked, MITMing is lower on the list of concerns, but it doesn't require nation-state level effort, and it doesn't have nation-state limited value. An attacker can set up a WiFi MITM device for relatively cheap. If it works for them, they can hope to grab some passwords, access tokens, or credit card numbers from you. True, at this point we've likely encrypted nearly everything that is that sensitive, but we've done this because at one point we didn't and we realized what a disaster it could be for people to pluck them out of our unencrypted network traffic. Not to mention that there are other things you can do with a functioning MITM system; I've only discussed the possibilities involved in reading network traffic, but sending some unexpected traffic to the user also offers some interesting possibilities, albeit at a higher risk to the attacker.

Your phone wakes up. Its assistant starts reading out your text messages. To everyone around. You panic. How? Ultrasonic waves

Mitigation options

"The best way to defend yourself from these attacks is to turn off voice commands, or only allow assistants to work when a handheld is unlocked."

Another good way that still allows use of voice commands is to disable the vocal trigger to start the assistant. The user can still use commands, but only by pressing a button on the phone to do so. If they have a complex unlocking system and allow a few commands to run without unlocking, this allows them to do that as well. It does prevent using the device when the device isn't near you, but when comparing it to disabling the feature entirely, it will have less effect on a user who uses the commands.

As attacks go, it's interesting but not the most frightening. It requires a lot of attacker investment and physical proximity. If they do it and I am there, I will likely hear my phone as it reads my new messages aloud and so I'll interrupt it and possibly look for a cause. If they're banking on my not being there so I don't notice the information being read out, they could have someone run in and grab my phone, which would be faster and require less investment on their part.

It's Terpin time: Bloke who was SIM jacked twice by Bitcoin thieves gets green light to sue telco for millions

Re: Weakest link security

If it's stored in your head, you stand a good chance of forgetting it. If that means you lose your money, you probably decide not to store it only in your head. If there's a method of resetting a forgotten password, that method can then be attacked. The same provisos hold for all the typical methods of storing sensitive information--the better they are at making sure other people can't get in, the more complex or difficult they are to use. Eventually, you reach a point where what you're really doing is making it hard for yourself to get in without doing much to an attacker. This is why 2FA is so important--if for any reason one method becomes compromised, the attackers still can't get in for the time being. The story here is about the failure of 2FA to have two factors that work well enough. That can of course be argued, but "memorize a long password and why not the private key while you're at it" isn't going to solve anything.

Apple tries to have VirnetX VPN patent ruling overturned again, US Supremes say no... again

Re: What??!!

I will have to read the patent, because if it's just NAT circumvention, that isn't original enough. The IETF was working on that quite a while ago and has continued past that RFC several times. Nor would pier-to-pier video communication be a valid patent as that's been done for a while as well. If it's been upheld this many times, it must be about something more specific than that.

Xiaomi in the UK: Multi-eyed Mi Note 10 hits Blighty festooned with cameras and hefty battery life

Almost certainly, as they make money off the advertising and preinstalled apps to help deal with the low purchase prices they often charge. Xiaomi devices are more likely to be supported by Lineage OS and other alternatives though, which has been a major point in Xiaomi's favor when I consider what device to buy.

Huawei claims its Google Play replacement is in 'top 3' app stores after Trump turns off tap to the Chocolate Factory

"Outside the Great Firewall, you don't need an app store, given that you only have to log in, or sometimes even simply go to, one of those sites through a mobile browser when you haven't got the app installed, and you get bombarded nagged to death forced suggested that their spyware feature-laden app can be downloaded straight from the site at the click of just One Button."

Almost always, this is a link to the Play store entry with a bunch of pop-ups around it. It doesn't help if the user is trying to download the app without Google Play. Of course, if the user wants to find an APK, there are a few sites willing to offer it. As long as you find the one that hasn't added some malware, that will work fine. Unless the app concerned also needs Google Play Services, in which case you will have to find clean versions of those.

This is why it will be difficult for their international business. We can do all of that, but the general user won't (or, if they're in your family, they'll ask you to). This means that the general public who buys a Huawei device without Google's insertions will end up in this situation, and they may mention this to others considering making that purchase. Only time will tell if enough notice for this to be problematic for Huawei.

Get in the C: Raspberry Pi 4 can handle a wider range of USB adapters thanks to revised design's silent arrival

Re: Forget the 'Osborne Effect':focus on the "Upton Effect".

These complaints are rather tenuous. The USB-C thing was a design flaw, and they should have caught it. It was not very impressive when they didn't. But it was a nondestructive design flaw that could be worked around, and they fixed it.

They have a reason for not making the OS a 64-bit one, namely they still make older pis, including the zero, which have 32-bit processors and they want it to be easy for the new customer who is probably a schoolchild to flash an OS to the pi without worrying about versions. You can dislike this reason, but it's logical from their viewpoint and they've been consistent about it. A 64-bit OS is possible from others, just not from them for the time being.

That said, it is absolutely not the case that the pi is "in its infancy". It's been around for over eight years, and we're on our sixth model (and that's not counting any of the non-B models). Even in human lifetimes, that's childhood not infancy, and as computer product lines go, that's between young adulthood and middle age. The fact that the pi is not in its infancy is one of the major reasons it is such a good product; one of the main problems with competitor products is the lack of the type of support the pi community has. Therefore, it's not fair to defend problems that are problems by claiming the product or the designers to be new at this. They're not.

Re: Power to the Pi-ple

I'll admit I was thinking about the older micro USB connector, which is rather easy to find. I don't have many USB-C cables, but I expect that's because all my portable hardware is older. As the standards change, I'll probably start to gather some USB-C cables. In terms of providing the high amounts of power the pi needs, that is becoming a greater issue but doesn't really change the availability of power adapters. If I have to find a USB supply with sufficient amperage, I probably can in a local area in an hour if I don't have one on me. If I have to find a specific barrel adapter, I'm not so confident. I don't yet have a version 4 board, so all of mine are using the older connector, and those adapters are available nearly everywhere. It's also the case that those older pis do not require as much power and can therefore run from most USB wall PSUs.

Re: Power to the Pi-ple

I see your reasoning, but I would prefer them not to change the power port because my use case is quite different from yours. I like to power these in many locations and from many sources, and a USB cable is often easier to find than an arbitrary barrel adapter, let alone having to set up my own power supply each time. It also makes it very easy to power them from USB batteries. Although the pi is useful in many engineering setups, it was designed for classroom and hobbyist use, and the hardware demonstrates this in many places. For me, that's more convenient, though that's not for everyone.

Re: Recall a $40 device to re work it?!

No, no, no. USB-C doesn't mean "PD", but it does mean "compliant with USB-C spec". USB-C spec says that, if you connect a PD-capable adapter to a non-PD capable device, the device requests a certain amount of current through various mechanisms and the adapter provides that current at 5 V if possible. The pi misidentified itself, and thus didn't get its current. The adapters did what they were supposed to do.

Consider what you would think if the problem went the other way. If you had an adapter for USB-C PD which was expecting to deliver about 60 W, and didn't rigorously follow the spec. You plug in a pi, and the adapter sees it and starts firing 20 V PD at it. That would fry the pi, and it might even be a fire risk. You wouldn't be happy at all. This issue was less destructive, and has now been resolved, but it was a problem.

Breaking bad... browser use: New Mexico accuses Google of illegally slurping kids' private data via G Suite

Re: Acedemic?

That's all true, but somehow we have to indicate this to the students. When you're young and don't know how all the tracking and data collection work, you probably assume that you're safer than you really are. And, as a student, you probably don't have a large supply of alternative machines to use for anything private. This might be changing due to increased smartphone use, but they probably don't have their own computers, and home computers for the whole family's use are less prevalent now that laptops are more popular. The first problem we can help fix by increasing education about the dangers of online data collection, while the second one is trickier but we could still help by showing them how to use trustworthy software and maintain good security behavior.

"As a School admin using Microsoft and Google clouds, I've at least been informed by Google we need parental consent, else T's&C's say we block the rest or breach contract."

That may not be as positive as it seems. That sounds like a minor legal measure that ensures that Google can blame you, the parents, or the children if ever something goes wrong because they got some forms. While it ensures that the parents have a chance to see what will be happening, it doesn't provide them or you with extra opportunities to do anything about it, and a privacy-conscious parent will probably instruct their children on how to use normal, privacy-respecting replacements for these Google services anyway, meaning that those who are most at risk get little or no protection from showing them some legal text.

London's Metropolitan Police flip the switch: Smile, fellow citizens... you're undergoing Live Facial Recognition

I think we would know about that, but fine, let's assume it's comparable. So what? Looking for someone specific and getting it wrong is a lot different from looking at everyone just in case and arresting a big chunk of them. One is not speaking well of the police's competence; the other is a violation of various rights. Oh, and the other one also means that all the police's time is spent tracking down people who the cameras get confused by, meaning they are less useful at preventing crime or catching criminals.

When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops

Re: Paranoia mode on

It's true that the best-case scenario is not to get caught, but in the case that you know or have a strong suspicion that you will get caught, it's helpful* not to let the victim know what you were doing. Consider the situation where you break in to a place to still data by copying disks and you find out that they have a silent alarm and you've set it off. You can run out with the data you have, running the risk that they figure out that's why you were there, or you can steal a couple of harmless encrypted laptops, hopefully convincing them that you were a street thief looking for something expensive. Spies who don't manage to always stay in the shadows find ways to pretend not to be doing what they are in fact doing.

*The above comment is written from the point of view of an attacker. I am not an attacker. Don't be an attacker, or we won't like you.

Paranoia mode on

"It appears the spear-phisher was more interested in holding files to ransom than specifically disrupting plant systems. Still, as a result of the infection, the plant had to be shut down as the monitoring systems were cleaned up."

Let's say I'm a person who wants to be able to control a natural gas plant. Maybe I want the ability to turn it off. Maybe I'd even like to blow it up. Unfortunately, I don't know how to bypass their security. Therefore, I spearphish their IT people to get access to their systems, hoping to find technical documents and information about security procedures. I do, but while I'm in, I also find that their operations network is linked. Hurrah! Well, onto those machines I go, looking for even more information. How do I access the controls? What could I set them to to cause the most havoc? Maybe I can find some manuals and procedure documents used by the operators.

Well, now that I have everything I need, there are just two problems. Problem one: I don't want to cause damage to the system now. Maybe I want to have this ready if ever my country of employment wants it, or maybe I want to make sure this will work on other plants before I make my move. Problem two: I am not impressed with their security right now, but there's no telling what they might have that I've never thought of. If they find that I've been here, there will be all sorts of warnings and I might even get tracked down. What's the solution? I infect all the systems with ransomware. All the evidence of my activities has just been obliterated in an avalanche of encryption. And at the cost of revealing my successful phish rather than hoping that nobody notices, I remove most suspicion about why I was here. I now have quite a nice vulnerability database in the bank, and if I don't have a discovered or installed back door, I at least have information about what I'd need to get in again to use the stuff I've found.

I really hope that's wrong. Now, if you'll excuse me, I need to reset my paranoia circuit breaker again.

Now Internet Society told to halt controversial .org sale… by its own advisory council: 'You misread the community mindset around dot-org'

Re: poison pill time?

That's not sufficient. That would prevent the scenario you've discussed, but they have another option, which already seems more likely to me. That is to buy it and start a massive price increase program until they finally do manage to drive all the customers away. That'll take a while since it's such a popular domain, so it will probably make them quite a tidy profit. Meanwhile, at least a couple million places, many of them individuals or charitable organizations, get hurt. It's not enough that they must keep it intact. If you want a reliable poison pill, make it a requirement that the prices not change for twenty years, and is limited to some low value after that point. If you do that, I guarantee they won't be buying.

Re: The bloody obvious

Do you really not get it? I'll walk you through it. Take the last thing you said it couldn't be. I'll paste it here for you:

"it isn't the organizations registering their .org names (they still get their registrations at a competitive price)"

See that parenthesized claim? Why do you assume that? Why do you assume that the price won't change? Why do you assume that the competition exists? Because the competition doesn't exist for everyone who already has a .org, as they will have to either pay whatever price is quoted or go through the turmoil of switching domains. That involves moving systems around, reconfiguring mail and other communications, ensuring that all their customers, clients, or visitors know this is happening, and worrying about someone else grabbing the .org they just abandoned. They have to worry about that because, in the absolute best case scenario, that person will make it even more expensive if they should ever want to get it back. In the scenarios that will actually happen, people will grab the .org to impersonate them, either riding off the goodwill they have generated (and eroding it for the place that still exists) or stealing information, money, or credentials from their former customers, clients, or visitors. So we've proven that there isn't much competition.

Now, you already know that ICANN has removed restrictions on how much .org domains can cost. Technically, there's a possibility that a for-profit entity with lots of debts to pay down will buy up the domain that is a nearly perfect monopoly property and then keep the prices the same. Just like it's technically possible that I'm a master of magic, have snuck into your house, and slipped some money into your pocket without you noticing me. Go and check if I've done that.

Re: "this board already works in a very transparent way”

"Why are people talking about the ICANN Board when the topic in the story is the ISOC Board?"

It's this little thing called comparison. People are alleging that ISOC's board is acting corruptly or at least self-servingly, and they compare this to actions performed by ICANN's board which they allege to be similarly corrupt or self-serving. They state this comparison outright. As comparisons go, this one is somewhat apt, as the current .org sale has been dramatically affected by decisions made by both boards.

"They [ISOC] met daily (by teleconf) for two weeks to discuss a proposed $1.3B deal. It would have been incredibly sloppy not to take it that seriously."

Sure. You are alleging that this statement contradicts or explains part of the quote you were responding to? I don't get it. The closest thing I can think of is that the quote says that ISOC "claimed to have met" and you're stating that they definitely did meet. But if that's your point, you are missing the important part of the sentence where it is alleged that the members and chapters were not brought into the discussions, I.E. that ISOC claimed the reason for meeting was to discuss the deal, but they had already made their decision and didn't allow any other parties to interfere. The quote you responded to clearly indicated that more discussion with more people should have happened, and your reply seems to be attacking the idea that no discussion was needed.

"And it was kept secret because the buyers insisted, which is hardly unusual for a deal of that size; anything else would have been remarkable. And the Board decided, because such a matter is evidently a Board decision."

No, it's not remarkable for a large deal to have some public scrutiny. I'll concede that a lot of high-value deals are kept undisclosed, but not all of them. Not to mention that, when an organization has a lot of subunits like chapters and an ostensible public service purpose, there's often a culture of more openness, both in information and governance. That's not required, and ISOC either doesn't have it or decided to abandon it, but stop trying to make that out to be standard procedure when it's simply one option among many.

Glue's clues: Samsung Galaxy Z Flip dissection reveals a pholdable mired in adhesive

Re: I've said it before...

And here I am to suggest yet another possibility: the functionality that comes with convenient personal internet access and the ability to write apps to make use of it. The old PDAs might have a phone connection in them, but it wouldn't be a data one. Then, there was enough data to receive and even send email, as long as you were a business and could afford the plan, but the typical consumer was still stuck on voice and text only. The smartphone also ushered in the revolutions of 3G and apps that expected to have it. True, it wasn't there on the early models, but adoption of those was primarily a small group that could afford the expensive hardware and still not cheap data plans. By the time the general consumer had a smartphone, they also had a data plan and a couple apps they used when away from home.