Posts by doublelayer

Lovely website you got there. Would be a shame if we, er, someone were to sink it: Google warns EU link tax will magnify media monetary misery

Re: I'm perfectly fine with minimal text and no images

You can use it fine with no images, sure, but minimal text? Usually, the main thing that helps me to decide whether the search worked is to read the summary text where my terms appeared. I can filter whether results are useful or just happen to mention my search term much more effectively with that than I can with the page title. I can also use that to identify pages that I've already effectively read, if the term was quoted in multiple places.

I also think it should not be possible to charge for linking to a page. That is antithetical to much of the web, and should remain so. I'm directing traffic to someone. If they want to make money on that, they should view me as a positive, whether I'm making money myself or simply thought they were a useful resource. I shouldn't have to pay for the privilege of telling someone they might find something else useful. I don't pay the newspapers if I suggest that someone goes and gets one to read a great article.

It's 2019, and a PNG file can pwn your Android smartphone or tablet: Patch me if you can

Re: Great

"Why did you buy a 3rd party phone if you care so much? Only an idiot would do such a thing."

Thanks for the compliment.

"1st party phone is a Google pixel"

That involves paying google a bunch of money, buying a hideously overpriced device, getting the wonderful extra google spyware unless I flash it, in which case there is no support... No thanks.

"2nd party phone is a network SIM free phone"

Sure, that is always nice to have. Some networks will make it a terrible pain to get one of those onto their network in the first place. Or maybe the person concerned got the phone from someone else, either an employer, as a gift, or from a previous owner.

"There is clearly nothing wrong with Android if some models get these patches every month, and many do."

Your logic says that there is nothing wrong with [x] if some examples of items in category [x] get good condition [y], with the clear indication that the remaining members don't get good condition [y]? So, in that case, you'd wholeheartedly agree with these statements, then:

1. There is nothing wrong with your car because some of those cars work perfectly well. The fact that it crashed yesterday, injuring the driver because the airbag didn't function properly and putting that pedestrian in the hospital because the brake pedal did not, if you want to be inordinately technical, activate the brakes, was clearly not anyone's fault, or if it was it was your fault.

2. There is nothing wrong with the lunch you had today because some people ate it and survived. The fact that yours, personally, was a little bit contaminated with antibiotic resistant bacteria and so were those of a number of others was clearly a fluke.

3. There is nothing wrong with floors because you can see many people walking on them and being supported just fine. Therefore, you are happy that you are falling through a hole in the floor because there is no problem with the floor over there where you are not right now.

4. There is no problem with Samsung Galaxy note 7s because there were one or two that never exploded. Many others did, resulting in a bit of flames and some injuries, but some didn't, so clearly it was fine.

A little tip, for there to be absolutely no problems with something means that all things in that category must work. That's why nothing is free of problems. Android is not even mostly free of problems.

Re: Oh well

And, unfortunately, devices running on old security updates are very common. Again with the anecdotes, but a friend of mine has two tablets that she uses very frequently, both of which are still on version 4.3*. My only hope is that they are too old to run the newest malware. She is, at least, a sharp person who will probably spot most scams, but it is still unpleasant to think of those things online in 2019.

*Neither received a single update of any kind.

Apple puts bullet through 'Do Not Track', FaceTime snooping bug and iOS vulnerabilities

The only site I've seen that does respect it is, in fact, adafruit. Nowhere else has ever warned me about this tracking, and of course many sites are known to completely ignore it. So you can pretty much assume the answer to what sites don't respect DNT is (*.* - *.adafruit.com). You will unfortunately have to be more active than that to stop tracking, and I'm glad that someone is killing the thing because checking that box probably provided some with a false sense of security about the whole business.

Almost £5k for a deskslab: Microsoft's Surface Studio 2 hits UK

Re: And we thought that Apple stuff was expensive tat

It doesn't compare well in price to Apple's iMac 5k; that starts lower in specs but also much lower in price. Then again, I suppose there must be people who want a 28 inch touchscreen for some reason, and Apple doesn't have that. I'm sure people have a reason. I don't know what it is, but it will come to me, maybe.

In the general scheme of things, both of these machines are much more expensive than will be needed by pretty much everybody. They price themselves out of consumer range, don't include enough processing power to run all the games that serious gamers want to play, and are too screen focused for the massive data processing people. I can see something like this being used by serious graphics users, but that's not a big market, and plenty of them have been satisfied with less.

Website programming? Pffft, so 2011. Python's main squeeze is now data science, apparently

Re: Re Good job Python isn't a syntax Nazi.

I agree, but sometimes you don't have that authority. I recently had to work with code where the writer (I don't know what is wrong with them, but something clearly is) had mixed tabs and spaces with *every* number of indenting spaces from 1 to 17 and several lines indented at random numbers above 17. This was C code, and the indentation didn't match up all that well with the brackets. Thankfully, this code was put under my branch, so I was able to thoroughly reindent the thing. However, I wouldn't mind something external preventing them from doing that to the code in the first place.

Crypto exchange in court: It owes $190m to netizens after founder 'dies without telling anyone vault passwords'

Re: Crypto-busting test case

"If an encrypted computer (I'm going to assume that means "encrypted data on the hard drive" in this case) is a ["]problem with a solution["][my statement], what is the point of encrypting any computer...?"

The point is to prevent data being stolen with a machine. If you were to rob me in the street today, you'd get my computer, but not the data on it. You could try some passwords, but it wouldn't get you in, and the security of my data would be intact. That's because it's not worth a ton of money to you. $190 million in bitcoin, on the contrary, is worth quite a bit to people, including to the people who run this company who could face some negligence cases if they don't get access to the thing. That makes it possible to invest some more resources into brute forcing passwords. For example, if the encryption is done using bitlocker on Windows, the passwords aren't super-secure*. It would be possible to brute force the possibilities of the default code if you had the inclination. For $190 million, the inclination is there more than for the random files I happen to have, and it is thus more likely to be attempted by this company than it is by a street thief who already has the main source of value, the hardware of my laptop.

*The default password for bitlocker is a 6-digit numeric pin. This machine could use a different system and/or a more secure password. This system could in fact not be encrypted at all. However, automatically typing in all combinations of digits is doable if you are willing to spend a couple of weeks on it, and other methods of trying to crack the password are doable too.

Re: Crypto-busting test case

From the sound of it, the people attempting to regain access aren't that good at it. I don't know the details, but it sounds as if they think they have access to a computer with the data on it. I'm assuming the computer is encrypted, but even so, that is a problem with a solution. They were also the people who let a store of value be set up in such a way that only one person could access it, which doesn't say much for their common sense.

Re: Bullshit

On the topic of faking one's death, if this happened, he could probably transfer the funds out somewhat easily by sending them to an exchange and getting a different currency. He'd lose a bunch of it, but you can lose a lot of $137 million and still be fine. In the meantime, while someone could detect that the money was taken, they wouldn't know how to find the thief.

Two things don't make sense here:

1. That the company would be so large and store all the passwords and other critical data in one brain and one computer.

2. That the company would put all the cold storage cryptocurrency in one wallet. That's just asking for someone to get in and take it. If you store a medium amount in each of four hundred wallets, an intrusion can be detected before you lose too much.

I would expect any crypto company to do both of these things. The fact that they have not makes them incompetent, whether these actions were done out of negligence or malice (I think it more likely to be the former).

I won't bother hunting and reporting more Sony zero-days, because all I'd get is a lousy t-shirt

Re: This is really tight

There could be a lot of benefits in having publicity. Don't publicize the errors much, just say that they were fixed, and the person reporting them got $large_amount_of_money from you. That attracts others to try to find vulnerabilities in your system so they can get $large_amount_of_money too. Not that you always pay them a large amount--that depends on the scale of the bugs they found for you--but if the bugs were indeed critical, they deserve it and you can use it.

Re: A little shortsighted

A completely accurate analogy is hard, but it is something like if a mechanic approached me and informed me that my car had a serious fault with it, and explaining why. Depending on the details, I might not care that much or I might be very interested in the risks. In the latter case, I'd be grateful that I was able to avoid the negatives and I would offer said mechanic some recompense for the useful service they provided. In the other case, I'd not do very much. However, it sounds as if the bugs found were considered very important, so a shirt, which is the equivalent of a thanks from me, seems less than justified..

Really? A shirt?

Here's a question for you. Have you ever been excited or even generally pleased about a free shirt from a company or event? For me, they've ranged from "Well, now I have another shirt" down to "Well, now I have another thing to wear if I decide to paint". That's without considering the possibility that I might not want someone else's logo displayed on my person. Of the many really cheap things you can make a bunch of and give to people, most are more generally useful.

Oh, and the bug finders don't need more shirts, people. I thought you could figure that one out. They've saved you the time and money it would cost to find the bug yourself or to deal with whatever problem would occur if someone else found it and sold it on the dark web. Show them some respect by giving them a small amount of that.

Boffin suggests Trappist monk approach for Spectre-Meltdown-grade processor flaws, other security holes: Don't say anything public – zip it

Re: An open letter

I'm aware of that, and perhaps my joke is not the style of rebuttal you would submit to the professor personally. That doesn't change the fact that he is wrong. It doesn't change all of the reports made to all of the companies that never did anything (for an example, see the tracking watches that have been known to be insecure for a year but are still insecure, about which multiple articles have been posted here in the past week). He seems to think that negligence doesn't exist. Either the company fixes their thing or they calculate that it is not important enough and are fixing something more important. That's not true; companies sometimes choose not to fix anything because they are spending all their time on the next product. That is a problem, it happens too often, and something needs to be done about it. Disclosure is a way to get something done, and if this professor refuses to acknowledge that the problem exists, he can't help to fix it. So I would argue that my comments, informal and inappropriate in tone as they would be if I submitted it as an official rebuttal, are still accurate.

An open letter

I'd like to write an open letter to people who think this professor's approach is the right one.

Dear members of the computing community:

You're wrong. No, really. Completely wrong. I don't know what leap of logic you took, but while there might have been logic when you went up, there is none where you came down. You clearly need to be let in on a few facts of how security vulnerabilities work.

When a researcher finds a vulnerability, they identify it with enough precision, and report it. They could release it publicly, but few do. Usually only if it's a thing that will never be fixed. But they usually don't both because it's a bad idea and because they might get paid for their hard work. So they report it to a company, who hopefully does its homework and figures out how bad a problem this is and how they're going to fix it.

You see that "hopefully"? That's because some times they DON'T. They leave their product vulnerable, keeping the customers at risk, completely ignoring the researcher, and making a mockery of security. And that, my friends in the audience, is not a very nice thing. So sometimes, a bug has to be disclosed so the company will get up and actually do something, or at least they can be held responsible for their negligence. Do you know the word negligence? Do you know that it happens sometimes?

Now, let us surmise that a company has proceeded with our hopefully and fixed their bug. Yay, the patch is released. The vulnerability is gone. Yeah... Do you remember that whole wannacry thing? It was kind of a big deal back in May of 2017, when a lot of things suddenly started breaking? That bug was patched in March, and a lot of people didn't have it. Maybe that is because a lot of people are lazy and incompetent. Actually it definitely was. But another set were unaware how critical the patch was. That's what publicity does. It informs the IT literate that they need to get fixing, and it alerts those who are not IT literate to find someone who is IT literate to fix their stuff because it can be broken. This, in turn, results in less broken stuff.

You can disclose improperly or in a counterproductive way. No contest. So what? You can also drive in an improper way, too, but we don't ban driving because we're better off being able to get places quickly. Having something that can be done improperly isn't fixed by never doing that thing again. It is fixed by finding the ways to do it improperly, and not doing those. If it's critical enough, it's done by putting incentives in place not to do it improperly.

Welcome back to logic. Let me help you up. Now, if you'd like to start researching again, that's fine, but maybe run your output past us next time. After all, you seem to have been doing it improperly, and we don't want anyone hearing about it and deciding there will be no more research.

Sysadmin's three-line 'annoyance-buster' busts painstakingly crafted, crucial policy

Re: Putting dates in names

Perhaps I should clarify my statement. Neither mv nor cp complain about copying a file over another one *by default*, which is how everyone runs them. Since these tools don't do a lot of, to me, more obvious things without my having to tell them with switches, I would think that -i should be on by default. So much did I think this that I assumed that it was.

Re: Putting dates in names

No, don't put dates in names. That just makes the names harder to understand. If the files are called "system_restart" and "system_test_dr_capability", they are less likely to be run by accident than if they're called "20170204_ada_lovelace_at_company_dot_com_fixes20160419_system_test_dr_capability".

The latter approach not only makes long names that are hard to remember, but it can also result in multiple versions of the file that may or may not do the same thing.

Put instructions at the top of any file that can handle them, and of course test before you push things into production. Also, if you can, don't use a system that cheerfully replaces one config with another config without asking; if they had gotten a single confirmation box or terminal warning*, this would have been detected before it caused a problem.

*As it turns out, neither mv nor cp complains about copying a file over another one. I thought they did. Time to become more nervous.

Re: Behind a locked door...

You don't even have to introduce a negative. Make the documentation very verbose, include something in it approximately 68% of the way through, and watch people lose their mind when they try to find it. Otherwise known as the irritating API reference technique, where you know there should be a function that does what you want, and it's in this category, but this category includes thirty APIs, each of which implement 60 functions. And the search box only searches API names, but not functions. They're watching me to see how long I search, aren't they?

Windows Defender update: So secure, it wouldn't let Secure-Boot Windows PCs, er, boot

What are the symptoms

What exactly happens when the machines don't boot? Usually, the machine has to do something to indicate the reason it isn't doing anything. The reason I ask is that a machine over here recently installed an update, though we don't know which update, and refuses to work normally; it boots to windows in a way but sits on a page showing only the time and date, refuses to show the login screen, and ignores input. This could be described as not booting into windows. If people here have experienced this bug, is this how it manifests? An internet search suggests that a bug like the one we're seeing has been around for a while, but I don't know exactly what this machine got hit with as no others are doing this.

Bug-hunter faces jail for vulnerability reports, DuckDuckPwn (almost), family spied on via Nest gizmo, and more

Re: SS7 hacked?

"One suspects that it's [phone hacking] easier and more lucrative now that everyone and everything is cloudy."

Easier, maybe. More lucrative, no. In general, all the things that used to be expensive are cheap now. People don't need to hack for cheap calls over long distances, because that is included. The only types of attack that are prevalent on the network are pretending to be someone else and intercepting others' messages. Given how little attention is paid to all those scammers spoofing caller ID, it is clear that the only type of hacking that is getting dealt with is message interception, which isn't that big. The attackers have to use this in combination with other things, usually social engineering, so most try the easier method of social engineering everything from the victim, rather than social engineering some things and accessing the phone system for the rest.

Want a bit of privacy? Got a USB stick? Welcome to TAILS 3.12

Re: An ARM version might be more useful...

Maybe, but you would need to connect it to an HDMI screen and USB input devices. That doesn't make it less disposable because you could keep those parts even if you were paranoid enough to destroy the pi (you don't need to), but it would be clunky. Unfortunately, there isn't a convenient system for using a pi portably. As much as I like it, battery performance isn't great and there isn't much hardware that can be carried without trailing wires behind you. For portable usage, the easiest solution is probably still the old-fashioned laptop.

Re: An ARM version might be more useful...

Other than raspberry pis, what are you going to run the ARM version on? We have ARM servers (I'm pretty sure it's not those), and most other ARM devices won't boot normal Linux, let alone one built for a much different purpose. This is a desktop OS, and we don't have many ARM desktops.

Apple yoinks enterprise certs from Facebook, Google, killing internal apps, to show its power

Re: "but it also treats mobile users like adults capable of making their own decisions"

You want more selfishness? Fine. I don't want people to give up all their information because it gives companies that seek to violate my privacy more ammunition with which to attack me. Either they will have better systems for gathering and using information I don't want them to have, or they'll have collected a bunch of my information from other people I've met. Does that logic work for you?

On the topic of saving people from themselves, that doesn't need to apply to everyone. I think most would agree it applies to children. Adults can walk into dangerous situations if they want, but if I see a child doing that, I'm going to stop them and explain why that is a bad idea unless someone else is already doing so, even if they're not my child. The app concerned here targeted older children, giving them a relatively substantial amount of money for a person in middle school while taking a bunch of information, probably without explaining exactly what information and what they were going to do with it. Am I allowed to save them from themselves?

Techie finds himself telling caller there is no safe depth of water for operating computers

Re: Ex designer of military kit

Disclaimer: I have never used military equipment. I'm not stating things, I am asking them.

All those requirements about what the machine must withstand make a lot of sense for why the prices are higher. However, I have a couple of questions. First, do they require that a device be capable of use in all of those situations simultaneously? For example, I would have assumed that machines intended to be installed in airplanes would be distinct from other classes of devices, as a ground or tank based machine would not need to sustain the G forces, the weird acceleration, or the recoil of firing plane-mounted guns. Second, do military computers really have the same specifications of top of the line machines? I don't know about the military models, but every time I have looked at or been requested to find computers for difficult environmental conditions, the options have been the following:

1. Machines with very old specs, usually something designed for windows XP or some old version of android.

2. Devices with somewhat modern specs, but with little access to the system. You stick with the OS installed on it and just write your application over that. This can be problematic when the device is running some restrictive OS like android (there are many of those).

3. Devices that seem to have a modern processor, but are very heavy, power intensive, and run very hot. These would often be unacceptable for military use per the specifications above because they use fans to dissipate the heat and, as far as I'm concerned, seem to be of somewhat dubious build quality.

I would assume that most military machines are running a slower system that is capable of running the program required, but does not have a ton of extra speed or graphics capability. From the original post, the machines described were sufficiently behind the machines of the time in terms of computing capability. From your experience, is most military hardware more advanced or more restrictively specced than I had assumed?

Texas lawyer suing Apple over FaceTime bug claims it was used to snoop on a meeting

Re: Can he actually provide proof that the Facetime bug actually caused him a problem?

If the bug was used, it can be proven. When the call comes in, the phone will ring normally, bringing this to the attention of the person in the meeting. The records will show if someone grouped themselves into the call. Whether you can prove harm can be tricky, but it wouldn't be hard to prove that the bug was used, and having that happen in a private deposition would probably be enough reason to say there was some negative outcome for you. If they did their research, they can probably prove fault by Apple. If they only have some evidence that someone listened in some way, they probably won't.

PSA: Disable FaceTime. Miscreants can snoop on your iPhone, Mac mic before you pick up call

Re: Bug?

Given that the phone is ringing, it's not that useful to a spy system, as you would only get thirty seconds of data before they answer or hang up on you. It is still a major problem, but it is a very small and mostly useless backdoor if you were in an actively malicious mood.

Re: Bug?

Your choices:

1. Lineage OS, uses the android stack but removes the google blobs unless you reinstall them. This generally works, but offers little Linux functionality. You must have a phone in a specific list, with only flagships from each generation and popular devices included.

2. Sailfish, which has more Linux and no android, and offers some Linux functionality but is mostly incompatible with the Linux functionality of a Linux desktop. You must have a phone in a specific list, with only flagships from old generations included.

3. Ubuntu touch, which was promising until it was dropped, and is now maintained by a random group of people, meaning who knows what it will be like tomorrow. But it does do Linux, and well. For now. You must have a phone in a specific list. The list is very short. Expect installation to take forever, plus a lot of typing. Good luck.

I really wish there were better options.

Furious Apple revokes Facebook's enty app cert after Zuck's crew abused it to slurp private data

Re: But but - Apple protects our privacy!

Apple didn't do this as a symbolic gesture. That app was running before the cert was revoked, and those installs have presumably all broken. There was a problem, actively existing, and Apple fixed it. In addition, they never allowed the app into the appstore, meaning they were already blocking it. Only by using this workaround and not telling Apple about it could Facebook get the app onto people's devices. When they found out that Facebook was doing that, they put a stop to it. Exactly what did Apple do wrong here?

Boffins debunk study claiming certain languages (cough, C, PHP, JS...) lead to more buggy code than others

Re: poor tools can't be blamed?....sure, sure, suurrrrre

You're allowed to complain about your tools. You're allowed to say that a tool is not fit for purpose and require a better tool to complete it. What you aren't allowed to do is *blame* them, as in "It's not my fault it fell apart immediately after you got it. You should have seen this terrible vice I had.". The tool can be worse, but that leads you to have a worse time trying to build the result, not the result simply being of less quality.

That said, there is at least some argument for poor tools if the person concerned was made to do the job using the poor tool in the same time limit needed for the good tool. However, for programming languages, it is likely not that one is better or worse, but that one is better or worse for each specific coder and their experience.

Are you a Windows 1 in 10 (1809)? Or a mighty 80 percenter (1803)?

Re: 19H1 (aka the Windows 10 April 2019 Update) is likely to hit in a matter of months..

That's the official name. Just as the 1809 update was called the October 2018 update even when it was delayed until November. I don't know who is setting the numbers or the names, nor do I know what the H is doing in that number now, but that's Microsoft's decision.

Q. What do you call an IT admin for 20-plus young children? A. A teacher

Given how many people have mobile phones, it would not be particularly difficult for a child to obtain phone numbers. They could easily get the student's number from their contacts, and with a little effort, gain access to their contacts using a number of methods. I think the risk of bullying is important, as it has proven difficult to prevent. I therefore suggest that we do our best not to make it easier.

However, let's consider some ways the access of these accounts could be abused by others who are not schoolmates. This is yet another source of data, and one that companies would not mind mining. Do we want our children to have their primary school grades analyzed or leaked? I think we can all agree the answer is no. There are many parents who obsessively check the grades of their children, but some of them* would not mind seeing the grades of other children for comparison. They could use this insecurity as an entrance. If we want to overthink this, there is probably a lot of personal information in this that could be used to socially engineer the child, too.

Children do not have much data on them. Their schoolwork can be a very personal thing. Some may divulge it to others, which is entirely their right, but others do not want their friends or anyone else to know all the details. I believe it is extremely important that it remain private to them and their parents. The worst-case scenario with a leaked phone number is irritating calls. This is certainly a thing to be avoided, but I can think of worse things that could be done with leaked educational data.

*Parents spying on students' grades: I know parents who do this, usually by "casually" asking students increasingly leading questions. It is not that many of them, but one is already too many and there is more than one.

Re: "Young students, for example, cannot be expected to remember and enter a password. "

I'm not sure that's accurate. In principle, I agree that the stereotype should die. However, let's analyze some things you claimed:

"And of course the entire computer industry and the Internet was developed by people now nearing their allotted four score and seven years."

That puts the computer industry and internet as developed by people born in 1932. Some of them, sure. Most of them, no. The people who did a lot of the modern-day internet technology were born in the 50s through the 80s. We're not including every computer science professor who wrote a lot of important texts; I'm thinking the engineers at the companies who designed the products we're currently using, from old concepts like HTML and HTTP to newer technologies like JSON. However, I also contend that this doesn't matter; if the point is that older people have had less contact with computers, citing old computer scientists is finding the exception that certainly doesn't disprove the rule.

As for when the majority of people encountered computers, I do not think we can really count the machines of the late 70s and early 80s. I don't think they count for a generational rule because they were not that commonly held by everyone. Remember that a lot of people here had them because we self-select to be more interested in computers. The population at large was not guaranteed to have a home computer in 1985. I would conservatively estimate that, if you were a child in 1990, that you would then be guaranteed to have a lot of contact with computers during your youth. We'll say that this would happen if you were younger than ten years at the time.

This puts our threshold of stereotypical computer familiarity birth year at 1980. In other words, the maximum age for such a person is 38 years. Many teachers are older than this,, as it is a job they typically hold for many years. Since we're talking about primary and secondary schools, I estimate that about a half of my teachers were above the age of 40. Nearly all the teachers were older than 40 in my primary school, though I do not know if that is a pattern.

Of course, this is a stereotype, and will not be generally correct, but I believe I've made clear that there are many people who did not have contact with computers during their youth. There is no guarantee that, even though they have undoubtedly had to use a computer at some point during these past decades, that they are literate in the technology and can successfully manage it. Look at all the people that are, according to this stereotype, supposed to know what they are doing. Many of them are not competent in using it. Unfortunately, while I have found many older people who have no difficulty with technology, I have found many more who reject it entirely or make me wish that they did.

"There is a world of difference between being able to guess the login for a child's reading record and being able to log in to a system which gives you name, address, phone numbers etc."

I beg to differ. Having an address or phone number can lead to spam, sure. Consider, however, how things would go if some students could find the grades for other students. That could be very unpleasant, and lead to torment of various types. There's reason number one not to let it happen. While we're on the topic of torment, a student with an urge to be malicious could log in as another and send in homework, either to have their victim fail or to frame them for an offense. Reason number two. An external attacker could obtain a list of students from the school (this is easy to get) and access all the accounts, either communicating with the child, sending the child elsewhere (think an XSS on the page that probably wasn't built well), or collecting information that could be used to track them. Reason number three.

Access to these systems is sensitive, and must be protected.

I helped catch Silk Road boss Ross Ulbricht: Undercover agent tells all

Re: Great Read

Not so. The way that Tor hidden services work is complex, and I suggest you read about the details and complexities of it because it is intriguing. However, since you are on the Tor network and the .onion is as well, you don't have to go to an exit node. An exit node is only needed when you want to leave Tor onto the regular web again.

As for how to purchase server space without identification, it is a bit difficult for most hosting companies, but it can be done with cryptocurrency or with cash in a paypal account. You have to go to various places to make that truly anonymous, but it works. The mechanics are left as an exercise for the reader. If you do it wrong but think you've done it right, prison time may occur.

Re: More Questions

They might have done that, but they didn't need to. They had access to his email. Presumably, somewhere in the trash folder was an email with the subject line "Your order of a [insert laptop model here] has shipped". It was a laptop, though, so they probably had enough time to look at it as long as they could keep him from pressing any keys.

Apple: You can't sue us for slowing down your iPhones because you, er, invited us into, uh, your home... we can explain

Re: Is everyone taking crazy pills?

That's not the alternative, or at least it shouldn't be the only alternative. The other option is that it works like any other electronic device; it continues to function at its speed but the battery doesn't last as long. You know, like every other phone or laptop.

I wouldn't mind it if they put in an option to underclock for increased battery life, which would be useful both as the battery became old and if there won't be convenient access to recharging for a while. However, I have to wonder what they did to their system that meant it would restart randomly rather than just deplete the battery quickly. That smacks of bad design to me, and the workaround, though perhaps not planned obsolescence, becomes a crutch for defective products. The other option is that they did have obsolescence in mind, and specifically designed it to break. I don't know which it is, but I think the former is more likely. Either way, they messed up.

Re: On the subject of slowing things down...

I would guess that Mojave has tried the APFS rewrite again for those with mechanical drives, and that yours may not have worked all that well. A reinstall might fix that. I have been holding back on the Mojave update; I have all the updates installed, but I prefer to do my massive OS updates as clean installs because I don't have a great history with in-place upgrades.

Re: "Apple had no duty to disclose the facts regarding software capability and battery capacity."

I agree with most of your points, but there is a difference between what they said, "We only warranty these batteries for a year" and what they now say that means "Your battery will only last a year, and if it lasts longer, you should be grateful." They only warranty the devices and all their components for a year because the users are likely the cause of damage after the year, and also they have found that time period to be financially useful to them. The components can and should last much longer than that. Their claim alleges a thing that is not a fact, and they are trying to use it to say that they can do anything they like that affects the hardware as long as the hardware is more than a year old.

As netizens, devs scream bloody murder over Chrome ad-block block, Googlers insist: It's not set in stone (yet)

Re: welp....

"Another - constantly berate your family and friends for how stupid they are and how little they value your time, [...] and you're there only because you cannot tolerate such worthless idiots accessing the internet without someone much more skilled there to take responsibility for watching over their actions [...] [t]hus guaranteeing you will have few people to worry about!"

Thanks for the suggestion. I think that sounds like a wonderful alternative to just not doing it and letting them decide whether they want the system.

If you think that is the attitude that we have, you are not getting the point of our posts. We are not saying that people lack the responsibility to run technology or use the internet. We are saying that some of them lack the knowledge necessary to maintain a self-run DNS server to block hosts themselves and possess other attributes that make support more difficult. Take my post, where I stated that my parents might easily manage to disable such a system in a way that would make it difficult. This is not because my parents have any specific problems. I greatly respect them, and there are many things they can do very well that I cannot do well at all. Unfortunately, Linux administration is not one of those things.

It is not because they disrespect me or my work that this would be problematic; it is because it is complex and I don't need to spend the large amount of time that I predict support will require. If I lived close to them, where I could quickly come over and repair anything, I would likely set it up if they requested. If I could be assured that there would be no hardware interference, I would also set it up. The reality, however, is that the system would probably be interfered with, and I would either have to spend a much longer time repairing it than it would take if I could do so myself, or the users would have to put up with the system being down for a longer time. That does not provide enough benefits to the user or to me as support for the system in that situation to be worthwhile.

Re: There is always the old fashioned way

You could theoretically run your own DNS system that periodically checks all the domains you don't want, and then modifies your firewall to block any address that shows up. However, the better response should they prevent normal DNS is to stop using the thing.

Re: welp....

Unfortunately, this is exactly the problem. I have such a filter on my network. I'd like to install that on my parents' network. One of the aforementioned parents actually wants that, because they do not like ads. However, I haven't done it. The reason: I do not live close to their house, so when they find a way for the system not to work, I'll have to do over-the-phone tech support to instruct a technically-unaware person how to fix an embedded Linux system. You may say that the system would be able to handle most error conditions, and on that you would be right. I don't doubt that it could probably fix itself on most unusual network activity. Unfortunately, these would be some scenarios under which it wouldn't be so capable:

1. Someone pulls the power on it, and doesn't recognize that.

2. Someone needs an SD card, and removes the one running the pi (yes, I do think someone would do that. I have a specific person in mind.)

3. Someone disconnects power at an inopportune time, and the SD card is corrupted. The other version of this is that power fails but something went wrong and the SD card was corrupted anyway.

4. Something goes wrong with their home network, and the technically unaware choose to use the reset button under the theory that that will fix their problem (they have done this before, thankfully I had a backup config for the device from when I set it up the first time).

5. They want to administer their own system, and ask me for the access. It is their network, so I'd have to give them access. I would then be kept up at night answering questions about whatever they used their access to break.

You might respond that this shouldn't stop me, because even if the device breaks, they're no worse off than they are now. Unfortunately, the history of managing those systems says otherwise. Every time something stops working, even though I didn't have anything to do with the problem or in some cases set it up, they will complain to me. These are the people who refuse to use a Linux machine, even as a backup. They may ask me to assist with a problem, but they will also take advice I give and do the things I exhorted them not to do. For example, one of them strongly dislikes Google and complains about them, yet continues to use Chrome, Google search, and gmail. You figure that out; I have told them about Firefox, duckduckgo, and for that matter ad-blocking extensions multiple times. This is a quagmire I don't need to walk into.

Data hackers are like toilet ninjas. This is not a clean crime, you know

Re: Inquiring minds want to know...

"An honest request for advice: how secure is this password? How great is the risk that I may have to spend a day changing my password on some 200 sites?"

This password is not secure. Actually, that's misleading. The password itself is probably fine, depending on length; I assume your name and date combination push the length up, and it is likely not used by others. In that, you're fine. Your problem arises because you use it on multiple sites. This is where it is bad, because it only takes one site to store it in plain text, hash it badly, or have someone persistent check a lot of combinations for them to break into all your other sites. If that happens, it is likely going to happen before you know that one of the sites lost their password database.

Some recommendations:

1. Use a password manager to not have to remember each password. Allowing that to create passwords will ensure that they are strong and unique to each site. You only have to remember the master encryption password to unlock that file. If you routinely have to log in on other devices with no access to yours or you mistrust password managers, you can go with another option, but this is really quite a good option.

2. Use your base, but include a site-specific component to your password. An important note, make this specific part difficult to identify; if it's just the name of the site, it won't stop someone for long. This isn't as secure, but it will protect you from a lot of things.

3. Periodically change the passwords. If you are going to have passwords that are insecure, make sure that they aren't valid for long. If it takes a hash cracker a few weeks to get the database and get your password from it, your password could have been changed before they can use it. Forcing password changes is usually a bad idea because it leads people to use insecure ones, but if you keep having passwords of similar security but change them often, you'll have better insulation against attack.

4. Be vigilant. Keep a list of sites where you have this insecure password system, and if you ever see that one of them is insecure or has been breached, change the passwords immediately.

Again, I'd really suggest using option 1 unless you have a specific reason you don't want to.

Plug in your iPhone, iPad, iPod, fire up the App Store: You have new Apple patches to install

Re: The Joy of updates

The major privacy things are kept. After updates, I'd recommend a trip down to privacy/location/system services, though, as sometimes they change or rename them, which can be accompanied with a turning on where you have turned it off. The one that comes to mind was their thing that is now called significant locations, but used to be called something else. I think it was around IOS 10 when that was renamed and reenabled itself. Mostly, however, apple doesn't really change that many settings as compared to android, so you're probably fine.

Fake broadband ISP support scammers accidentally cough up IP address to Deadpool in card phish gone wrong

Re: Who is to blaim for being taken by scammers?

So in any scenario where something bad happens to someone else, they did something wrong. At least, that is the case in a large majority of cases. Why did you open your door for the armed burglar? Surely you're intelligent enough to check the person at your door in some way before you open it to see them, right? Therefore, it's your fault if you get shot by a burglar. Is that the logic you're using?

Unless the victim knows the scam is coming and chooses to go through with it, which only makes sense if they are really a conspirator in the fact, they are not at fault. They could have done something better. They might be viewed as irresponsible and face consequences for it, for example not getting promoted because the company thinks they shouldn't be given any more responsibility, but it is not their fault that something negative happened to them.

Surface: Tested to withstand the NFL. Microsoft firmware updates? Not so much

Surface firmware problems

I was asked to help fix a surface pro 3 that had developed a firmware problem, in that it would not recognize the correct charge for its battery, so would not hold a charge at all despite having a relatively new battery. This had been fixed in a firmware patch that would not install because "The battery level must be above 40% and the device must be connected to power to install this update". I tried a lot of things to circle around this error, but no luck. In addition, the charging cable, which uses the same strategy as Apple's magsafe connectors so that it can come out easily if disturbed, meant that ordinary activities could pull it out and force a long recovery process. So the people who asked me to fix their surface now have a particularly weird desktop, with its magnetic power plug taped into the socket, the cable taped to the back, and the device taped to the table. The least portable device built with extreme portability as the defining goal.

Want to spin up Ubuntu VMs from Windows 10's command line, eh? We'll need to see a Multipass

Re: Webservers?

Quick answer: yes.

Long question: Why? You could run any OS with webserver in your VM solution of choice. You could exactly virtualize your server environment and share the network connection, thus having local access. If it is a server you don't mind setting up, you could also run apache and any other dependencies (definitely MySQL and PHP but a lot of other tools are supported) directly on windows. I've done it*, and setup is very fast and it works the same unless you have some specifically Linux backends.

*We needed an internal server. They put the windows image on a machine and put it somewhere I couldn't change it. What was I going to do?

Re: I love WSL, since it made scripting on Windows usable after 30 years :)

Powershell is nice and powerful, it can do a lot of the scripting things that CMD couldn't do before, but could they make the commands shorter? When I've written PS code, I've either ended up with monstrous lines of code to run a few commands or I store everything (really everything) in a bunch of confusingly-named temporary variables in the interest of readability. I know you can have long and terrible lines in shell scripts too, but they're less common in my experience.

French data watchdog dishes out largest GDPR fine yet: Google ordered to hand over €50m

re: There is no Refuse option available.

And when the site is not one that you can simply ignore? Sometimes, the site is one you are required to use. Either it is a site run by a business or governmental agency that you must use in order to fulfill some obligation, or in other cases it is the only site providing a necessary service. Other times, there are a number of alternatives, each of which has the same or similar cookie system. I have cookies autodeleted and do some other things to attempt to prevent this from being as creepy as it could be, but it isn't always possible to go elsewhere when these problems arise.

Man drives 6,000 miles to prove Uncle Sam's cellphone coverage maps are wrong – and, boy, did he manage it

Re: Why are physical checks needed?

The tests were done in Vermont, which couldn't be measured fully because a lot of the areas are remote and rural. If congestion was the cause of these subpar measurements, the mobile companies do not know how to deal with congestion. These aren't metropolises we're looking at; the largest city in Vermont is Burlington with ~42000 people in it, and that is the largest city by 250%. Also, a challenge can't be made because an algorithm says the situation is bad, both because the FCC has set the rules to be much stricter than that but also because someone else could write a different algorithm to disagree. They were required to have ground truth, so they went and got it.

Oh snap: AWS has only gone and brought out its own Backup

Re: All fine and dandy

But the major benefit of cloud is that it can be cheaper, conditions apply. The cloud providers sell economies of scale where your usage can be balanced against everyone else's usage to reduce the total amount spent on computing so you only pay for what you're using, as well as your risk of hardware problems which again reduces your cost. Otherwise, cloud doesn't tend to offer much more than you could do with your own hardware. There is a minor benefit in having geographically-distributed systems for faster access by people in distant locations, but this is rarely an issue of paramount importance. If cloud isn't cheaper, the only benefit that is distinctly relatable to cloud is scalability, but again, conditions apply. So many people either jump on the cloud bandwagon or refuse to use any cloud-related product whatsoever without actually looking at whether it is useful in the situation.

It’s baaack – Microsoft starts pushing out the Windows 10 October 2018 Update

Re: "our next generation machine learning model"

I think you may be a bit overzealous in your defense there.

"Again, to be fair to Microsoft they are tasked with rolling out a global update for a user base who are 80-90% computer illiterate,"

Good start. I agree that this is a major problem for Microsoft's engineers.

"many of whom bought computers that were either built or upgraded by a 'mate who knows about computers' or the local back street 100% legal PC repair shop."

Some of them are, but most of them are using computers that were built by the companies that build or sell computers, using the software environment that those companies came up with. Dell, HP, Lenovo, etc. have much more market share each than custom-built machines, especially when considering users who are tech-illiterate. Those machines have many of their own problems, and a great deal of the driver or hardware problems experienced by users can be laid at the feet of those companies, but it is not fair to classify most windows machines as built with extremely weird components.

"Think about the chances of all them 'genuine NVidia GeForce Ultra cards for £30 on ebay' working after the update,"

I don't think those are going to work, but the kind of person who goes to eBay and purchases an obviously not-genuine graphics card is the type who should expect problems. The type who buys a computer from the computer store and has done nothing at all to the hardware shouldn't expect anything like those using counterfeit graphics cards.

"but they'll be the same 'know-it-all' teenagers that you'll see posting YouTube videos about how Microsoft programmers don't care and aren't listening."

Those people are probably not the ones complaining here.

"In short - the fact that Microsoft have a development team that can release this stuff without destroying the world more often is a minor miracle (and anyone who works in software development would agree)"

They are not as hyperbolically bad as comments here might lead one to believe, but they have had times where they didn't do what they should have (the initial 1809 deleting files thing, for example, was purely their fault and could have been fixed when the Windows insiders found it rather than after it deleted standard users' files).

"just ask which development environment is the world's best - Microsoft Visual Studio wins hands down - made by Microsoft developers for developers. (and yes I'm aware Eclipse is better for some use-cases)"

Personal opinion, not necessarily one I agree with, either.