Posts by Blazde

Sorry Dave, I’m afraid I can’t do that! PCs refuse to shut down after Microsoft patch

Re: A bit late in the evening...

Yup: https://www.youtube.com/watch?v=T2OpRfLmhHU

Also from the same era, Weird Science: https://youtu.be/8SCCihCUI4U?t=211

"Unplug it!"

"... Oh shit"

Britain goes shopping for a rapid-fire missile to help Ukraine hit back

Re: Of course the real truth

I confess I don't understand the MTCR, and have never looked into it. In fact the first time I remember hearing of it was an explanation of why we weren't giving longer range Storm Shadow to Ukraine. So while I agree with you, I don't know if it's a convenient excuse for not giving more advanced weapons, us being all legalistic or the actual reaon. It is the reaon I've heard the government give though, and we do tend to gold-plate international commitments.

I don't know the calculus for sure but Storm Shadow/SCALP is much more on the limit because it's export variant is designed to be both just in-range (290km, not .>=300km) and under-delivery (450km, not >=500km) of MTCR requirements and the the non-export variant is well over-range. My understanding of the actual requirements are they're a best efforts/exercise responsibility/not legally binding/box ticking exercise(*) but there is clearly a benefit to be seen to be upholding the norms so naturally the export Storm Shadows/SCALPs get donated first and then there's a genuine operational question about whether Ukraine can really benefit much from the modest range boost of the non-export, given they have home-grown capabilities for longer range. There seem to be rumours of some long range ones being donated but no official acknowledgement. Perhaps it's a very occasional case-by-case basis. Perhaps it's "do you want two short range ones or one long range one?" and Ukraine always replies like "Quantity over quality"?

(*) To some extent you can say this about any actual international law of course. Enforcement is only a matter of consequences.

Also though, that phase of the war was marked by a strong vibe of European nations coaxing the US into doing more by basically saying "we'll go this far if you will too", ensuring the US was both complicit in the escalation and encouraged to do more via effectively a donation matching scheme. Biden was pretty spooked by Putin's nuclear threats so there was a desire in Europe to lead, but gently so as not to leave the US behind completely. So we had this whole ratcheting dance of, these missiles but.. not fired into Russia, then.. only into Russia at military targets, etc. and MTCR was naturally a rung on that ladder. Since Trump this factor has gone out the window so there's a much greater emphasis on maximising direct (bilateral) benefit, and this Nightfall programme seems squarely aimed in that direction.

I think cluster munitions/mines are pretty different from a British perspective because Ukraine is a prime example of a war where there will be significant clean-up cost and/or disability/mortality from left-behind munitions, there was perhaps some potential to bring Russia and the US into the treaties because of that, and at the same time there has instead been some unravelling of the consensus as a result of Russia using clusters and mines and Ukraine saying 'to hell with that, we will too'. On the bright side: the drone infested battlefield has made front-lines so wide and sparse that chemical weapons seem out of vogue right now, and that trend doesn't favour mines either. On the other-hand: Literal hundreds of thousands of FPV drones flying around are going to leave their own unexploded ordinance legacy.

Re: Of course the real truth

So I'm pretty sure we won't give Ukraine anything that can do long range with high payload. It will always be one or t'other

Well, in this case it's yes to range no to payload. But Ukraine is part of the MTCR club, an NPT signatory, has it's own fairly advanced missile industry, has given up nukes rather than simply not developed them like Germany, is severely financially constrained and currently quite obligated to play nice with EU/NATO/Western norms, so in no actual danger of pursuing nukes, and there's a very strong argument that long-range drone and intermediate missile delivery systems have parallels and they're world-leaders in the former. (And should they tragically be overrun by Russia, there's also no proliferation danger since Russia has half the world's nukes). I really don't think any argument you can give for sharing or not sharing missile tech with Germany doesn't apply to Ukraine equally at this point.

One of the things that makes missiles expensive is all the testing and work to give them a 10-20 year shelf-life

That's a fair point. It's very interesting to see just what corners can be cut when there's active need: The Royal Navy testing various quite polished looking USVs and harping on about integration and cultural change, while Ukraine are actively fielding vessels with similar capabilities that look like they were welded together 12 hours before the mission and fitted out by those electricians who insist on leaving all their trash under your floorboards (because their job is to wire the thing and maybe you should hire a cleaner if you want it clean), and they work. At least enough of the time from what we've seen. But missiles are pretty finicky, there's a limit to how close you can sail to the wind on reliability before they just become an expensive embarrassment you don't want to build in any quantity.

Another way to make it cheaper, is to build some bits in Ukraine. With much lower wages/costs.

Except it's becoming apparent the reason we haven't seen Ukraine's Flamingo cruise missile in much service is that their sites keep getting hit. Again, for expensive high tech stuff there's a limit to how close you can push the cheapness angle. Ideally you want this to help Ukraine but you don't want to be too reliant on build sites in a warzone when NATO territory is relatively untouchable. Conversely from Ukraine's point of view, even though currently they enjoy a lot of collab with the UK, they quite understandably want their arms industry to be as independent as possible, so they'd prefer not to have a factory building a British missile when it could easily be building a domestic one instead. But that's why I wonder if this is really just a way to achieve both, cloaked in the usual procurement rules for show.

Re: Of course the real truth

I absolutely agree cheapness is worth it and should be aimed for, but it would incredible by any recent standards to get this kind of capability for £500k a pop. Even the CAMM missiles you mention cost that much and the goodies for that are in the launch system, with the missiles being intentionally as expendable as possible because of their role. The only realistic hope is that production scale can bring costs down, but that is exactly where the US comparisons are relevant.

I assume the MTCR is ignored for this programme because it's aimed at capability rather than commercialisation, so the usual aim of making an arm as export-friendly as possible to drive costs down and get domestic purchases as a loss-leader will not neuter it - but then isn't it even more hopeless to expect it to be cheap? The most MTCR-restricted missiles are those with range over 300km and 500kg warhead because they're immediately nuclear-useful. But this will have a 200-300kg warhead so it really just falls in the "don't offer it to every single sketchy regime" category.

Incidentally the £500k figure and the 300kg warhead are from August(*). It's now 'maximum' £800k and 200kg warhead. So we already have a sense of the rate of slippage.

(*) https://www.contractsfinder.service.gov.uk/notice/96bd4458-74ee-448a-8517-e702cc2f7d51

Re: Of course the real truth

They want it at £500k/missile without warhead(?) and to have almost twice the range of ATACMS, which even as a very mature programme costs twice that (err with warheads). Russia's Iskander is supposedly $3mil/missile (how on earth anyone calculated that and whether it's adjusted for PPP I've no idea), although that's a chunkier warhead with similar range. US newer PrSM - similar range, lighter warhead - $3mil. Also Ukraine's own Hrіm-2, comparable to and possibly partly based on the Iskander has been in development for over 10 years, and ya know, time is money.

The only way I see it being remotely cheap is if it's genuinely an off-the-shelf design, proven on the battlefield and with production lines already optimised (eg. perhaps the intention is tender a Hrіm-2 technology transfer & scaling up), or it's simply a blatant low-ball.

(I do think the Ukraine war has proven cheap munitions are desperately needed though. Imagine we were building £100mil Hurricanes during WW2? To some degree that was a mistake Germany made back then.)

Re: Of course the real truth

- Must be precise, manoeuvrable and unjammable

- Hit hard

- Go far

- Manufacturable in high volumes

- Want it by yesterday

- And it must be cheap

It sounds amazing. No prizes for guessing which of these requirements will get sacrificed first

(Edit: To be fair, needing something quickly with high order volumes being guaranteed is a decent way to keep unit cost lower than it otherwise would be)

Infamous BreachForums forum breached, spilling data on 325K users

Not a recent incident

Ah, I barely remember it. The dimly forgotten past when this was all fields as far as the eye could see, when children respected their elders, when a man wasn't a man until he owned a good tailored suit and a bowler. The heady late summer of 2025, rapidly fading from living memory. Them were the days.

Malaysia and Indonesia block X over failure to curb deepfake smut

Re: Block X

At least in the UK the main distinction is that X is a user-to-user service, deepfakes generated by Grok can and are immediately shared and that's the unlawful moderation failure. If an X user posts a Gemini-generated intimate deepfake then X also has an obligation to moderate that.

Additionally, Gemini attempts to stop abuse. But we know all AI guardrails are inherently and unavoidably flimsy so I presume this story will run and run, and hopefully contribute to a more clear-eyed assessment of both AI's usefulness and restrictions that can practically be placed on it.

How hackers are fighting back against ICE surveillance tech

Re: So...

Here (UK) it's pretty common for 'nice' cars to do away with especially the front license plate entirely, on the grounds that it spoils aesthetics of the car from it's most photogenic angles.

The fixed penalty fines are merely a vanity cost I suppose. £100 first offence. Cheaper than a decent wax job.

I'm not sure how common fines are but at least in my parts the police are much focused on the street racing some of the same cars are involved in, since that's lead to some nasty deaths and - as far as I'm aware - failing to present a license plate properly to an ANPR never has.

Re: So...

Benn Jordan's weird tech/sound/data adventures are incredible by the way. I highly recommend them.

Brit lands invite-only Aussie visa after uncovering vuln in government systems

Re: Government wishful thinking

Most Olympic gold medallists may have reached their peak, but statistically an Olympic gold medallist is massively more likely than your average migrant to win another one.

Also, never underestimate how seriously Aussies take their sport. One day their visa programme will yield an extra Bronze in the Winter Olympics and the policy will be labelled a 'beut'.

Hong Kong’s newest anti-scam technology is over-the-counter banking

Re: Extending this idea will only lead to madness

I don't think this sounds very plausible. Just imagine how quickly shoes would wear out, and many umbrellas would be required..

Europe's cloud challenge: Building an Airbus for the digital age

Re: air gap

Sadly we'll never know whether they've been successful, but I like to imagine them now happily existing in a parallel internet forever cut off from the rest of us. Chatting away on IRC and scraping together a rudimentary search engine..

From video games to cyber defense: If you don't think like a hacker, you won't win

Re: Again, El Reg?

I think you're straw manning since your argument could be applied to any advice on securing systems. Don't bother because it's too hard and not worth it unless you achieve 100% security?

A complex enough system can't be secured. At the very least you can't prove it's secure. If you try to apply mathematics to the problem of proving it's secure you first have to model the system and then prove the model is secure. That definitely has value but it fails to secure real world systems partly because of their complexity, but also *because* mathematicians don't tend to think like hackers. Hackers aren't respecting the model, they're finding ways to subvert it.

Re: Again, El Reg?

I think it's a bit cliche at this point, but 'think like a hacker' is really *the* thing. It's almost binary: There's a gulf between people who default to acting to some rule-set without consciously thinking about why they're doing it, and those who default to getting creative and thinking in terms of consequences, ignoring rules or even actively getting a kick out of the challenge of subverting them. I'm not sure it can be learnt though, you certainly can't just will yourself to think like a hacker. But you certainly should identify people who do think like a hacker and employ them.

Someone who claims you can never win the game has already lost it, is not thinking like a hacker, is not going to get a kick out of the challenge or think creatively and therefore should probably not be employed in an important security role.

Pen testers accused of 'blackmail' after reporting Eurostar chatbot flaws

Crude but honest. I also quite like: "Blackmail? That's slander!!"

Optionally followed up by: "I shall see you at dawn with either an apology, or a pistol"

Microsoft wants to replace its entire C and C++ codebase, perhaps by 2030

2030 Goals

As long as we're already smoking crack and pulling numbers out of our arses, why not just go full pelt to make The Singularity happen by 2030? Rewriting a 50 year old tech giant's entire codebase will be a mere microsecond's effort then.

Conman and wannabe MI6 agent must repay £125k to romance scam victim

I feel sorry for the genuine Swiss bankers who work for MI6 and know a few celebrities. How are they supposed to date when everyone suspects a blatant scam straight away?

There’s so much stolen data in the world, South Korea will require face scans to buy a SIM

Butt-hole scans.

Only while they perfect the more 'internal' scanning technology though. There's an endless supply of very private biometric information available from each of us if you really get creative about it.

Starlink claims Chinese launch came within 200 meters of broadband satellite

Re: Drugs in ink cartridges?

I believe they use methatone

UK watchdog urged to probe GDPR failures in Home Office eVisa rollout

Re: Paperless, online only, smart devices, virtual, etc

But getting a smartphone is easy! Click here to download our app(*) to help you select the phone that's right for you.

* Android/iOS only

UK pushes ahead with facial recognition expansion despite civil liberties backlash

The Government is supposed to represent the people, so why do they need to watch us? They are ours to command, not the other way around

Indeed, but we the people keep electing governments who want to be seen to be tough on crime. The sad reality is most people are happy to accept a little bit of 'so-called' miscarriage of justice and unsafe conviction because these suspects wouldn't end up in court, or in the police facial recognition database, in the first place if they weren't guilty, would they? And even if they're not guilty, allowing society to acknowledge that would involve orders of magnitude more actual criminals circumventing justice. Better to bake the cake while breaking some innocent eggs.

It pains me to say it but sometimes the truly corrupting powerful influence is the electorate ourselves. The Justice Secretary spoke eloquently in favour of jury trial but a few years ago. The pressures of pleasing the populous and their desire for both financial efficiency, and swift revenge have changed his mind.

Re: First check to run

Roughly 2,530,089,949,700,000 pairs. Should be a good enough sample for a solid false positive assessment, the result of which will be buried with extreme prejudice.

it's the fun of joining dots and linking different things together to see if there's a pattern

This is not really linking things. You're focusing on an extremely narrow aspect of the economy: office real estate. It's not a particularly prominent area of investment for big political donors. It's low-risk commodity investment. Cheap buildings on land which has little down-side risk. The big donors are doing more interesting risky things which government policy could significantly impact if backs were scratched. The want deregulation and multi-billion pound government contracts. You don't benefit from those if you own a few business parks, and you're not making enough money to buy a peerage either.

A proper economist - which the Treasury has a couple of - would label *productive* working-from-home as economically beneficial because it reduces the need for capital-intensive office space and allows land, buildings and construction resources to be reallocated to other parts of the economy where it's sorely needed. Such as housing. So that people can have a home to work from.

In reality business, and therefore the government also fret that WFH leads to lower productivity because people are more likely arse around during work hours when they're in the comfort of their own home with all it's homely distractions. Without digging into that debate too deeply, perhaps they hope AV helps with that problem.. (as long as we're trying to join the dots).

We don't really need conspiracy theories to hate surveillance though: The problem is that even if the government has pure intentions now, and that may well be the case, the surveillance powers will get abused shortly down the line. It always happens.

Windows keeps obsolete strings forever to avoid breaking translations

Re: Ah yes, unnecessary strings

But they don't get purged until a major release. That's often over 365 days of unnecessary strings!

GrapheneOS bails on OVHcloud over France's privacy stance

Re: is this real

it may of been a more powerful statement had OVH said "the government is telling us to terminate your access because you won't put back doors in your software". (certainly not a bad idea to have a backup in place in the event that happened)

If it's implemented anything like the UK's attempt they won't be able to say anything. Much better to jump vocally now before any legal gagging takes effect, and in doing so potentially move the needle on the political debate against it going ahead at all.

UK digital ID plan gets a price tag at last – £1.8B

Re: I voted for him

I thought the incompetent vs competent chancer, which is worse? Question had been comprehensively answered by the Liz Truss vs Rishi Sunak pm thing few years ago.

Rishi? He managed way more damage to the economy by appearing competent enough, to enough people for a long enough period of time.

Or Liz? Although she did very little damage directly, the trouble is she showed that if you are incredibly incompetent you should avoid splurging your incompetence up the wall all in one go. As a result, the next incredibly incompetent PM (and there are several prospects on the horizon) might be that bit more dangerous if they can learn some basic lessons from her time.

Google links Android’s Quick Share to Apple’s AirDrop, without Cupertino’s help

Re: Rust ?

They're a software company with over 150,000 employees, they're allowed to use more than one programming language. They were a little bit late to the Rust party but have since made up for that in enthusiasm & support for it.

Researchers claim 'largest leak ever' after uncovering WhatsApp enumeration flaw

Re: Excellent Work

Presumably they collect that data in advance so the arresting officer doesn't need to risk asking "sex please?" when booking a DUI case

Re: Excellent Work

There was actually quite a lot of shock and horror in the 90s when phone books first became available in machine readable form on CD.

Re: University of Vain-a

Meta said themselves the method "exceeded our intended limits".

This is the same company that has had the exact same, and several similar issues with Facebook in the past and claims to have "an External Data Misuse team that consists of more than 100 people dedicated to detecting, investigating and blocking patterns of behavior associated with scraping".

https://about.fb.com/news/2021/05/scraping-by-the-numbers/

To be clear, our first line of defense against unauthorized scraping is to make it as hard as we can for people’s data to be collected at scale. We want people to feel comfortable using our services, with confidence that we protect their information, so we work to limit access to our features by scrapers while enabling people to continue using those features in order to connect and share with others.

But keep insisting it's nothing.

Excellent Work

20 pages of academic paper to send to relatives when they ask why anyone would refuse to use WhatsApp when it's "really easy" and "free".

As a bonus several pages of detail that can be sent to anyone about to waste their time engaging with Meta's bug bounty program. Some really shameful responses there. Props to the researchers for persisting with the contact. I would not have had the patience.

FCC looks to torch Biden-era cyber rules sparked by Salt Typhoon mess

Re: this administration

Remarkably the health of drinking water (wrt fluoridation) is, on the face of it, a rare point of agreement between the Biden & Trump administrations: https://subscriber.politicopro.com/article/eenews/2025/07/21/trump-admin-fights-historic-fluoride-ruling-00465318

(You rather suspect the reasons for disagreement with the ruling are very different)

Google Chrome bug exploited as a 0-day – patch now or risk full system compromise

Re: Do I need to panic?

Don't forget the hundreds of programs using Electron which may/may not have code paths executing potentially malicious javascript.

And wait, if it's a bug in V8 it presumably affects everything Node.js too? Or not? This is a remarkably poorly described bug.

Ransomed CTO falls on sword, refuses to pay extortion demand

Re: Slightly misleading headline

I think the billionaire CEO is the principle shareholder, and the actual donation is unspecified so it's more a case of throwing a few pennies onto the sword in the wishing well, and writing it up in accounts as marketing spend. If we're being cynical. Still, it's great when a company's incentives align with the greater good and the leadership can recognise that.

Re: Chief Technology Officer Mariano Albera said that his company takes "full responsibility"

> you shouldn't need bars on the windows and shutters on the doors.

This is kind of a rich world idea. In places where poverty is high, you absolutely do.

'Poverty' is relative to the thing at risk though. Even in the rich world if you're protecting data that can be extorted for millions, or crown jewels that can be melted down for millions, you need bars on the window.

Perhaps, in a hypothetical world inequality would be low enough that person A never has enough stuff that it's worthwhile person B stealing it and risking the consequences, and so everyone can leave their front-doors unlocked. However that's never going to apply to organisations because they require greater piles of wealth in order to function.

Clop claims it hacked 'the NHS.' Which bit? Your guess is as good as theirs

Re: Perhaps striking doctors could check through any leaked info.

Paper is not cheaper. It costs about £30k/year for a switch that will move paper around with extremely high latency and low bandwidth plus an extra £1.70 (and rising) each time a sheet of paper needs to be sent to another network, and that switch requires biscuits and sick pay and maternity leave and can also strike.

I remember my local surgery in the 80s. 50% of the floorspace was filled with those old patient note carousels and there were more people working in reception than there were doctors. It was all worthless when I moved to another surgery and the 'transferring of records' which took 8 weeks amounted to a blank sheet of paper with about 4 words written at the top of it summarising 25 years of medical history.

Ubuntu 25.10's Rusty sudo holes quickly welded shut

New code, new bugs. This is why innovation is seldom good.

In this case the old code has new bugs too..

sudo-rs has 5 low severity CVEs in it's entire 2.5 year history: https://www.cve.org/CVERecord/SearchResults?query=sudo-rs

During that time alone 3 high severity CVEs have been announced in the original sudo, including a memory safety issue: https://www.sudo.ws/security/advisories/

The goal of sudo-rs is not just to have a memory safe version of sudo but to reduce complexity especially in security sensitive areas so that logic errors are less likely and less severe. Time will tell just how successful that's been but so far it's looking like a worthy case of rewriting something from scratch however ill-advised that may be in general.

UK's Ajax fighting vehicle arrives – years late and still sending crew to hospital

Re: And in addition to that...

many of the shots you see of that online are of stationary tanks with no crew. i.e. they were already out of combat, but to stop them being reoccupied (or towed off and repaired) local units would send a drone to finish them off.

There's drone survivorship and clickbait bias here. The most 'interesting' footage we see is indeed 'hand-grenade dropped into open hatch' type you mention. But the threat to active tanks with hatches closed, and even moving, are FPV drones carrying RPGs with shaped charges. We rarely see the result of those besides a black screen indicating the drone itself was destroyed. The reason drones are a threat is the greater precision for hitting vulnerable points, even compared to advanced anti-tank missiles.

However we're usually talking older Russian tanks which have more catastrophic weak points. The practice of hardening a tank against a precision missile should help with drones also. Indeed, we see reports of modern Western tanks taking numerous 'attempted precision' FPV drone hits, and also crews surviving even when ammunition does cook off. Hard to know how statistically significant those are of course.

Either way your main point is absolutely valid. Not every asset on the battlefield can protect itself from every threat, nor does it get consigned to the history books if it doesn't. I think we can see a trajectory favouring dedicated anti-drone weapons because the drone density seen in Ukraine necessitates minimising cost per drone-counter. Expensive single-use interceptor pods on armour should be a last line of defence.

Meanwhile air-burst rounds even from the very capable Ajax auto-cannon - which apparently has a maximum elevation of 85 degrees specifically to counter air threats - may well be too ineffective to be worth the displacement of other ammunition. Those things are downright scary on the battlefield. If I were a soldier on the other side nothing would make me happier than to see it pointing at shadows in the sky while I ran away from it.

Techie ran up $40,000 bill trying to download a driver

Re: Implausible to say the least.

Yea, there were a lot of good solutions for interrupted downloads however they all relied on the remote sever being capable of starting in the middle of a file. Many weren't and email was probably especially bad. We should also mention it's already not great to do bulk downloads by email because of the then-unavoidable 7-bit encoding.

Re: Implausible to say the least.

C'mon 20% success rate? 40 times around? Nobody in their right mind downloads like that. I can believe the end figure though, because corporates were getting shafted back then. The pace of change was so great that what looked like a great deal wasn't 3 months later, and if you took your eye off the ball a little bit longer or signed a long contract a £30k bill is plausible.

There's no doubt he should have done it at home. After 6pm. At least by 1994 line time (the 'sole phone line occupied for the several hours') was the bottleneck for residential dial-up, not the cost.

My own story from a little later in 1999: BT were offering a 0p/min dial-up connection on a special 0800 number for some very reasonable £/month, in the days before 'fair use' restrictions. Snapped it up, connected 24/7, serving websites, amazing unlimited internet like it's the future already. However a configuration error by a flatmate let to the wrong number being dialed, and BT still accepted the login details but chose to charge 1p/min instead (and a little more in peak hours iirc) which resulted in a 500 quid bill at the end of the month, to be shared among students already indebted by several £K each. Despite arguments and pleading that a particular service had been paid for and not delivered in good faith BT refused to waive the bill and I'm pleased to say I've been very diligent in avoiding giving the f***ers even a penny more in the 25 years since. (I've instead given Virgin Media countless thousands for shitty customer service and monopolistic pricing practices, doh).

LLM side-channel attack could allow snoops to guess what you're talking about

Re: Specialisation of a generic attack?

A standardisation of mitigations would be great, but I don't think there're any wins that don't come with significant trade-offs to bandwidth or latency, while also not fully solving the risk until you crank those downsides up to unfeasible limits. Even Tor doesn't attempt to defeat timing attacks in general, it just relies on obfuscating and elongating the route to reduce the chances of the whole route being analysable.

Oh except AWS's mitigation: Trust us, and do absolutely all your work on our networks without touching the wider internet. To be fair it's a valid approach for some use-cases but it's a bit of a grim one.

Cisco creating new security model using 30 years of data describing cyber-dramas and saves

Re: From 8 to 17 billion

https://huggingface.co/fdtn-ai says the 8b model and it's underlying Llama 3.1 model were already trained at BF16. I doubt they've gone lower for the new model.

I'd guess the new one is a Llama 4 variant which is also BF16 but has a mixture-of-experts architecture. If Cisco only used one expert, which is perhaps/probably sensible for a specialised task(?), it'd be 17b paramaters. Or just possibly it has multiple experts and they're underselling it a bit.

Famed software engineer DJB tries Fil-C… and likes what he sees

Re: Not quite ...

Hammering it in the last bit is important because it makes it easier to get out again by making a complete hash of the otherwise perfectly tight thread you've created in the wood.

Then, once you've made whatever silly mistake inevitably leads to needing to take the screw out again (8 times out of 10 it's failure to measure twice) the trick is to squeeze a bit of wood glue into the gaping mess of a hole you've created and quickly turn the screw back in, jostle it around until it's kinda flush with the face of the wood, and then try not to disturb it while the glue dries. If the hammering created any nasty splits in the wood this is also the time to try to make those good enough with generous squirts of glue. Don't be afraid to go mad with glue - the orbital sander is your friend. If the screw still isn't working out, don't sweat it. Dremel off the head to sufficient depth, filler in the hole, and repeat the whole process again nearby while patting yourself on the back for adding character to the piece.

Re: DJB's safest C code

It was widely used back in the day when literally every other codebase widely used for critical networked services, including BIND, was full of simple stack overflows.

As an aside he offered $500 at least as far back as 2001, which makes it possibly the earliest security-focused bug bounty programme? (He only bumped it to $1000 shortly before having to pay out, ironically).

None of the vulnerability hunters I knew of got anywhere looking back then, it was a tight code base. However it wasn't coded especially defensively, which is very tough to do in C anyway, and even tougher to do back then without sacrificing performance because compilers weren't as mighty as they are now. It relied on DJB being extremely careful and having complete control of the project. There were places where a careless but innocent looking local change could have introduced vulnerabilities elsewhere.

This security hole can crash billions of Chromium browsers, and Google hasn't patched it yet

Re: That's a bummer

Okay, more info: People seem to report defeating efficiency mode is now a moving target and a mystery. All I can advise is that I managed to stop it triggering last year, and that needing the solution was unexpected but it wasn't complicated to figure out and it still worked as of around 9 months ago, but I can't remember for sure whether it involved anything other than setting 'Best Performance'. I haven't confirmed whether it still works. In ~3 weeks I'll be returning to lengthy CPU-intensive workloads so I'll report back with any new findings/solutions. We may need some kind of support group... :|

The solution then was robust over various workloads and I was even able to run CPU-intensive code which set itself IDLE_PRIORITY_CLASS and achieved the expected functionality of properly using all spare CPU (on all cores) while having minimal impact on any higher priority programs, although that wasn't (at least originally) necessary for stopping Windows triggering efficiency mode - it was defeated for Normal priority processes just fine too. Note that PROCESS_MODE_BACKGROUND_BEGIN & THREAD_MODE_BACKGROUND_BEGIN are the real killers because they throttle I/O and memory resources (rather than just affecting scheduling priority), and efficiency mode appears to do the something similarly nasty. So Low (aka Idle) process priority itself is probably not the true issue in your case, but rather a tell-tale symptom. (However no two workloads are the same so you shouldn't take my word for that, it could be confirmed by manually setting the program Low manually before efficiency mode kicks in, then checking that CPU is still high and only drops later once efficiency mode is triggered).

Cisco warns of 'new attack variant' battering firewalls under exploit for 6 months

Re: It's time for some rewording

The 'advanced' designation is clearly based on a whole lot more than them burning ~4 Cisco zero-days.

You have to chuckle at the 'ArcaneDoor' branding Cisco came up with though. I'd like to petition to change it to 'MundaneDoors'.

You'll never guess what the most common passwords are. Oh, wait, yes you will

Re: How many systems allow unlimited login attempts ?

Upvote for using at least one special character

Re: How many systems allow unlimited login attempts ?

Chain it with password reuse and think again.

Cybercrooks getting violent more often to secure big payouts in Europe

American isn't it. Since it's Paris 'haut d'échelle' would be more appropriate.

As in "don't drop The Crown Jewels from the haut d'échelle"