Posts by Bronek Kozicki

Autonomous vehicle claims are just a load of hot air… and here's why

Re: it's only tepid when the emissions test cheat device is enabled.

or when buying covfefe

Meet the open sorcerers who have vowed to make Facebook history

This would be promising

... if 1) RFC for appropriate protocols were written 2) security (authentication and encryption!) was catered for. But as the things stand, meh.

Five things you need to know about Microsoft's looming Windows 10 Spring Creators Update

Re: My personal OS is ...

oh, but they do have little Linuxes and command line. I thought that's obvious :)

My personal OS is ...

I do not run one OS, I use multiple at the same time. Which is:

Linux when I need to do actual work, running both as a hypervisor and also as a guest OS within libvirt/qemu/kvm stack. That's what I use for writing and debugging code. Also, my personal OS is Windows 10 (running always as a guest OS) for sake of these few actually good programs not related to work, which are not available on Linux, and also when my children want to play games.

OK, deep breath, relax... Let's have a sober look at these 'ere annoying AMD chip security flaws

Re: Maybe this will backfire.

On put options: the current price is $11.35 , so put option at $11.50 is "in the money". However, the price has been climbing up, from the lowest point today $11.28, so those who bought these options when the shares were cheap will not make profit, unless the price falls again. It might, or it might not - if it does then it would be not on the "strength" of the security "discovery" discussed here.

grumble grumble ...

When people find that your products suffer from meltdown, do you:

1) focus on fixing the problem, or

2) put large spectacles, wig and fake moustaches, point at a rodent passing nearby competitor's factory, and shout "oh look, squirrel!"

Credit to Torvalds for naming these guys for what they are.

Re: Closed black box firmware

Actually, IIRC Intel AMT flaws are worse, because to exploit those you do not need:

1) root access

2) any local access at all

The only unusual quality of these new AMD attacks is that they can remain under the radar for a very long time, making "evil maid attack" particularly dangerous.

18.04 beta is as good a time as any to see which Ubuntu flavour tickles your Budgie, MATE

Re: It's a pity

Actually, having multiple distros use the same desktop (MATE, in your example) means that those who maintain desktop code receive more help and input from distributions maintainers.

Do not forget these are different people with different interests. Someone with expertise writing good UX code might not feel at home maintaining a distribution but will welcome input (and vice-versa - good maintainer might not necessarily write good UX code).

Similarly, having too many people working on any single piece of code directly (rather than via trickle of contributions from distributions) brings to mind saying "too many cooks spoil the broth". You do not achieve more progress by cramming more developers on a project, so having all of these distributions work on desktop code directly (rather than making it better for their distribution) would not help make it better. More likely it would be the opposite.

China ALTERED its public vuln database to conceal spy agency tinkering – research

ok, and the surprise is ...

oh, there is none.

Rant launches Eric Raymond's next project: Open-source the UPS

Re: Lack of reading skills

Not LiPO batteries. LiFEPO4 - which is a different beast. You make many good points which are probably applicable, but c'mon, confusing these two?

Mum? Dad? Can I have a 3D XPoint disk for my birthday?

Re: Don't like/trust Intel SSDs

Here is an interesting discussion on power caps in SSD. They are the reason I only buy "enterprise grade" SSD, and only after having double-checked the specs for capacitors and their function. Both Intel and Crucial make some good, enterprise-grade SSDs, but you have to make your choices wisely. I would definitely not trust OCZ, though.

Slack cuts ties to IRC and XMPP, cos they don't speak Emoji

Obligatory XKCD reference

https://xkcd.com/1782/

IBM's homomorphic encryption accelerated to run 75 times faster

Re: I'm still none the wiser

At the end of that wiki page is a good example.

Imagine you have generated a keypair (private key "a" and public "A"). Your public key "A" is a not memorable at all, but you want memorable one. Another person takes your public key "A" and generates a keypair (private "b" and public "B") such that operation "A + B" yields a "vanity" public key "C", i.e. one which is easier to remember (where "+" may not necessarily denote addition; it is just some mathematical operation). You buy from them the keypair "b" and "B" and then apply the same mathematical operation on private keys "a + b" which gives you a private key "c", matching the public key "C" (which, to remind, is a result of "A + B"). This is of course assuming that the homomorphic encryption was applied here - otherwise, this won't work.

The real news is ...

... IBM giving access to cutting-edge research under APACHE 2.0 license. That's the one which explicitly grants (although under the condition of non-litigation) licensees access to relevant patents. Yes, that's IBM.

ESA builds air-breathing engine that works in space

Re: "...roughly < 1/32 Sea Level pressure...".

I would just say that "roughly <" was a tiny understatement.

Women of Infosec call bullsh*t on RSA's claim it could only find one female speaker

There some good and well-known women security researches

... but they do not have the corporate backing to be given the keynote slot - for example, Joanna Rutkowska.

Euro Commission gives tech firms an hour to take down terror content

or simply HTTP error 451

At last, sex trafficking brought to an end with US House vote on new internet law (Yeah, right)

"knowingly"

I think that word "knowingly" is crucial in the context, and FB contribution to the law is a good one.

IPv6 and 5G will make life hell for spooks and cops say Australia's spooks and cops

Re: Some encryption, good; ...

Seems like a good idea, anyone to prepare new revision of RFC3514 ?

/s

I think spooks would be happy to endorse such proposal

Nokia tribute band HMD revives another hit

list of applications?

Could not find one - does anyone know if it comes with Signal?

EU aviation agency publishes new drone framework. Hobbyists won't like it

Re: @Martin Gregorie

Also, flying model aircraft (planes or helicopters) is always subject to line-of-sight rules. You are not allowed to fly a model which you cannot clearly see, or which cannot be seen by the assisting ground crew.

Software shortcuts: Pay down your tech debt. It's time to fix a price

Re: re: it was deemed over-engineering to cater for anything other than the specification required

There is also this little thing called "non-functional requirements". Things like scalability, logging and monitoring subsystems, deployment and test tools, etc. Things which are rarely, if ever, mentioned by the project stakeholders, but if ignored during design and development then the final product is guaranteed to fail.

Samsung needs to eat itself, not copy Apple's X-rated margins

I thought ...

... that A5 was S7 lite, so a new release of A... could take the place of "S9 lite"

What did we say about Tesla's self-driving tech? SpaceX Roadster skips Mars, steers to asteroids

Re: "rapid, unscheduled disassembly,"

Oh, so that's where URL came from

Monday: Intel defector touts Arm server chip. Wednesday: Intel shows off new server chips

Re: Yes... But does it actually work?

AMD CPUs are not affected by Meltdown, only by Spectre. The workaround to the former is really expensive in terms of CPU overhead on Intel (and exactly 0 cost on AMD), especially if your workloads involve lots of IO, which is why I plan my next upgrade to AMD Epyc (from Xeon Ivy Bridge). The workarounds to Spectre are still appearing, but so far all are pretty cheap.

Yes, but does it ...

... run Meltdown exploits ?

Adobe: Two critical Flash security bugs fixed for the price of one

Re: Roll on 2020

Yes, well, assuming it is actually removed from users' computers ... especially those whose owners never bother with patches anyway.

Beware the looming Google Chrome HTTPS certificate apocalypse!

Well done, Google

I recently installed a new server and migrated friends website from Ubuntu 14.04. While doing so, I also installed letsencrypt certificate and it was very easy, thanks to "apt-get install letsencrypt". A bit of learning of nginx configuration was required, but learning is what I do. Setting up a timer to refresh the certificate bimonthly was trivial, too. One point of note: the certificate will store all alternative host names from -d parameter(s) passed to letsencrypt, but the first -d parameter is also set as CN= record of the certificate. So make sure you pass the right name first.

Why boasting? Just to show there is absolutely no reason to stick with dinosaur CA like Symantec. If the only thing you want to show in the certificate is the host name (rather than organization name), then you do not need expensive verification and letsencrypt is your friend. If you need verification, there is plenty of competition to choose from.

US broadband is scarce, slow and expensive. 'Great!' says the FCC

Like healthcare

Say what you will, but you have to admire the consistency (screwing the rest of population so that select few can have it all)

Exoplanets from another galaxy spotted – take that, Kepler fatigue!

Long time ago and in a galaxy far, far away ...

That's no moon.

Epic spacewalk, epic FAIL: Cosmonauts point new antenna in the wrong direction

I think Russians are used to seeing worse, with all these oligarchs ...

(sadly, not a joke)

Scammers become the scammed: Ransomware payments diverted with Tor proxy trickery

Re: Twice screwed

You mean, Time Machine snapshots are not immutable?

I am starting to feel lucky, as I do not use Apple products ...

Can't login to Skype? You're not alone. Chat app's been a bit crap for five days now

Re: Any good replacement that would be simple for elder users to install?

I am using BBM for family too, it works great and is simple to both install and use. However it is not available on Windows nor Linux, so was looking at alternatives - Signal received serious consideration.

Fella faked Cisco, Microsoft gear death – then sold replacement kit for millions, say Feds

Re: faces a theoretical maximum sentence of 1,029 years in prison

To be truly pedantic about such things, you get 0 years (rounded down, as set by the rules of conversion from floating point to integral types) until the midnight before first anniversary of whatever event you are counting from. So, 1023 years would be either forever (if the counter does not have enough bits and hence keeps rolling over at some smaller value, like 255 + 1) or 1024 years less some arbitrary, usually small, quantum of time.

You can't ignore Spectre. Look, it's pressing its nose against your screen

Re: State actors = malware developers

vCPU pinning is well know, but it makes load balancing difficult. Regular load balancing would be based on assumption that you can always pin more than one vCPU to a single core, and you pin vCPU from multiple VMs to cores on one physical CPU. These assumptions need to go out of the window now.

I expect Amazon, AWS, Azure etc. will start offering a new tier of services where they indeed guarantee that only your VMs run on any single physical CPU, but this is going to be expensive (you pay for more vCPUs than stricly needed), or slow (poor load balancing), or both.

Re: State-sponsored actors

That's what GCHQ wants you to think ...

I want life to be boring, says Linus Torvalds as Linux 4.15 debuts

Re: Yay for ArchLinux

I am not living under the impression that my computer is not vulnerable to spectre v1. But there is very little I can do about it. I am simply happy that living on the bleeding edge of both kernel and compiler development has, at least once, given me some real benefits. Few distributions make this easy and most are lagging behind, sometimes quite significantly.

Yay for ArchLinux

Thanks to a really, really small patchset in the distribution itself, it is trivially simple to build my own Linux kernel straight from www.kernel.org and with my own configuration. Even better, thanks to following GCC releases really fast, my kernel is now reporting this: "Mitigation: Full generic reptoline". And I am running 4.14.15 - but I bet the distribution will make kernel 4.15 available in the next few weeks (or I can just roll my own - not tempted though, just yet)

Intel alerted computer makers to chip flaws on Nov 29 – new claim

Re: And how is the other way looking

Well, let's see ... processors from the competition are catching up, on some benchmarks are better and worse on others, but clearly getting there. Then comes the news about Meltdown bug (lets put Spectre aside - all are vulnerable to this) which only affects Intel processors, and the mitigation to this one comes at a cost at least 5% of the performance, sometimes more than 20%. Surely that is going to impact the benchmarks, and hence sales figures. The problem is systematic, and it will take Intel a long time to fix it in hardware - the time which the competition can use to improve their designs, not impacted by Meltdown bug

Judging by the moves of INTC and AMD share price right after El Reg article, shareholders think similar.

Serverless: Should we be scared? Maybe. Is it a silly name? Possibly

Re: Oh, shit...

This, but what should we expect when everyone - including headhunters, regulators and journalists - think that CODERS are synonym with ENGINEERS.

Sometimes it feels as if these two were seriously considered to be engineers, and the whole of the profession held responsible for the inevitable mayhem.

@Trevor Pott

I think you got it right here "If something goes wrong, we don't know how to fix it, but we may still be held responsible. Most IT practitioners simply won't be able to get over this."

The thing is, IT practitioners make the decisions. Their job is to control the risks and take the responsibility. Until "serverless" evangelists find a way to put that in a black-box, too, it will not take off. And we are far from it.

Samba 4.8 to squish scaling bug that Tridge himself coded in 2009

Why a VFS plug-in would need 1GB memory allocation? I guess you mean file buffers, which are maintained by the kernel anyway and shared by all processes which need access to the cached files.

Samba is not SMB

It started its life this way, but that was long ago. Since then it has become a central authentication authority based on standard Kerberos (now with both MIT and Heimdal implementations available) in the local network, with integrated directory services for both humans and machines, based on standard LDAP. Also, it is a go-to solution for making the enterprise scale distributed filesystems available to Windows machines, thanks to CTDB - for example see page 12 in Lustre Architecture whitepaper. Not everyone needs distributed filesystem; I will grant you that. But that does not mean that Samba is less useful as an authentication authority or directory service.

'WHAT THE F*CK IS GOING ON?' Linus Torvalds explodes at Intel spinning Spectre fix as a security feature

Re: Speculative but maybe workable fix

@David Roberts - it is a perfectly good analogy, for a non-technical person like Lee has proven himself to be.

Meltdown/Spectre week three: World still knee-deep in something nasty

Re: Intel "shouldn't be selling CPUs?"

@ST you are right and I am right - I was referring to Meltdown (not to Specre) so we agree on this. The speculative execution on its own can also cause Spectre "class" of bugs which are cheaper (performance wise) to work around, as compared to Meltdown one. The numbers I keep seeing on lwn.net for Specre are consistently under 5% (usually around 1%), but numbers for Meltdown easily exceed 10% if your system is doing little more IO or other kernel-related activities. This is why I believe that AMD (not being affected by Meltdown) have now huge performance win against Intel, which is not reflected by old benchmarks, at all. On related note - I wonder if GPU intensive application (i.e. games) need context switch to communicate with the GPU. If so, then gaming benchmarks are going to be affected a lot, too.

You are also right on explaining that speculative execution issue is not just "implementation", it is more of a design issue. Just let me have that simplification, ok?

Re: Intel "shouldn't be selling CPUs?"

AMD is known to be not affected by Meltdown bug, which was also the most expensive (in terms of performance penalty) one to fix. This means that, suddenly, all the performance benchmarks comparing Intel (with crappy buggy speculative execution which allows user code crossing kernel boundary) against AMD ones (which would not allow such violation in its own, slightly less buggy, implementation of speculative execution) are no longer valid.

Linux 4.15 becomes slowest release since 2011

Re: Now what would be interesting...

(typo, should be 4.14.14 - that's what I'm running, today). Always follow kernel.org , that's where upstream is.

Honestly, I am very annoyed at distributions refusing to use something closer to LTS upstream and insisting at applying hand-picked patches on old kernels instead. I can understand the reasoning for RedHat doing that, but everyone else?

Apple iPhone X: Two weeks in the life of an anxious user

@Destroy All Monsters

... ouch, this is so sexist. And brilliant, too

PowerShell comes to MacOS and Linux. Oh and Windows too

use case

I read elsewhere that MS has added (not production ready yet) an ssh server to Windows. I am trying to guess what shell is that ssh going to make available for its users, could that be PS rather than cmd? If a Linux admin tried to do some remote administration of a Windows machine under ssh and landed in PS prompt, then perhaps it would help to be able to run (and learn the basics of) PS on a Linux machine? It wouldn't be great and it would not convince anyone to switch from bash or zsh, but it would serve the educational purpose, I think.