Posts by MCPicoli

Beanstalk loses $182m in huge flash-loan crypto heist

Re: Where do I go to borrow one billion dollars?

AFAIK, the "buy tokens for X" and the "sell same tokens for ~X" are all encapsulated in the same loan-repay transaction.

So it is one transaction: Loan, Buy Tokens, Do Something, Sell Tokens, Repay Loan (with interest and fees)

Interest and fees came from the funds diverted from the project after majority of tokens was gained.

Somehow if any of those steps failed, nothing would be commited. Seems like magic to me, to be honest. But it worked for them.

Re: Help me understand....

There was no bug. The smart contract worked as intended. You buy governance tokens, you get voting rights. If you have a majority of them, anything you propose is automatically approved.

The cleverness is that the "attacker" encapsulated everything... taking the loan, buying the tokens, proposing changes, approving them, draining the funds and repaying the loan (with intereset) into a single transaction.

There was no theft. The system worked as designed!

Re: Where do I go to borrow one billion dollars?

AFAIK, the idea is that everything happens in one single, atomic transaction.

The borrowing, the interest payment and the principal repayment. All in one transaction. In fact, to start the loan you have to "pre-pay" the interest. Therefore, the "people" lending do not incur any risk of non-payment, and for this reason the need to have any kind of credit check is none or almost none (maybe some crypto collateral?).

In fact, the lenders did get repaid, in full, and for them, everything is fine.

IMO, the system worked as intended. The "voting" system was not hacked, all that was done was buying a majority stake and then "replacing the board" with "people" that would approve of any proposed change. This is not even a case of a bug in the smart contract, or some malicious code surreptiously inserted in it.

I don't think the original "owners" of the project have any claims over the diverted (not stolen) crypto. They designed the system, it worked. Unfortunately for them, not in their favour. Convincing exchanges to block transactions from the destination addresses would be criminal since there was no theft.

For them, code is law, so... live by the sword, die by the sword.

Not shedding any resemblance of tears for them.

Unable to write 'Amusing Weekly Column'. Abort, Retry, Fail?

One of the old ones

Never forgot an old one I used to see a decade ago. Something related to a COM+ component or some database.

"Task failed successfully"

Took a long, long time to "understand" what was going on (the task failed, and the operations needed to properly deal with this failure were successful), but for the common user it was a message at the same time amusing and excruciatingly irritating.

Client demo in 30 minutes. Just what could go wrong?

Re: What's in a name?

My parent's parrot has an uncanny ability of choosing which cables to chew on and which ones are dangerous. Audio, video, network, all fair game, but never, not even once in decades (she is a 37 years old parrot now) a power cable was molested.

We have redundancy, we have batteries, what could possibly go wrong?

Re: cold start generators

Itaipu UHE in Brazil just entered the chat. (~11 GW)

(trying not to draw attention from 3 Gorges Dam people around...)

One-size-fits-all chargers? What a great idea! Of course Apple would hate it

Re: Apple don't like it?

About your footnote...

Because, of course, for Apple the option of simply complying with something that will save money and reduce waste for everyone is not an option. Apple must do *everything* the Apple Way, fuck everyone else.

Apple may choose to open their connector and communication standards to everyone for almost free (as is the USB-C), ensuring interoperability of Apple equipment with other manufacturers of phones and accessories, but let me stop deluding myself with my utopic dreams.

OK you may pay Apple to certify your cables and chargers, but god forbid you try to create an Android Phone with a lightning connector...

I'd say fuck Apple, comply or get out.

When everyone else is on vacation, it's time to whip out the tiny screwdrivers

Re: Haynes Manuals

You brought many, many old memories back!

I remember the part of being my dad's assistant, long neverending hours of him working fixing the old clunkers of my family. I enjoyed every bit, to the tune of my mom saying I couldn't "assist" anymore until I had all homework and chores done. Lots of trouble, lots of "extra" bits and bobs, but in the end my dad always managed to put everything back together, and miraculously it even worked.

Except for the two times he tried a full body paint job. Something got wrong both times and the cars ended with a not-so-desirable-for-the-time "matte" finish. Not fixed, he and mom used the cars for several years after.

China reports local chipmaking boom with output up more than 40%

Re: Quality

In my personal experience, chinese-made chips are inferior, both in design and manufacturing, but each year, year after year, they're getting less inferior and more refined. Most "new" designs from them still have some problem or limitation, but less and less. For many, the difference simply doesn't matter anymore.

How much time until they're as good as any western chip or better?

(my experience revolves around MCUs, radio/cell modules and simple logic ICs)

I no longer have a burning hatred for Jewish people, says Googler now suddenly no longer at Google

Re: Shakespeare

"Damascene moment"... Sincerely, I had to google it up. Thank you, for enriching my vocabulary with obscure expressions.

AMD teases '3D V-Cache' tech that stacks cores and SRAM, delivers 15% boost to today's Ryzen CPUs

Re: Picture

The chip at the upper left corner seems to be the one with something (SRAM) stuck over it.

China announces ‘crackdown’ on Bitcoin mining and trading

Re: Ponzi

Your line of thinking is mostly flawed, since you may not simply decide to sell your coins for "X" dollars and it be magically executed, depriving other traders from getting any and collapsing the exchange. Most crypto coins like BTC or ETH are essentially "zero sum" games. You may call crypto any scammy name you want, but a Ponzi it is not.

In an exchange you buy coins *from other users* and NOT from the exchange, unless the exchange is a "user" of itself as well. For someone to buy some, someone has to sell.

If suddenly everybody wanted to sell, the price would collapse, since now there are a lot of coins for not so much dollars (from users willing to buy them) but in the end <new price> x <amount of coins> is _exactly_ equal to the amount of dollars available from buyers.

And the exchange, as usual, makes a pretty penny from their share of the transactions.

In that sense, users would lose a lot of money because they bought high and sold very low (close to, but not equal to zero), but would never get nothing from their coins, barring exit scams, "hackers" stealing the wallets, etc. In the worst case of the exchange not having liquity for that coin, nothing blocks transfer to another exchange where there would be a little value left.

OK, I will concede the case where the coin collapses so hard that it has _zero_ liquidity, then you will lose exactly the value you "invested" and not one cent more.

However, if you start "investing" in derivatives, futures and other complex "financial instruments" involving crypto, then you may lose your pants. For example, if you bet that the value would go up and borrowed a lot of money to buy crypto now, and the value crashed, you'd be in deep trouble.

British bank TSB says it will fix days-long transaction troubles tonight

$1bn contract with IBM

As I predicted more than one year ago, TSB has now $1bn+ less and the same troubles (with some variation). Of course, NOTHING could go wrong by signing a contract for a company systems maintenance with IBM... Could be any other IT provider, doesn't matter if the company is disfunctional.

Can't get that printer to work? It's not you. It's that sodding cablin.... oh beautiful job with that cabling, boss

Re: Ahh, thefts...

Place my father worked before retirement had a policy that all tools and equipment that was going to te decomissioned/dumped/trashed had to be physically destroyed or otherwise mangled to "beyond any chance of repair" condition before, and any and all company markings removed.

It was sad to see lots of equipment in working condition, but completely obsolete, get the hammer/blowtorch/angle grinder treatment, but ended the sporadic cases of newer kit suddenly being deemed "not economical to repair" but misteriously disappearing from the bin later that night.

Re: Time was...

Better NOT investigating if the carpet rolls were bulkier when exiting the building than when they entered it in the morning before...

BOFH: Postman BOFH's Special Delivery Service

Re: Still laughing..

Same here, I wouldn't mind being sent this kind of "trash". My wife, on the other hand...

Absolutely fab: As TSMC invests $100bn to address chip shortage, where does that leave the rest of the industry?

TSMC is Taiwan's insurance against mainland China's invasion

Concentrating so much of so many critical cutting-edge fabs is insurance against invasion since the price the rest of the world would have to pay if all of those fabs got disrupted/destryed is too high. Therefore, cheap whenever compared with the cost of ensuring Taiwan's defense against mainlaind China.

Another consequence is that even if TSMC builds something elsewhere in the world, it will still keep the vast majority of the advanced fabs in Taiwanese land and never tease the option of its allies pondering if it is worth or not letting China retake Taiwan.

TSMC's fabs in the US/Europe/China will allways be smaller ones or less advanced.

The SK Hynix with the recently announced $100B expansions will follow the same line, ensuring the large and continuous military presence of the US nearby against NK and China.

Raspberry Pi Foundation moves into microcontrollers with the $4 Pi Pico using homegrown silicon

Re: Annoyingly low on RAM

Well, I'd be *really impressed* if you managed to do any kind of modern and safe internet cryptography using only 256 bytes!

Re: No WiFi?

I personally use the ESP32 (WROOM32-like modules) since it has all of the above (except USB that is not needed) plus BT, more RAM, freeRTOS support, lots of GPIOs, PWMs, many ADCs, three HW serial interfaces, etc. and is not much more expensive. With very little in additional components you may also even get native (embedded PHY) Ethernet connectivity with very decent speed.

I've used the ESP8266 by the hundreds in the past, and now use the ESP32 by the thousands. My only concern is making sure I am in control of the freeRTOS and application binaries loaded, since I am not ready to rely on raw chinese OS FW.

Annoyingly low on RAM

264kB of RAM? Makes my life harder, lots of juggling needed to marry decent internet cryptography/security with the needs of my application code. 1MB would feel very spacious in comparison. Is it asking for 1MB RAM too much? ESP32 is better (520kB, but significant fraction used by the freeRTOS) but still limited. PSRAM does not count.

Attack of the cryptidiots: One wants Bitcoin-flush hard drive he threw out in 2013 back, the other lost USB stick password

Not a traditional USB drive

The ironkey is NOT like a traditional USB drive. Imaging the drive would yield nothing since traditional brute-forcing the encryption used would take a very long time even with plentiful computing resources. The actual decryption key is generated and stored inside the chip, and is based on locally-generated entropy as well as the user-supplied password.

If the user supplies a bad password too many times, all that the drive does is delete its own internal key, rendering the contents encrypted. Optionally it can also wipe the drive or even destroy it.

Therefore, if it was even possible to copy the image from one Ironkey to another new, not locked drive, it wouldn't work since the internal "random key" would be different.

The drive is also designed to be tamper-resistant making attempts of removing the chip for further analysis on external equipment quite risky.

What's that you got there, AMD? More Ryzen chips? Yeah, OK, we could do with some of those

Re: Am I the only one who is confused ...

AMD enabling even ECC single-bit-correction on their lowly consumer platforms is already a huge step forward!

Re: Intel...

That's why TSMC et al won't displace any of their customers with long term contracts or relocate any significant fab capacity on the most current nodes to Intel. Nor will TSMC commit to expand or build any new fabs to supply them.

They know Intel will turn its back on them as soon as they get their own processes running smoothly.

Under that pile of spare keys and obsolete cables is an IoT device: Samsung pushes useful retirement project for older phones

S8 and S9 old?

Only in Samsung's mind... I have in some drawer somewhere the following galaxies: S1, S3 (2x), S5, S7 and a S8 (almost destroyed). All of the other ones are in perfectly fine condition, only hopelessly obsolete.

Samsung could do the right thing and:

- Unlock their bootloaders

- Release the device's technical documentation

- Release source code for their kernel drivers, etc.

Allowing the community to create something really safe and useful with this old hardware.

Pizza and beer night out the window, hours trying to sort issue, then a fresh pair of eyes says 'See, the problem is...'

Re: ~/.procmailrc

Positive example restoring faith in humanity is Dell's Service Tags. Almost always easily readable and almost always in easy-to-see places.

Re: Doubtless with the assistance of a baseball bat peppered with rusty nails.

Had the unpleasant experience of pointing to an "network expert" that the thin coax cable that came from one computer went... to the same computer, thus explainig "why" it was offline. Remember the ancient thin coax networks with those small "T" pieces and coloured terminators...

Curiously somehow the two adjacent computer (on the same desk) were networking just fine, it just happened that in the rat's nest mess of cables behind them the coax from the first went directly to the third and the cable from the third went on to be connecting the middle one to itself.

Cats: Not a fan favourite when the critters are draped around an office packed with tech

Cat fur is not the only cat-produced thing that can damage computers!

Several years ago I had the worst possible experience involving cats and computer hardware. I had just bought a brand-new RX-480 GPU (very expensive at the time, specially in this backward part of the world I live in) and was enjoying the just-launched Fallout 4. The computer was assembled inside a not so well ventilated case and started showing signs of overheating during extended gaming sessions.

My first idea was to remove the cover of the computer and play with it open, and put it back again when finished. Everything went fine until it didn't.

My house is home to six cats and as any cat-owner knows, whenever a new cat is introduced there is a bit of territorial re-shuffling and infighting. The fifth and sixth cats were recently and suddenly introduced (I inherited them when my sister died) and they were still at this stage of their adaptation into their new home.

One night I forgot to close the computer's case... at some point in the night I hear the familiar sounds of cats hissing and fighting and as it stops rather quickly I do not bother to get up and end the fighting.

Next day I go to the computer to check emails and do other morning stuff and after moving the mouse, the familiar login screen does not come up. Computer locked up? After rebooting, the familiar "beep" but no video signal. Loose cable? I reach behind the computer and then I smell the very unmistakable odor of cat pee...

It just happened that during the previous night fights, one of my cats somehow lost bladder control and sprayed cat pee around the general area where the computer case was... And some of it landed just on top of the GPU's circuit board.

I tried everything I could to revive it... washing with DI water and putting it with a dessicant, drying under the sun, drying in the kitchen oven, etc. to no avail. The GPU was now an expensive paperweight and a bad one at it.

Miraculously, the rest of the computer was unaffected. Back to integrated graphics for some more time...

Of course I bought a new larger case with much better ventilation after that.

You *bang* will never *smash* humiliate me *whack* in front of *clang* the teen computer whizz *crunch* EVER AGAIN

Re: With great power comes great incompatibility

Nice museum...

...and my productivity goes down the drain...

Beware the fresh Windows XP install: Failure awaits you all with nasty, big, pointy teeth

Re: chewed wires

My parent's parrot had a nasty habit of chewing cables. Ethernet, speakers, mouse and keyboard, telephone, none was spared. Except for power cords. Never chewed on one, not even once. She is now 36 years old and still going strong.

C'mon SPARCky, it's just an admin utility update. What could possibly go wrong?

Blanket bans aren't healthy

Simply banning "something with a spindle" from being used in backups isn't a good practice. It's just a measure out of fear and misunderstanding.

I know, we get traumatised and scarred from past mistakes and disasters. Been there, done (and suffered) that.

Understanding each backup medium and realising its strengths and limitations and planning accordingly is much better!

I do not think this is your case since you've already stated following many other good practices, however once someone starts putting too much faith - without constant reasoning about "why" - in some well established procedure, disaster follows.

Starliner snafu could've been worse: Software errors plague Boeing's Calamity Capsule

Re: How things have changed...

First of all: Where are the sources beyond "I was around"? If true, there HAS to be written record somewhere?

1) Reaching a MTTF of 10 years is independent of whatever architecture you are using, from the software point of view. "Bug free" software (or 99,99x% bug-free software if you like) will run bug-free regardless of clock speed. Hardware is another history.

1a) Why are we using 3GHz processors anyway? The old shuttle-era processors did the work, why suddenly do we need 3000x more processing power? OK, it allows for more complex scenarios, and a lot of "quality-of-life" improvements, but at some great cost in terms of development/bugs.

2) And why is is bad? Or, in other words, what does error-prone "advanced" programming constructs gets you? Use them in non-critical places only, stick with tried-and-true "simple" programming where it matters.

3) Again, WHY do we need millions of LOC? Keep it the simplest possible. Less code, well designed, made, audited and tested relates (but no assurance) to less problems.

4) Source or I'll call it bogus. And let me tell you, if several tens of billions of dollars and several human lives are in play, so be it, productivity be damned, quality (functionality, performance, security among others) FIRST, productivity after.

Help! I'm trapped on Schrodinger's runaway train! Or am I..?

Hmmm cookies!

Most people:

Did I hear something about cookies? I like cookies! hmmm... yummy cookies!

...then they get all upset and enraged when the inevitable <insert your favourite nasty surprise caused by not being privacy conscious>...

...and suddenly it's all governments fault for not protecting the good citizens against evil Hax0rs.

Rinse-and-repeat.

Spanking the pirates of corporate security? Try a Plimsoll

Re: A decent backup strategy

What is preferrable:

a) Losing X hours of transactions and Y pounds and then coming back to business, vulnerabilities fixed, reputation (and ego) bruised, but alive.

or

b) Losing ALL hours of transactions (past and current), 100Y (or more) and possibly never coming back to business, everyone fired and your (company) name forever written in the hall of infamy. Also, not being allowed within 100 meters of a production datacentre.

Backups done right aren't a panacea for curing all security headaches, but for sure they're a damn good starting point.

Totally Subcontracted Business: TSB to outsource entire IT estate to IBM for a cool $1bn after 2019 meltdown

Trouble intensifies

Now TSB will have $2 billion less and the outages will continue.

Only the lawyers will prosper, as usual.