Posts by FILE_ID.DIZ

Why do bit barns keep bumping up our bills, Senators ask DC operators

Re: Confused

I'm not sure why you caught (at the time of this writing) the lone vote in a downward direction.

I think you have a great question. In my mind, asking these critical questions to the generators and transmission line operators instead could move the needle further. They are, after all, regulated monopolies and it should be easier to force them disclose operating agreements and contractual obligations and communications.

And to your last point about waiting for the AI bubble to burst... I too am sitting back and waiting. I've already pared back some of my tech stock holdings, just to take some profits before the end of the year. My question is how can the company OpenAI, with just $20 billion dollars in revenue (not profit) through November 2025, expect to float $1.4TRILLION dollars in capital projects over the next eight years.

Makes absolutely no damn sense. I really hope OpenAI goes like Webvan.

TP-Link accuses rival Netgear of 'smear campaign' over alleged China ties

Battle of the short buses?

I really don't know who to root for here.

I've always had a place in my heart for Netgear's "metal" switches. They're simple and just work and can be placed in very inhospitable locations without a second thought.

But routers/edge devices are much more complex pieces of kit (software-wise), regardless of the name on the outside of the box, be it Palo Alto, Fortinet, Cisco, TP-Link or Netgear.

TP-Link always seems to be in every other CISA email recently with critical vulnerabilities in no longer supported hardware. TP-Link, however, isn't alone here. It can't be expected that the software that drives the hardware can supported in perpetuity.

I recently had to bite the bullet and swap out some old Fortigate 50E routers I got super cheap on flebay a few years ago to play with HA at home with because they stopped with updates earlier this year (6.2.17 came out in June and it was supposed to be EoS) and I had to disable SSL-VPN because of concerns about unpatchable vulnerabilities on these old routers.

But something has to change in informing consumers on when their firewall/edge kit becomes unsupported with patches. I don't know what the solution looks like, but consumers need to understand that the internet router (regardless of the brand) they buy today has a planned obsolescence date. Perhaps a date needs to be published prominently on the outside of the box indicating when that device will become unsupported by the manufacturer, like a Best By date?

This way one could at least make a comparison between devices when purchasing model X versus model Y. If one model has a date only a year out and the other has a date five years out, might steer a decision. Similar to a chromebook? (Even though some dislike those expiry dates on Chromebooks too!)

Dunno.

Cloudflare broke itself – and a big chunk of the Internet – with a bad database query

Who watches the global kill switches?

As a consummate pessimist, eventually one might be concerned that all these additional "global kill switches" which future "important" code updates might require, alone become the next source of outages if discovered they are be easy to trigger, just like an actual fire alarm?

Complacency breeds.... something?

SonicWall breach hits every cloud backup customer after 5% claim goes up in smoke

Re: Silly Question

While I am no expert nor anything beyond a layperson - a big problem with config files like these is that the encryption has to be reversible. So, how do you do that at-scale?

A client-managed password is always a solid option. However I'm sure there's a non-zero number of SonicWall Cloud Backup users who wouldn't want to do that. Think about AWS S3 encryption-at-rest. I wonder what portion of companies use the server-managed encryption key vs using their own key?

So now the service provider has to manage the encryption key(s). KEK can be used here, but still at the end of the day, if the KEK key(s) is/are compromised, then everything encrypted by that DEK can be decrypted.

Basically it is hard to handle encryption safely at scale.

Texas senators cry foul over Smithsonian's pricey Space Shuttle shuffle

Re: Risks?

They probably declined the insurance option. I mean, who needs insurance as long as you're careful, AMIRITE? Insurance is for suckers and losers!

Re: Risks?

One Toyota Tundra was enough to pull Endeavour through some streets in LA a while back....

https://www.youtube.com/watch?v=26CtnvXKY3w

One token to pwn them all: Entra ID bug could have granted access to every tenant

Microsoft apparently gave the middle finger back to the US Government and CISA after the latter's dressing down of Microsoft from the 2023 Exchange Online breach.

But at least we have CoPilot... instead of a more secure Azure... I guess.

https://www.theregister.com/2024/04/03/cisa_microsoft_exchange_online_china_report/

German security researchers say 'Windows Hell No' to Microsoft biometrics for biz

Using Sysinternal's CoreInfo tool and a webpage from 2011 (yes, apparently 14 years ago if the date is trustworthy), you can check if your computer meets the requirements.

https://www.howtogeek.com/73318/how-to-check-if-your-cpu-supports-second-level-address-translation-slat/

Note: Do execute the correct bitness version of coreinfo.exe. Running the 32-bit version on a 64-bit OS fails to work.

Backblaze denies 'sham accounting' claims as short sellers circle

Re: :(

If a truthful narration and evidence take down a company, I'm not sure how that's manipulation.

Re: :(

Lordstown, while I didn't mention it in my original post, several persons involved were sanctioned by the SEC and paid monies while "not admitting fault" or some such, so it was pretty bad there too.

I believe that both companies would eventually met the same fate. But since we don't have time machines and time is linear, there's really no way to know if there could have been a different outcome.

Re: :(

As a shareholder, technically you're not obligated to loan your shares to a short seller. If you're so inclined, you can request certificates of your shares of a company. That'll prevent your broker from being able loan your shares. It'll also completely slow down the whole process of selling your shares if you need to do so urgently, so it comes with pitfalls.

And, as you say, if the short seller does shit on the listed company and expose a truly hollowed out shell of an entity for the world+dog to see, every shareholder who held those shares, including yourself, failed to take the required due diligence before investing and/or failed to continue in said due diligence in that company and that's going to be a reminder of at least three core principals of investing.

1) Never invest what you can't risk losing completely.

2) Understand what you're investing in, continuously.

3) Diversify, diversify, diversify

Let's say the obverse happens, taken to an extreme - not only did the short seller write a fraudulent report, but also violated SEC regs and/or other laws. The company responds with proof against all the questions that short seller wrote and steamroll them with your truthful responses and counterpoints and the short seller report writer is investigated for SEC violations and/or criminal conduct and is exposed for what they are.

The stock may take a little ding while the dust settles out quickly, but if you're in it for the long haul and you have a strong conviction in the traded entity, then you've got nothing to worry about.

At the end of the day, the market's forces correct themselves justly. It may hurt if you're on the wrong side of the ledger and weren't prepared for it.

Re: If it is true...

While I chuckled - those drives will be ridden hard and put away wet.

Unfortunately, it might give a lot of cover to those scammers who keep on unloading "New" Seagate EXO drives that really have upwards of 50K hours on them from that failed crypto Chia.

Read more here: https://www.tomshardware.com/pc-components/hdds/seagates-fraudulent-hard-drives-scandal-deepens-as-clues-point-at-chinese-chia-mining-farms

Re: :(

Full disclosures - I'm a happy consumer customer of BackBlaze and have been for probably a decade or a tad longer now. I am not a shareholder, at least not directly. (I don't know if any ETFs I have may own shares of them.)

Last question first, generally short sellers are aware of insider trading regulations and honest ones work with qualified counsel to ensure that their sources and methods used to acquire the information that they ultimately publish, don't fall under Insider Trading regs.

And yes - there are scum short sellers. Plenty of examples I'm sure. Unfortunately, I'm not as quick to recall shit hit jobs as fantastic exposes as I note next.

Nikola and Lordstown Motors immediately come to mind as of a short-seller doing the due diligence and knocking it out of the park with their respective reports. Both companies imploded some time after of a short seller's report and the CEO of Nikola was charged and convicted of crimes uncovered as part of a short seller's report. Interestingly he was recently pardoned by the easy peel tangerine.

In short, short sellers have a place in an efficient capital market - to keep the lairs and cheaters on their toes. Honest companies attacked by a misguided or worst short seller should survive an attack. Dishonest companies likely won't.

[0] https://www.ecfr.gov/current/title-17/chapter-II/part-240/subpart-A/subject-group-ECFRbda83517ce4377f/section-240.10b5-1

Datacenters selling power back to the grid? Don’t bet on it, say operators

Batteries? At Proper Datacenters?

The few datacenters that my company has stuff at - they don't use batteries to bridge the gap between utility power loss and the gensets taking over, they use flywheels instead.

They literally only store a couple of minutes of power, tops.

If my limited dataset is indicative of other datacenter designs, might be why this really hasn't gotten off the ground.

But who knows.

Privacy died last century, the only way to go is off-grid

Re: The pros have it.

Don't worry - Musk and DOGE has already visited NSA. They'll be winnowed down soon enough, like what's happening to SSA and Dept of Ed.

Free-software warriors celebrate landmark case that enforced GNU LGPL

Re: Stretching

I think you're conflating two different things.

The plaintiff (don't know what it's called in what'd be a US equivalent German civil courts) was missing required components so that they could update that LGPL-covered code to do what they wanted with that component's logging. Whether those changes were persistent across reboots or entered in manually via CLI after reboot doesn't have any bearing here.

The concern here was that uclibc's license requires where it is statically linked to an application, that that application be provided at a minimum as an object, so that, in the author's own words, "[t]his will (in theory) allow your customers to apply uClibc bug fixes to your application." [0]

Also, I am presuming that AVM statically linked the library in their application, since uclibc's license states, "[y]ou can distribute a closed source application which is linked with an unmodified uClibc shared library. In this case, you do not need to give away any source code for your application." [0]

As I stated previously - it was the prior decisions made by AVM here that forced their own hands before the Court, not the plaintiff.

[0] - https://uclibc.org/FAQ.html#licensing

Re: Stretching

It's great having access to the full stack and to be able to properly fiddle with the systems *but* I really can't see where the GPL/LGPL itself is responsible for granting the level of rights implied here.

Had AVM written code themselves to do whatever uClibc does (without violating uClibc's copyright), then Herr Steck would have had no standing to request AVM's code.

But because AVM advantaged themselves of someone else's work licensed under LGPL, they were obligated to adhere to its terms.

Crims backdoored the backdoors they supplied to other miscreants. Then the domains lapsed

Re: Don't get it

If the endpoint was already infected when the domain was valid but not detected, what makes you believe they're capable of finding failed connection attempts now.

I think that's a clear case of the former negating the latter

Akamai to quit its CDN in China, seemingly not due to trouble from Beijing

Re: Anyone else not buying into this?

Not that I know much about CDNs or whatnot, but my casual recollection of a smattering of NANOG maillist posts over the years seems to indicate to me that with the transition to all HTTPS for web content, CDN providers seem to feel really uncomfortable having their cache boxes outside of their physical care, custody and control since those devices are required to also store a copy of the TLS keys for all their customers loaded on any specific boxen.

That could be a reason. It could also be a completely wrong analysis and incorrect synthesis of incorrectly recalled impressions.

Now Trump's import tariffs could raise the cost of a laptop for Americans by 68%

Re: Replacing Imports

UNICOR is the trade name for Federal Prison Industries.

You can see all that Federal prisoners make here: https://www.unicor.gov/

The prices seem reasonably cheap on many items.

IPv6 may already be irrelevant – but so is moving off IPv4, argues APNIC's chief scientist

Re: phone numbers are easy

Compared to FE80:CD00:0000:0CDE:1257:0000:211E:729C? Or even FE80:CD00:0:CDE:1257:0:211E:729C??

Sure, DNS can fail.

However - a /64 should be what's assigned to a host. While that's not as short or easy to type as 192.0.2.2, (colons suck for the shift component - can't type with a single hand on a 10-digit number pad, for example) FE80:CD00::0CDE is all that you should need to locate a single host on a network if you're not assigning /128's like a numpkin.

Note:

(FE80 is a terrible example - in the real-world, that machine would have a /64 somewhere within 2000::/3)

Re: Opinions do differ

We should have also started serious work on IPv7 and IPv8 and IPv9. Iterative progress would have put us where we are at now 15 years ago.

We already had IPv7, IPv8 and IPv9 - June 1993, May 1994 and June 1992, respectively.. So those started around 30 years ago and longer. (Also, IPv5, but who's counting.)

https://www.rfc-editor.org/rfc/rfc1475.html (IPv7)

https://www.rfc-editor.org/rfc/rfc1621.html (Supplement to RFC 1475, so next in order? [The RFC doesn't directly refer to IPv8, just the merger of two minds, including IPv7.])

https://www.rfc-editor.org/rfc/rfc1347.html (Apparently another swing at the Heir-Apparent, IPv6, like the two above?)

https://www.iana.org/assignments/version-numbers/version-numbers.xhtml is the source.

Boeing's new captain promises U-turn after Q3 nosedive

Re: "...after Q3 nosedive..."

Maybe the bean counters were replaced with all the failed 737 MCAS units?

Parents take school to court after student punished for using AI

Re: School rules

Which is a sphere! Or spheroid, if they weren't so accurate in machining and manufacturing it.

I'll disagree with you on your second point.

When I was in college, I frequently used Wikipedia as what it is, an encyclopedia.

I could not cite an encyclopedia[0], because it is not a first-hand account. It is a third-hand account of first-hand information gathered, sorted and collated.

I frequently recall using it's citations to go to the source material, gather what I needed and cite that. It made easy work, at least for me, in finding first-hand information on some random topic which I hadn't been familiar with.

[0] - I haven't had to cite anything since college. I'm sure you can cite encyclopedias. My instructors' rules were that we could only use first-hand sources, which an encyclopedia is not.

Re: School rules

Schools aren't supposed to be self-cleaning ovens like the real-world can be.

Re: School rules

Well the article was written this way:

Students should "not use AI tools during in-class examinations, processed writing assignments, homework or classwork unless explicitly permitted and instructed," the policy states.

I presume that the quoted part is from the manual and the two words preceding and three words following it are the author's words.

Digging a bit more at the linked court filing (starting at PDF page 5), it states in an ordered list:

Students shall:

* Not use AI tools during in-class examinations, processed writing assignments, homework or classwork unless explicitly permitted and instructed. Blah blah blah....

* More points listed.

China’s infosec leads accuse Intel of NSA backdoor, cite chip security flaws

No shit sherlock...

major defects in product quality and security management show its extremely irresponsible attitude towards customers

Intel has many published vulnerabilities and other issues, both in hardware and in software. Between all the side-channel vulnerabilities and enclave vulnerabilities, one wonders if China's looking at this not through the lens of Hanlon's razor.

And speaking to "irresponsible attitude towards customers", one only has to look as far back as to the differences (if you can really find any) between 13th and 14th gen processors at the consumer level...

Would banning ransomware insurance stop the scourge?

What about China or Russia with respect to compromised companies?

While hacks and breaches are published far and wide from companies based in the US/Canada and Western Europe, what's going on with companies that are big in China or Russia with respect to their users and the like?

Is the lack of news because there are no breaches, or because it's not as well publicized here?

Not for the fact that misery likes company, but misery DOES like company.

Re: Cyber Insurance?

Without wading into whether cyber insurance specifically is valuable or a hindrance or an indirect facilitator in the furtherance of crime, let's discuss insurance in general.

So, first issue I'll point out is the assumption that the insurance company is exposed to open-ended costs. All policies have maximums, period. Maximums, per individual policy can vary, but is proportional to the policy's premium paid.

Tangentially, unlike a physical property insurance carrier as a counter-example, who may have hundreds or thousands of claims during a specific weather event over a specific geography (think tornado, severe hail storm, hurricane and the like), one cyber insurance claim likely has nothing to do with the next claim. Therefore, a single cyber insurance issuer is likely to experience a claims due to a single catastrophic event.

And while I'm no expert in insurance (or really anything), there's insurance for insurance companies, called reinsurance - further distributing the financial burden beyond the insurer. And beyond that, there's a whole bond market colloquially called "CAT" bonds, or Catastrophe Bonds that helps further distribute exposure from any event across even more entities.

At the end of the day, there's not too many insurance companies that go out of business (at least those that are well run - and that's not the topic of this response). That's because they know how to manage risk [0] and adjust their exposure and premiums appropriately.

[0] There's been a whole bunch of insurance companies who did property and casualty insurance over the past half-decade who have gone bankrupt. While I haven't dug into the specifics of any one company - I'd suspect that some of those failed insurance companies fell into the same rising interest rate trap that caught a few banks who failed during the same time frame. Insurance companies, if properly run, bank a crap ton portion of their money in various investments and other hedges against inflation.

Ryanair faces GDPR turbulence over customer ID checks

How'd you get back home?

Microsoft hits go on Windows 11 24H2: Fresh features, bugs, and a whole lotta AI

Re: plastic can melt

I was chatting with a colleague of mine earlier this week, wondering when this CoPilot shit would be added to Windows Server.

His position was a strong "never".

If that holds out, maybe my next Windows OS will be Windows Server if this CoPilot crap can't be avoided easily enough.

Bank of America app glitch zeroes out people's balances

Re: Cash is king

A few things -

First off, as some in Western North Carolina have recently discovered - having some cash on hand in your emergency kit, is useful. No power and/or no telecoms = no ATMs or working banks or debit/credit card machines at stores.

And an emergency doesn't always mean a catastrophic storm. A banking outage can qualify. Heck, ever since the Change Healthcare debacle earlier this year, I've made it a point to keep 7-10 days of prescription drugs that me and my better three-quarters depend on, have been put aside and rotated from time to time (for freshness), preparing for the next cyberattack that cripples that industry.

Secondly, I'm sure most people who complained about BoA's outages were people with DDAs (Demand Deposit Account) with BoA. DDAs don't generally pay interest, so second hole in your interest-stealing cat thief.

Third, looking at NOW accounts at BoA, they pay a paltry interest, even in today's high(er) interest rates. In my area, they're currently paying between 0.01% APY and 0.04% APY, depending on the Preferred Rewards Tier with Interest Rate Booster, whatever that means. So, third hole - BoA doesn't really reward you for keeping your extremely liquid funds with them anyways, so what's a few hundreds dollars in a safe or dresser drawer or even under your mattress actually losing?

And for those with more liquidity - there's better places than a DDA or NOW account to keep it, but that'd make the money a bit harder to get at in a moment's notice.

This is not financial advice.

Boeing's Starliner set for extended stay at the ISS as engineers on Earth try to recreate thruster issues

Re: In a nutshell..

It's always pilot error at the end, isn't it? :)

Advance Auto Parts: 2.3M people's data accessed when crims broke into our Snowflake account

Re: WHY, in deity's name does an autoparts store require

Well, it was explained elsewhere in the article, "The general version mentioned that the data accessed by the criminals was gathered and stored as part of the company's job application process..."

So, yes - the collection of SSN numbers would be part of a job application's data acquisition task.

And because their employees may do deliveries to local repair shops, storing drivers license data also makes sense.

The fact that they stored many multiples of people's data than they currently employ is possibly concerning. But I don't know record retention laws or regulations may require post-separation, both with respect to IRS (SSN) or any traffic-related civil or criminal suits (DL) and I don't know what their employee turn-over rate is. I mean, if they hire and separate from 20K people every three months, having a few million over the course of several years seems reasonable.

But - most likely, this company simply didn't know the breadth of all the data that they were storing.

You also bring up a good point with respect to returns and drivers licenses - I don't know about Best Buy specifically, but I know that there are third-party companies that do provide such fraud checks. Whether or not that data is domiciled with Best Buy or with that third-party entity, couldn't tell you.

You can always refuse to have them scan in your drivers license. Just say you don't have one. Purchasing from their store wasn't conditioned on having one, returning can't either. (FYI, IANAL, YMMV.) Or just return it online - no DL needed that way.

ViperSoftX variant spotted abusing .NET runtime to disguise data theft

I think the point being made here is that regular powershell auditing and logging that enterprises do by sifting continuously through PS Module Logging, PS Script Block Logging and PS Transcription data streams could be thwarted with this technique.

Tesla shareholders agree to pay Musk staggering sum of $48B

Re: Pay the workers better?

Sorta.

First off, the $56 billion is paper money. That's why it's worth only $48 billion now.

Secondly, it's value is derived solely from the price of a share of TSLA.

Thirdly, in order for Musk to convert that paper money to real money, he's going to have to find literally billions of dollars from other investors who want to buy his shares at the time he divests. Given the enormous quantity of shares he has, any considerable selling off his shares will cause the price to drop in a very noticeable way. (It happened when he sold a ton of TSLA to get cash to buy Twitter, for example.)

Finally, a company's share price - or the sum of the total or fraction thereof of shares - has no direct effect on the company's books, except when that company chooses to issue more shares or buys back shares. The value of a company from the lens of it's stock price is the value that investors give it. No more and no less. It (seemingly and more rarely in a general sense) has little bearing of the company's actual value creation.

Your last statement can only be true for employees (former or otherwise) who own shares of TSLA AND voted to give Musk that massive traunch of stock.

Re: The occupants of the deck cabins will quietly assemble at the lifeboats.

In a few words, many institutional investors can't divest Tesla because TSLA is part of the S&P 500 index and if you're going to have ETFs that track S&P 500, then you're going to need to keep TSLA around.

Sorry.

US watchdog chases Waymo robocars to catch violations

Re: Oh got to love US tech bros

Or even deal with this thing called "weather".

They're operating in some of the most weather-less cities in the US; Phoenix, San Francisco, Los Angeles.

Numpkins.

Ex-Space Shuttle boss corrects the record on Hubble upgrade mission

Probably because Freon is sold and measured by weight... pV=nRT and all.

Throwflame launches fire-spitting robo-dog from Hell

If COVID and its lockdowns taught us anything about billionairs' survival plans, it's not in 'Murica but in New Zealand.

I don't know if that terror-beast would be allowed there.

https://www.seattletimes.com/nation-world/rich-americans-activate-new-zealand-pandemic-escape-plans/

Now all Windows 11 users are getting adverts to 'make the Start menu great again'

I prefer O&O's Shutup10 (also works for 11, but they've kept the name the same) to keep me up-to-date on Microsoft's shenanigans of resetting settings' choices and when adding and splitting settings from time to time. Oh, and all the bullshit in Edge too.

https://www.oo-software.com/shutup10

I usually run it on the middle setting (yellow) and haven't found it to break anything I've noticed.

Waymo robotaxi drives down wrong side of street after being alarmed by unicyclists

Good question.

Interestingly, there was an article in The Register (https://www.theregister.com/2024/02/14/waymo_files_recall_after_pheonix/) where two Waymo cars hit the same cock-eyed towed vehicle behind a tow truck within minutes of each other because the software responded identically to the input stimulus. (Makes sense, if you think about it.)

I'd say they're all identical and therefore should all be considered a single driver. A software update is like remediation and/or additional court-required training.

Accumulate enough infractions however, or abuse/use all your ways to shed points and you're off the road until those infractions reset on whatever time-scale and/or court visits a regular meatbag might require.

Unless and until the congress critters (likely local governments and/or state governments) choose to change the laws for robots and until then, the robots are no different than the meatbags, in the eyes of the law.

https://old.reddit.com/r/SelfDrivingCars/comments/1ca1z8m/longer_video_of_the_wrong_way_incident/ works for me.

But yes, something's up with the www version linked.

Edit: The link in the article is fine. For me, it seems to be related to NoScript in nuke mode on my machine. Probably why the old.reddit.com works, since that's an older format/code and probably doesn't have all the bullshit code and requirements that www.reddit.com has.

Thanks for pointing out that video Cornetman. I bypassed it on the first read. Have a thumbs up!

Seeing that video and re-reading this article after seeing the video, the article only mentioned "a half minute". That doesn't do justice to just how severe of a traffic infraction and dangerous situation that robot created. From my count (and I'm not from the area), it looked like it traveled in the on-coming lane for nearly two full blocks.

And Waymo's explanation is bullshit. That's not "passing" an obstruction by any stretch of the imagination.

WayMoreFailure here.

Digital Realty wants to turn Irish datacenters into grid-stabilizing power jugglers

The few datacenters that I'm familiar with (eg: have stuff in cages) use rotary UPS instead of batteries of any chemistry.

Batteries have maintenance demands and can leak or off-gas hydrogen which burns basically clear if you don't have sensors to detect hydrogen buildup.

The few data points that I have doesn't make a trend, but there seems to be plenty of datacenters which either fall over due to poor UPS maintenance and/or battery hold time wasn't as expected or the/a UPS might have been the cause or the chemical accelerant for a fire, like OVH in France.

Edit: That's not to say that rotary UPSs also don't have maintenance. But at least you're not pitching tons of batteries every few years if you're not doing some type of wet battery that have life-spans that can reach 20 years, iirc.