Posts by dafe

Tax inspectors raid Huawei offices

So far, Huawei is only being investigated for tax fraud. That doesn't mean they actually committed tax fraud. India has a huge problem with tax dodgers in general, most of whom are Indian, so they may as well investigate the Chinese as well, why not.

Excluding Huawei from the 5G rollout does seem discriminatory to me.

Your idea of reciprocal business practices seems like a recipe for war. It seems fair and everything, but only if you ignore that not all macro-economies are equal. The West already doesn't allow investment in China, which is quite alright with China. Now imagine Jack Ma being forced to buy Amazon because if reciprocity.

Red Hat signals Intel's software-defined silicon will debut in Linux 5.18

Re: Not keen..

You're not wrong.

Russian 'Minecraft bomb plot' teen jailed for five years

Re: Checks calendar, nope, not 1st April

First off, Russia today is not the Soviet Union, which hasn't existed for 30 years.

Second of all, Minecraft is not illegal in Russia. Blowing up government buildings without a licence is. And intent matters in legal matters.

Third: Do those anti-Soviet games come with instructions for how to build pipe bombs? If so, awesome. And a bit scary.

This malware gang plants incriminating evidence on PCs, gets victims arrested

Re: "malicious Microsoft Office attachments"

Both.

File extensions are unnecessary, but file names should be displayed in full. The suffixes, if they are there, shouldn't even be called extensions.

Geomagnetic storm takes out 40 of 49 brand new Starlink satellites

Re: At least they're not additional, long-lasting space garbage

They burn up on re-entry.

To err is human. To really tmux things up requires an engineer

Re: Step outside

In many window managers, including kwin, the close button can be put in the top left corner where it belongs.

Suspected Chinese spies break into cloud accounts of News Corp journalists

So now it is no longer "Russian hackers", now it is "Chinese spies", whenever some script kiddies find an NSA backdoor.

I can only guess that the change is because Kaspersky have given a reason recently to say "if we are going to be blamed anyway".

12-year-old revives Unity desktop, develops software repo client, builds gaming environment for Ubuntu...

Re: Your reporter was very fond of Unity

Personally I like OpenBSD better, but Linux has the largest selection of hardware drivers. FreeBSD is an acceptable compromise.

Remote code execution vulnerability in Samba due to macOS interop module

Re: CIFS?

Is it a holy war? Or is it inertia?

Execs keep flinging money at us instead of understanding security, moan infosec pros

Liquidating BitCoins to pay off drive-by ransomware incurs a substantial opportunity cost. Throwing money at redundant arrays of inexpensive disks solves that problem at a fraction of the cost. Especially if the RAID is in The Cloud.

OpSec? That's in Morocco, isn't it?

Google's DeepMind says its AI coding bot is 'competitive' with humans

I'm thinking it is solving the wrong problem

It can generate Python code from English, and that is nothing short of impressive. It is trained by test cases, which is how software development is ideally but rarely done.

What it does not do is devise a domain specific language to describe the problem in. Nor does it look for the most elegant existing tools to solve a problem. Instead, it makes the same mistake most novice programmers make: It creates a monolithic block of code that does everything in one process in the one language it knows. Not reusable, not maintainable, not provable, and not necessarily correct.

And that seems to be by design. AlphaCode is artificially hacking together one file by increments. It is incapable of solving the more general case, then applying the solution to the specific case. Any tool it writes can't be reused or repurposed.

Re: The problem with this approach

So the AI is already at the level of web developer. That's progress.

Trio of Rust Core Team members take their leave

Re: Fashions

Edsgar Dijkstra of 'Goto Considered Harmful" fame (and more importantly less famous for Dijkstra complexity, the Dijkstra algorithm, and his proof that recursions can be compiled into loops) said that it is almost impossible to teach someone how to write good code who had previously been exposed to BASIC.

Maybe that's why?

Internet Society condemns UK's Online Safety Bill for demonising encryption using 'think of the children' tactic

Re: Criminals will continue to crime...

I'd go further.

Without E2EE, criminals will have access to all of the files that the police and MI have compiled on everyone.

Re: Think of the poor NSA/GCHQ

You are confused about AI and BMI.

I wouldn't mind being able to connect to the internet with my mind. I would mind if that connection wasn't encrypted.

AI is just a different way of programming. Instead of writing a function that maps the input to the output, use a function that finds a heuristic from example input-output pairs.

BMIs may require AIs to work, but they are not the same thing or in the same category.

And neither endanger human rights, they may even help protect them. People might use technology for nefarious purposes, like drunk driving, but they would get drunk even without technology.

Re: If THEY have nothing to hide

I did that once. I was told "that's what privacy is for."

Those who say that they have nothing to hide believe that they have hidden everything already.

Re: Lazy

Without E2EE, everyone will be able to trawl through police records and change communications about ongoing investigations.

Surely that is what the police want.

Apple Mac sales break records amid ex-86-odus to Arm-compatible M1 silicon

Re: I don't understand the draw of windows....

With Chocolatey there is a package manager for Windows. It makes finding and downloading tarballs simpler, but underneath it's still Windows, with the registry and all.

Imagination GPU cleared for RISC-V CPU compatibility, licensed to chip designers

Re: I'm curious

Those doing the R&D are being paid by the companies they work for.

It's the companies that need to recoup the costs, and in companies, the cost of R&D is part of the product costs.

It used to be that when you bought an electric device, you also got the schematics for it. This is no longer the case, but obviously opening the source to paying customers was not a problem back then either.

Quite a bit of the R in R&D is done at universities, or subsidised by governments in other ways. Arguably that should be available to the public anyway.

A very valuable part of doing R&D is building the expertise associated with the resulting product. If you encounter a problem, or want to build on a product, who better to ask than those who developed it? And that consulting is also time that is paid for by B2B customers. Sharing the schematics only makes that easier.

Alert: Let's Encrypt to revoke about 2 million HTTPS certificates in two days

Let's cert pin

I didn't know that OIDs are used for anything other than SNMP.

Why isn't certificate pinning the default? Why can't I use my old self-signed certificate to sign my new self-signed certificate? There is no technical reason, it is just not part of X.500. Is it because CAs are an important backdoor that certificate pinning would close?

Or is trust on first use (which most people do all the time with SSH) perceived as the bigger threat? That doesn't explain why Apple's app store doesn't allow it for user apps though.

Toaster-friendly alternative web protocol Gemini attracts criticism for becoming exclusive clique

Re: simple websites

What I like about Gemini as a protocol is that the headers do not contain more data than the actual content.

The header overhead is the problem that SPDY, now HTTP/2, was supposed to solve by compressing the headers into binary representations (not completely unlike MQTT aliases) and reusing those between multiplexed channels, thus introducing several new classes of potential bugs while reducing debuggability.

HTML in all its gory is still usable with Gemini. The proposed replacement hypertext markup is simple, but also inflexible. I'd rather use CommonMark instead. I very much like the idea that presentation is up to the user. In case the author wants control over fonts and colours, then DVI and PDF are better formats anyway – unlike HTML, they distinguish between the spacing between words and sentences.

Linux distros haunted by Polkit-geist for 12+ years: Bug grants root access to any user

Re: Eyes

I think there was a baby in that bathwater.

Re: Polkit

Polkit is not a mitigation of user and group based capabilities.

It completely by-passes that system for the purpose of privilege escalation, and while the filters can be as fine-grained as any setuid command, Ulrike sudoers polkit's always run as root. It's a root-kit.

Re: Why do you broadcast this for ?

Those who want to fuck up your system already know from the CVS or had the exploit ready for over twelve years.

Those whose system might get fucked up by this probably don't subscribe to the CVS.

Behold! The first line of defence for 25% of the US nuclear stockpile: Dolphins

Re: 2,500 doses of deterrent sitting in Puget Sound

Nuclear bombs are not nitroglycerin. An earthquake will bury them, not trigger them.

So, fingers crossed that the nuclear disarmament will proceed ahead of schedule.