* Posts by Daniel B.

3134 publicly visible posts • joined 12 Oct 2007

Google+ GOING, GOING ... ? Newbie Gmailers no longer forced into mandatory ID slurp

Daniel B.

They should just get it

They can be big in a lot of areas. They don't need to be big in everything, and especially in the social media stuff they don't really need to be dominant in that. They might get more success if they allow people to hold on to their nicknames instead of pulling a Facebook and forcing everyone to use their real names. Sure, the whole "social media" stuff is a moneymaker because of the data slurp, but in this area Google doesn't really need to make money, they can simply hang the social media stuff on their servers which do other stuff that does give Google revenue, and keep users' privacy intact.

Come on Google, you can do it. You're already doing ads on GMail, you don't need to slurp ID data!

Got your NUDE SELFIES in the cloud? Two-factor auth's your best bet for securing them

Daniel B.
Boffin

2FA is good, but...

I think that 2FA is missing the point here. What should really be done is to have the uploaded files encrypted client-side, then uploaded, and have your crypto key stay with you.

Daniel B.
Boffin

Re: So we'll all have

a keyring with dozens of TFA token generators to carry around.

I can see the improvement already.

I carry *four* keyfobs. Each bank gives me one, so I have four of 'em. I'd rather carry those than have some numbnuts sweep my bank accounts clean.

Your chance to win the world's only handheld ZX Spectrum

Daniel B.

Re: As a former VZ200 owner (yes, a refugee from the antipodes)

Heh. The lowest RAM I've ever had to monkey around has been 64k. Though I still get to amaze the young'uns with my uber-short 14-byte "Hello World!$" program. Arrrrr!

Microsoft buys Minecraft for $2.5bn. Notch: I'm getting the block outta here

Daniel B.

Re: Two wrongs make right?

If MS targets "something other than Java", it'll be .NET which isn't an improvement at all. The only thing achieved will be MS lock-in.

Daniel B.
Boffin

0x10c

Well, the 0x10c project seems to be an interesting project. It'll be nice to see that one prosper now that Notch has much more free time.

Blood-crazed Microsoft axes Trustworthy Computing Group

Daniel B.

Good news

Windows will lose the little security confidence it gained with the TwC division and more companies will actually switch away from Windows on the Datacenter, or halt any future migrations to Windows.

Oh, you were expecting good news for Microsoft? Nope, not with this. This news, combined with the killing of Nokia X means that Satya is keeping Ballmer's "strategy": pushing down the yoke for the MS plane to crash in the most spectacular manner!

Infosec geniuses hack a Canon PRINTER and install DOOM

Daniel B.

Re: I want to know

idbeholdl

For those dark levels, like Phobos Lab...

Daniel B.

Re: Shodan?

With all ethical constraints removed, SHODAN re-examines... re-ex... re-re-re... I re-examine my priorities, and draw new conclusions. The hacker's work is finished, but mine is only just be-be-be-beginning.

The laser printers are just the beginning...

Daniel B.

Re: Almost as cool as the HP printer hack

lp0 on fire, practical example?

Daniel B.

Re: Oh The Fun To Be Had

I was thinking something similar; hey this looks like something out of a BOFH episode.

Huawei ditches new Windows Phone mobe plans, blames poor sales

Daniel B.

MS shilltrolls detected

Oh dear, is MS this worried now? The shills are out in full force *and* manage to get first comment thread.

Announcements from OEMs are just that, just like MS's announcement that they would keep the Nokia X initiative.

Truth is, nobody wants Windows on their phones. Elop managed to shit on Nokia's phone division and MS is going to finish the job. At least the rest of Nokia managed to survive, unlike other companies burned by MS (Palm, Sendo).

Microsoft's rumoured $2.5bn Minecraft gobble expected on Monday

Daniel B.

Oh please no

MS would probably kill Minecraft as it currently exists. It is multiplatform and runs on Java, and it's available on most consoles. I'd guess they'd kill the PS3/4 versions, then proceed to port it to C# for extra suckage and Windows lock-in. Hopefully it won't happen.

2016: Robo-butlers, flying cars, and Google's internet Terminators hunting SHA-1 SSL certs

Daniel B.
Boffin

SHA1?

I'm more concerned by sites that still allow handshaking with the "EXPORT" cipher suite. The one that most countries outside of the US were stuck with because of the braindead export restrictions on crypto that were in place before 2000. Also, 3DES because it still uses DES which has been cracked for a long time. It's only a matter of time for it to be thoroughly cracked.

Net neutrality protestors slam the brakes on their OWN websites

Daniel B.

Re: Get it right

Subscribers are paying ISPs for the upload/download pipe the ISP needs to reach the greater internet. Netflix pays the phat pipes they have on their end to be able to stream data. If an ISP can't cope with 100% usage of the bandwidth they are charging their customers for they should either jack up their prices or invest on upgrading their infrastructure.

Daniel B.
Boffin

Re: Cretins.

The telcos/providers have always offered differing levels of service based on price.

Yes, and they can remain doing so with net neutrality. There's no reason for them to oppose this as they are already charging differing levels of service. Ending net-neutrality will actually allow them to double-dip on those "levels of service".

Competition between the telcos/providers has ensured the growth of the Internet and services to the public just fine,

Large swaths of the US are stuck with only one broadband provider. I still remember my dad suffering from Time Warner Cable's "only 1 PC per cablemodem" policy because it was either that or dialup.

any company trying to offer an unrealistically throttled service has simply lost customers as they went elsewhere.

Comcast didn't lose any clients over their lousy RST packet forging scheme. They stopped doing it not because their consumers got mad, but because the FCC gave them a slap on the wrist. Too bad the new FCC dude is a telco shill.

Phishing miscreants THWART securo-sleuths with AES-256 crypto

Daniel B.

Re: Isn't this pretty much straightforward?

So you're caught in a dilemma. Don't run JS and you can't decipher the text (sure it uses AES now, but what if uses a multi-stage system in future so you can't do it yourself offline), run it and you risk getting nailed with a hidden zero-day.

Or the third option: simply tag any site that isn't readable without JS as phishing. It's pretty obvious that this is only the result of phishing schemes or crappy web developers.

I remember that a couple of years ago (5? 6? 8?) a lot of spam was getting through most spam filters. The trick spammers were using was to set up a series of div tags that when rendered would show the spam email. But reading the text would give out an undecipherable thing that looked like "a b d i s c o e l s" or something like that. The solution? Anything unreadable with a zillion div tags would get filtered out. Problem solved!

Daniel B.
Boffin

Isn't this pretty much straightforward?

It's done in a crappy language (JavaScript) that has to run client-side. Therefore, the key will always have to be embedded in the code, or at least retrievable by the browser to decrypt the scam stuff. Therefore, security screeners need only to run the JS code and read the resulting stuff; if it is phishing, kill it. Is this really that hard? Alternatively, shitlist any site that looks like garbage without JS.

Crypto is a good way to securely transmit data from A to B. It's a poor way to have A show B information but have B unable to copy around the resulting data or trying to avoid B reading the actual key. See all the continuously cracked DRM systems as an example.

Mozilla certification revocation: 107,000 websites sunk by untrusted torpedo

Daniel B.

Re: In a few years time ...

RSA's cracking difficulty grows exponentially instead of being linear. Just to put it in perspective, 512-bit RSA was cracked in 1999. The largest RSA number cracked from the RSA challenge has been 704 bits long, and that was in 2012. Ok, 768-bit challenge was factored in 2009. But many of these efforts have been running non-stop for God knows how many months. Or years. Up until now, nobody has been able to factor 1024-bit RSA numbers, even though it is possible that cracking 1024-bit keys will be possible in the near future. But 2048? Unless something better than the quadratic sieve is discovered, or quantum computing actually takes off, it's still a long way down the road.

Daniel B.
Alert

Re: No Excuse

Unless of course you already forked out for a 3 or 5 year certificate….

Having worked at a certain financial institution that had this very issue, I can vouch for Verisign that signing a new 2048-bit request for the remainder of your purchased term is free of charge.

And I'd also note that this requirement issue was tackled by said bank back in 2011. VeriSign would not sign any 1024-bit cert with a validity beyond 2012. What kind of CA has been signing certs with expiration dates beyond 2012?

Zuck: Yo, Mexico! My $19bn WhatsApp could connect THREE BEEELLION people

Daniel B.

Mexico's internet penetration is larger than it seems

The Mexican Congress tried to slip a mickey a couple of months ago, implementing wide-scale internet censorship "for national security purposes". During that time, there were many debates on why this wasn't an issue, or why it was an issue. The main thing is that we have simultaneously a low internet penetration % in residential homes, and a high internet penetration % in total number of users. Why? Because those who don't have the money to pay for broadband or even dialup, or lack a computer, can go to a cybercafé and get online. Thus, while OECD number show 20% penetration, it is closer to 60%; if you narrow your sample group to urban areas, it will be even higher.

Shareholders throw the book at Apple for ebook price-fix drama

Daniel B.

Not that they don't deserve it

But the real culprit in the e-book price fixing scandal would be the late Steve Jobs. He's the one that engaged in this scheme of corporate "vigilantism" and dragged the company he presided into it. Tim Cook, at least, is probably not as guilty in the whole thing.

Then again, maybe this will deter Apple from trying to pull such a scheme in the future. I'm only sad that the publishers didn't get punished as they deserved.

Work in the tech industry? The Ukraine WAR is coming to YOU

Daniel B.
Facepalm

Re: Morals, ethics, principles...

Quite. A friend in a neighbouring state was telling me last year that the protesters were paid $50 a day - dollars, not euro or roubles - to keep the protests going.

See, this hits home. I've heard these arguments being passed on in my own country back in 2006. Barring the "paid in USD" stuff, most of the things said about protesters were the same. We were paid daily to keep the protests going. Said protests were calling for a recount, as some of the polling station numbers weren't matching what was being counted in the central system, and the candidate that had been most likely to win had lost by a 0.56% margin.

My country's Mexico.

The sad part of this story is that the same people who were protesting back then are drinking the Russian kool-aid this time because of the anti-US sentiment that permeates most left-leaning people (not like it is unwarranted. The US has been a really bad boy in most of Latin America.) Ukraine's Yankunovich could easily be equated with our own current president Peña-Nieto, down to the "evil party gets back into power" and "selling our asses out to [Russia/The US]".

Go ask actual Ukranians on the situation. Chances are they're angry at both Russian and US/EU intervention and would very much like to be left alone. Some of the people who participated or supported the Maidan protests were former Spetsnaz and Afghanistan vets. Do you really think those guys would support "fascists" like the Russian media likes to brand all protesters?

'Sony and Twitch' hacking crew Lizard Squad: 'We quit'

Daniel B.

Re: Crapping their nappies.

Actually, they did take out MS as well:

http://www.theregister.co.uk/2014/08/25/sony_says_playstation_network_is_back_up_and_running_no_data_lost/

Neither PSN or XBL were fully taken down, but they did cause grief to many players. PSN had already a scheduled maintenance downtime, so they just pushed the downtime window early. On XBL I do remember seeing the warnings showing that you might have trouble connecting to XBL, though some other services were OK.

Community chest: Storage firms need to pay open-source debts

Daniel B.

Re: Real coding!

ZFS + CIFS/NFSv4 should be good enough. (i.e Nexenta and they do support it).

This has been the closest I've seen to this. I would actually like ZFS support on every OS, but it seems it also crashes against the Windows barrier. I've been able to use ZFS as a multi-platform filesystem between OSX, Linux and Solaris though.

I still would like a secure version of a NAS protocol. I don't think "routing over http" is an issue anyway, as most of these services are usually needed within an organization (thus everything's inside the corporate network) or within a home office (same thing, no firewall problems).

What's the real barrier against someone doing their own filesystem driver? Is this actually closed off by MS legalese? There are (expensive) suites that let your Windows box read/write HFS+ partitions, so it shouldn't be that much of a problem, should it?

Daniel B.

Real coding!

As I keep telling the young-'uns - if you're a qualified Samba coder I can get you a job tomorrow (many postitions in Silicon Valley). But they keep wanting to do the webby stuff... :-(.

TBH, I would rather be coding real stuff (C/C++) rather than these baby scripting languages everyone seems to be hot about (JavaScript, Ruby, Python) and webby stuff like AJAX. I've managed to stay on Java at least and doing mostly back-end stuff, leaving the front-end things to the javascript kiddies.

However, I'd love to see something better than Samba come out, something that was both multi-platform (Linux, Unix, OSX, Windows) and have the advantages of, say, NFS without having proprietary "security" like SMB (which depends on some MS protocols). Why can't we have something like that?

Feds salute plucky human ROBOT-FIGHTERS

Daniel B.
Alert

You haven't been robocalled, ever? Some of these guys are extremely sneaky. I once got a call offering something free, blah blah, and suddenly they ask to confirm my personal info. Turns out that confirming your personal info is somehow warped into "accepting their service", and that's how I got rammed with a useless life insurance product or something like that. I got stuck with that for 2 years, and the only way I got out of it was by defaulting on my credit card, negotiating a "pay less than full balance, cancel my card" so that the card was forcibly cancelled and thus the scammers were no longer able to charge my now-dead CC.

The only saving throw you have against these guys is to hang up on them. It's the only way to be sure. Once you speak, you might as well have given them a copy of your CC to charge you a new yacht.

Sony's 'Lizard Squad' battered PlayStation Network staggers to feet

Daniel B.
Facepalm

Re: Probably about time

You're an idiot to want second hand games locked down.

You n33d to l34rn to r34d. What "push anti-secondhand DRM on their nextgen console" means es exactly that, the MS boneheaded decision to implement said anti-secondhand DRM. While they did do good on doing a U-turn on that decision, they did so after E3, and after they got curbstomped by Sony. And they had already lost at some exclusives which switched to "timed exclusives" instead of actual exclusives, like Plants vs. Zombies Garden Warfare.

So even though they backtracked on their stupid DRM decision, they still deserve to fail for even attempting to do that. That's what I meant with the unforgivable sin. The video games market must get the message: pulling such a stunt is a career-ending mistake.

Daniel B.

Re: Probably about time

As much as I dislike Sony's acting on both the rootkit fiasco and the OtherOS removal … I dislike MS more on their boneheaded decision to push anti-secondhand DRM on their nextgen console. I actually consider that more of an unforgivable sin.

GitHub.io killed the distro star: Why are people so bored with the top Linux makers?

Daniel B.

Re: If the rise in GitHub means....

The death of stupid crap like *.rpm, *.deb, and stupid per Distro crap like apt, and yum, and replaces it with something both simple, and universal.

Actually, it's reversing the trend. RPM and DEB are package managers that simplify software installation/upgrading in the corresponding distros, while yum/apt-get go a step further by downloading them automatically from established repositories. Before the package managers, we had to get tarballs and compile 'em all. GitHub is actually the same thing, except instead of downloading a tarball, you're actually pulling down an uncompressed copy of the whole frickin' repository, branches and all (because git is shit and does that instead of SVN/CVS where all the extra repo stuff stays on the server). So it is actually worse than just downloading a tarball, or even doing "svn co" on the sourceforge repo.

I've been mostly sticking to svn repos for FOSS stuff, as sometimes I do have to compile from source when handling obscure distros or when I want the latest update for certain packages. I'm mildly annoyed by the git-craze in the FOSS community...

Daniel B.

Re: You may not want to read this

Hostility towards n00bs, coupled with "if you gonna do FOSS U should know how 2 compile j00r k3rn3l d00d!" is one of the things that have indeed pushed back widespread adoption of the revered Linux Desktop. It also doesn't help that many of these "n00bs" were asking questions back in the late 90's or early 2000's and were simply shrugged away back then. Anyone remember trying to get one of those infamous winmodems to work on Linux? And what would you get as an answer if you ever had the great idea of asking about this?

One thing that has got better these days is that most distros Just Work out of the box, even with the newer annoying stuff like EFI and Secure Boot (urrrrgh). Now the problem seems to be that there's too much stuff out there. Sound system? ALSA! ESOUND! PULSEAUDIO! Everyone trying to pull off their own half-assed implementation of something that should've been standardized 15 years ago. Then there's the kernel devs that seem to be purposefully breaking ABIs just to annoy proprietary driver devs because fuck proprietary drivers. I still remember the dark days of the early 2000s when we didn't even get proprietary drivers for anything on Linux, and I do not wish to go back to that. Please STOP it. Play nice.

Hopefully, the Linux community may have gone past the RTFM stage, coupled with most distros mostly working without extra tweaks, so maybe Linux uptake will be better during the next years. I've had at least one colleague who gave up on Linux a couple of years ago come back to the Penguin OS after finding out that most of the annoying hacks are no longer needed: WiFi works OK out of the box.

Daniel B.
Boffin

GPL

Ah yes, the GPL. Even the Linux kernel code ended up staying on GPL v2 because the latest incarnation of the GPL ended up being very toxic. There's one thing in wanting to have free software, but another one to force that "freedom" into everything even slightly related to free software code. Hell, LGPL had to be created just to ensure that linking to FOSS libraries doesn't mean the GPL has stuck to your code!

Now, don't get me wrong, we need radical people like Stallman; if it hadn't been for the Free Software folks we wouldn't even have the stuff we have now, but the GPL should really be toned down.

Daniel B.

@boltar

No offence, but Python, javascript, ruby and similar scripting languages are training languages. They're the 21st century equivalent of QuickBasic.

YES. YES. YES. There's a lot of "do it with JavaScript" oriented people that are turning out to be very annoying; anything done in JavaScript will only run client-side and is a security vuln waiting to happen unless you're checking everything server-side as well. Pretty much the only thing I see good with the "cool" scripting languages is that they aren't Visual Basic.

Daniel B.
Trollface

Re: Crawling in my skin, these bugs they will not go away.

MS shills are now hiding behind AC. It seems they noticed that using their real handles gives them away, it's probably why I haven't seen TheVogon posts as of late. Though there's still one MS shill posting with his handle...

I’ve never paid for it in my life... we are talking Wi-Fi, right?

Daniel B.

Re: must be a Europe thing?

My experience has been quite different. US airports have free Wi-Fi, only showing a ToS page to click through and you're in. US hotels, however, love to charge for the privilege of having *any* kind of internet access in your room. Even Ethernet/wired. And they charge per device!

Claim: Microsoft Alt-F4'd Chilean government open-source install bid

Daniel B.

Not surprised

MS also went in back in 2000 when then-new President Fox was eyeing FOSS for the Mexican Federal Government. Suddenly a lot of cash changed hands, and magically everything went for the Microsoap platform. However, Chile just went back to the left-leaning party, I do wonder why did they let this proposal die?

Galileo, Galileo! Galileo, Galileo! Galileo fit to go. Magnifico

Daniel B.
Pint

Oh dear

Was it just me, or did everyone read that headline singing?

Microsoft refuses to nip 'Windows 9' unzip lip slip

Daniel B.

Re: Complete this series...

Actually that list is missing a couple of entries where the good/bad cycle does fit perfectly:

Windows 3.1 good

Windows 3.11 bad (I'd say, AWFUL, especially with DOS 6.22 that broke DoubleSpace.)

Windows 95 good

Windows 98 bad

Windows 98SE good

Windows ME VERY bad

Windows 2000/XP good

Windows Vista bad

Windows 7 good

Windows 8 bad

Windows 9 …

YMMV with Windows95 though.

Daniel B.
Boffin

Re: Underwhelmed

Probably even sadder is the fact that "Windows 8" is actually "Windows 6.2". Windows 7 is "6.1", the last "major" revision was actually Windows Vista with "6.0". Also, Win8.1 is version 6.3 which implies that 8.1 was actually a bigger jump than what its commercial version is willing to admit.

At least Apple keeps their major/minor versions in sync; you can actually map Darwin versions to OSX versions instead of having complete mismatches as MS has with their Windows versioning...

Daniel B.

Re: S.O.P.

a normal company ("company A"), if they say "something much better is coming out soon!" usually *decreases* sales as people hold out for that better model,

It's hard to decrease Windows 8 sales as they have already been pretty low as it is. People are holding out on W8 already, keeping to their old iron. However, there is a slight skew on numbers because people buying Windows7-loaded PCs are actually buying a "Windows 8 license with downgrade rights" so it adds up to the W8 count, even though W8 isn't even being used.

MS is even doing this with their sales numbers as of late with the Xbox division. They know the Xbox1 is flopping so now they report "X Xboxes sold" lumping 360's and XB1's into a single group. The empire is sinking, but MS has a lot of cash reserves and OS lock-in so the double-whammy won't kill them. They have all the time in the world to roll out a decent Windows version. However, the Xbox division might actually end up being a casualty if things keep going the way they're going.

Daniel B.

Meh.

The real question for the new Windows is: "Will I get back the Start Menu and a Disable Metro option?" which is probably what most Windows users are asking. If the answer's no, expect it to flop.

Microsoft exits climate denier lobby group

Daniel B.

Re: @Notas Badoff RE: "non-partisan" groups.

as opposed to an uber left-wing rant? Which is ok? A word comes to mind, hang on, it's...it's.... oh yeah, hypocrite!

… or maybe, just maybe, most of the rants are actually right-winger nuts and thus that's what you'll assume you'll be served with when someone utters those words? Kind of like hearing "Mainstream Media" these days will automatically flag whoever utters those words as a right-winger nutcase in the US, even though dissing the "mainstream news sources" is usually something done by the left-wingers in most parts of the world. Just ask my countrymen about Ukraine, and they'll tell you that all the news are being manipulated by the US war machine and that Putin is telling the truth, yadda yadda. But in the US, it's "the MSM is defending BHO".

Daniel B.

Re: ...that word. I do not think it means what you think it means

Wow. Of all the places I frequent on the 'net, this is the last place I would have thought to find a republican troll.

I guess you're new here. Yes, even though this is a site for more intelligent people than the average dudes, there is actually a pack of Republitards trolling around the comments section. Their most active point must've been during the Snowden brouhaha last year, they're easy to weed out because they're the ones calling him a traitor.

Did you swipe your card through one of these UPS Store tills? You may have been pwned

Daniel B.
FAIL

Re: What OS & server platform was infected?

Heh. I read this barely 2 weeks after DEFCON, where I learned that a lot of POS/Payment Applications use Windows Embedded. So my guess is that they were running Windows and that's why they got 0wn3d. When will they learn?

The agony and ecstasy of SteamOS: WHERE ARE MY GAMES?

Daniel B.

Re: Steam on Mint

So was I downvoted because someone did not want Windows 8 or because they dared to want dual boot?

I'm guessing because someone didn't want Windows 8. The MS shills think that Windows 8 being refused by non-techies is heresy speak and does not exist at all.

Daniel B.
Boffin

Re: still early days

Everything can and should be on OpenGL instead of DirectX. It used to be that everything was on OpenGL, it was sometime around the 2000s that some studios started using DirectX instead. But looking at the current PC gaming market, it seems everyone's switching back to OpenGL. And that's for full engine games; some use engines like Unreal that already do OpenGL on non-Windows platforms.

Goodbye Windows, and thanks for all the BSODs.

Call of Duty daddy considers launching own movie studio

Daniel B.

Prince of Persia

On Prince of Persia: Sands of Time:

For all I know, the concept may even have been created to explain the mechanism rather than the other way around.

That's exactly how the concept came to be. They were dealing with levels that would cause severe frustration, but they wanted to 'em. Thus the 'Sands of Time' were born. It seems they basically implemented moving checkpoints with this, except instead of being "checkpoints" you get to see them as part of the story instead of "GAAAAME OOOOOVERRRRR TRY AGAIN!"

Daniel B.

Re: Starcraft

Actually, a StarCraft movie is the one I'd see having far more potential than any of their other franchises. They might even use the same cutscene tech and pull off a SquareSoft-ish movie with their existing tech!

Daniel B.
Joke

Re: It can't be any worse than...

Daikatana : The Movie ????

Uwe Boll is about to make you his bitch.

Daniel B.

Re: FMV Sequences

So you get a live action movie centered around Jean Claude Van-Damnit and Gomez Adams with barely a nod at the already established lore.

To be honest, Street Fighter II didn't have much "established lore" when that movie came out besides M. Bison being the bad guy and Sagat being his second-in-command. King of Fighters was notorious in having the story that SF lacked. Capcom started adding real background stories to SF sometime later, with the "Zero" and "Alpha" games, but before that there was no real "story" in the SF games. It's kinda like doing a Pacman movie based on the first Pacman game.

That said, many game-based movies end up being horribly mangled, especially those that had the bad luck of getting "adapted" by Uwe Boll. The one movie made by that dude that didn't suck (as long as you forget it's based on a game) would be Bloodrayne. That one works as a corny vampire movie.

However, I wonder if having the real team behind a movie adaptation would avoid the mangling? After all, Chris Roberts directed the Wing Commander movie and it sucked compared to the games. Even though he "directed" that particular saga...