* Posts by Christian Berger

4850 publicly visible posts • joined 9 Mar 2007

North Korea's antivirus software whitelisted mystery malware

Christian Berger

Now watch the next spin

This paper says that "SiliVaccine” might be connected to North Korea... but they obviously cannot know. Now if someone finds a new version of it, which is likely based on this copy of "SiliVaccine” they will then claim that according to the first paper, this must be from North Korea.

That's how attribution "works", when in reality it's trivial to pose as someone else. Everyone could write software in the style of North Korean software, and secret services do false flag operations for centuries.

Firefox to feature sponsored content as of next week

Christian Berger

Re: The problem lies deeper

"Could you get away with telling a Firefox user to install Chrome to use your website? Possibly."

Well we are already seeing that companies with bad websites abusing Javascript, tend to get less customers. Of course they blame that on Amazon, but then again, Amazon has a very decent website which largely works without Javascript. I think that at least part of the success of Amazon is caused by their website.

Christian Berger

Re: The problem lies deeper

"More likely, Mozilla would have fallen behind its commercially-driven competitors and faded away."

The question is, back when Mozilla had a large market share (it's still significant) would features they did not support be adapted by the web?

When Apple decided to abandon Flash, they had no bigger market share than Mozilla has now. So what did fade, Apple or Flash?

Christian Berger

Re: The problem lies deeper

"Is a corporation with $30+ million in net assets large enough?"

The problem is that any browser will need such a large community to maintain it, that you will eventually end up with a large corporation mostly concerned with its own survival.

The primary interest of Mozilla is not to provide a good browser, the primary interest is to keep on existing and grow. Providing a browser is just a means to this end. It's the same as with any big corporation, tax exempt or tax dodging.

That's why Mozilla has no interest in a "better web". A "better web" would mean to say "no" to bad proposals like "WebAssembly", Bluetooth APIs or HTTP/2. However a "better web" would be simpler and lower the barrier of entry for new browsers. If writing a browser engine was as simple as writing a text editor, we'd have hundreds of engines, all competing to be the fastest and safest. Instead we have an oligopoly. We have a browser engine by Microsoft, one by Apple, one by Google and one by Mozilla. 4 browser engines, all with their own user group. Often they don't even care about fixing bugs, as the web will just develop around those bugs.

Christian Berger

The problem lies deeper

"The money has to come from somewhere."

The problem is that browsers now are so incredibly complex that you need a large corporation to support them. If Mozilla wanted to do something for a free and open web, they'd have done everything they could to prevent the bloat of web functionalities. Instead of making Javascript ever faster, they'd have provided, for example some "remote GUI" standard which is less insane than web applications.

If Mozilla would just have said "no" to new web standards more often, those standards wouldn't have gotten off the ground and nobody would have had to implement them.

NASA dusts off FORTRAN manual, revives 20-year-old data on Ganymede

Christian Berger

Re: Keep old drives

"I have a TK50 tape somewhere, which has my PhD thesis on it. Anyone got a drive which can read it? The document itself is in a variant of TeX called Scitex (not Latex)"

Ahh the wonderful world of properly designed systems where hardware is the main problem. As soon as you get the file, you will probably be able to read it as all of its text is just ASCII text, and even the formulas will probably be easy to recover somehow.

Christian Berger

Re: The problem probably wasn't the software...

"Almost certainly not the software although the software migration could be non trivial if the code relied on long deprecated low level run time functions."

Yes, that's why experienced programmers see any kind of dependency as a potential problem. Perhaps it can be hoped for that NASA only employed experienced ones.

"The other factor to consider with the hardware is not just reading the stuff but being able to write it to something your more modern hardware can handle."

Well in that case, that's probably not a problem. VAXes have serial interfaces and even have power of 2 word sizes. Since it can't possibly be a lot of data (probes have very slow links) it should be trivial to just convert it to text, set your terminal program to log the incoming text and just pipe it over that way. It might take a couple of hours, but then again that data obviously was worth that.

Christian Berger

The problem probably wasn't the software...

but probably more the hardware to read the data of disk or tape.

I mean Fortran is a well defined language with widespread compiler support. You could probably just run it on any modern computer with minor changes, but then again if you have the hardware lying around and you need it anyhow to read the medium, why bother porting the software.

Brit healthcare system inks Windows 10 install pact with Microsoft

Christian Berger

Re: How Long?

Well wouldn't it be simpler (and cheaper) to just develop a dedicated platform for the NHS?

I mean much of modern IT is there to support legacy systems. Think of the Service Mode on modern CPUs which is mostly just there to allow Windows use USB devices without having to install an USB stack. An extreme example are web applications which require a whole browser on the client end which is by itself larger than the Linux kernel. Having a simple "graphical terminal" instead would greatly decrease the complexity on both ends.

Developing a computer system is not very hard, after all in the 1980s there were lots of small companies doing just that.

NetHack to drop support for floppy disks, Amiga, 16-bit DOS and OS/2

Christian Berger

Hmm... that's an odd choice

I mean many of us know many architectures which will likely die before 16-Bit DOS, AmigaOS or OS/2. After all Microsoft already dropped Windows support with it's newest 64-Bit operating systems, so Windows software won't work anymore unless it's using the new Win32 APIs.

Microsoft Lean's in: Slimmed-down Windows 10 OS option spotted

Christian Berger

The funny thing is that...

Windows 2000 could be comfortably installed in 2 Gigabytes... including the registry editor, wallpapers and many extra files.

There's a talk about bloat in modern unixoid enviroment which explains why your "cat" today is 48k instead of a couple of hundred bytes it used to be in its original version. Such a talk would be highly interresting for Windows, particularly since it now uses insane amounts of memory for what little functionality it has.

IETF: GDPR compliance means caring about what's in your logfiles

Christian Berger

Re: How long are you required to keep financial records?

If I'm not mistaken, there are differences between keeping something in your long-term archive, and keeping something in your active file.

'Your computer has a virus' cold call con artists on the rise – Microsoft

Christian Berger

I still think those "victims" are rather silly

I mean isn't it absurd to think that a software company you pay money to would actually give you support?

Christian Berger

There is a "non-filler" talk about that topic here:

It was held during the SHA2017 and talks about some people who decided to hunt down such a callcenter.

https://media.ccc.de/v/SHA2017-233-a_trip_to_india

Christian Berger

"at least for non-international calls"

Well actually the standards for the same for international and non-international calls. The "problem" is that some phone providers are very sloppy when dealing with those numbers. It's not unlikely that a phone call from Germany to Germany will have a Swiss network provided number, because the carriers the call went through couldn't be arsed to do their job right.

BTW what good does it do if you know the number? It could still be a company acting as a front for someone. In a time when coorporations can create fake identities by building fake companies, a phone number is worth nothing.

Christian Berger

"This could be avoided if we ditched the old phone system for one that could actually verify who was calling you."

a) There already is a field for the "Provider Asserted Identity", it's just that providers often are rather sloppy.

b) You're suggesting no less than a complete redesign of the phone network, a network that has grown over a century and consists of wildly divergent technologies, often as many of 3 generations being active at the same time.

McDonald's tells Atos to burger off: Da da da da da, we're lobbing IT ...

Christian Berger

"So that will do for Macdonalds burger then..."

In older marketing documents McDonalds actually called them "Sandwiches".

Chinese web giant finds Windows zero-day, stays schtum on specifics

Christian Berger

Re: What ?

"What are they good at ?"

Lobbying schools to drop programming lessons and switch to Office 95 courses instead. They were pretty successfull with that in the 1990s.

BT pushes ahead with plans to switch off telephone network

Christian Berger

Re: Voice quality

There are some providers insisting on G.729, that's when you get shite voice quality.

Any semi-decent one will give you G.711 which is (except for a bit more latency) indistinguishable from ISDN. However even the latency should be much lower than 150 ms end to end. If it's not you or your ISP are doing something seriously wrong. Typical problems include not traffic shaping the Uplink and not prioriticing UDP.

Any decent telephony provider will tollerate no more than a single packet being dropped per 10 minute telephone call.

Christian Berger

Re: So what about the customers?

"If we're looking at VOIP and digital-only to the premises, who's going to pay to make my analogue interfaced cordless system a VOIP compatible one?"

First of all, my condolences for that piece of kit. You should sue the person who sold you that... but I digress...

In Germany the scenario for old, so called ANIS lines (essentially people who still rent their Dialphone for an Euro a month) is simple. You install a special line interface which is essentially an ATA so you can have all your analogue goodness like Impulse dialing, static, echoes and even semi-broken signaling so your answering machine will record some noise or beeps when the caller hangs up.

For people who want to have Internet along with ISDN, there's not much change. The most popular routers people buy in Germany already include a very decent VoIP stack you can plug your ISDN phones into (or even dialphones if you insist), and they even include a DECT base station. If you are one of those customers renting the CPE and you don't have the necessary equipment, you'll get CPE with at least one port for your dialphone. Some telcos in Germany, like Deutsche Telekom, are known for extremely shitty CPEs.

Christian Berger

Re: Digital Fibre Future

"Yes,all exchanges were digital since the mid 1980's,"

Sorry but that probably should be "all _new_ exchanges were digital since the mid 1980's".

In Europe development on digital exchanges started in the early 1970s when phone companies were hyped about computer powered switches. The only country I know of that saw significant use of those were the USA. The idea was that once you have such a system running, you could just replace the analogue switching matrix with something digital, and you get a completely digital system once that was more economical.

What they didn't take into account were the advances in microelectronics. While back in the early 1970s it was perfectly normal to have a computer with ferrite core memory, it was ridiculously outdated by the early 1980s when development was done. The result was that large parts of those switches were re-developed, based on microcomputers. Those switches then were completely digital and gradually came to service in the 2nd half of the 1980s.

Here's a commercial for a 1970s style analogue computerized switching system:

https://www.youtube.com/watch?v=QgB0KSjC2zg

https://www.youtube.com/watch?v=IbTGVN2VMnQ

Ohh and here's a BT film about their development of ISDN switches

https://www.youtube.com/watch?v=xy_6DL4haJA

There's even a 1984 Japaneese childrens programme about I(S)DN. Here's the German dub of it:

https://www.youtube.com/watch?v=4sCuN6TE8y4

Christian Berger

Re: Yeah right @Hoppy

"If I remember correctly, ISDN specified a 144Kb/s link, which could carry a 2 voice calls, each using 64Kb/s, and a 16Kb/s signaling channel."

That's correct, though those 2 64k channels could carry everything, even non-voice. It's signalled via the "bearer-capability".

"Also IIRC from my POTS training, analog phone lines used to have a filter at 8KHz, which was regarded as plenty high enough to carry voice communications."

Well there were early very long lines which used indutances on the lines which acted as a low pass filter, but extended the reach. I don't know exactly where that filter was.

However the actual limit was when carrier-wave systems were introduced shortly before WWII. Those stacked voice channels in frequency so a single coaxial cable could carry dozends of voice channels. So obviously you had steep filters to only give you a passband of 300-3400 Hz so they could stack more channels. (in fact there are reports about the stacking being changed during the day, so at night you actually got wider channels) Back in the days however you were likely to even get less if you had a worn out microphone capsule.

As for digital telephone networks they decided to use a sampling rate of 8000Hz as this allowed for affordable analog filters on both sides and was well withing the technical capabilities of the 1960s. The codec they used was G.711 which could be implemented fairly easily as it could be done by having some analogue circuity and an 8-Bit A/D converter.

ISDN actually had a special bearer capability for G.722 encoded audio which allows for frequencies of up to about 7.2 kHz to be transmitted over a single 64k channel. This caused quite some hype at radio stations, but ultimately fell into obscurity.

Christian Berger

Re: Mobile as the emergency option?

"Not really - you don't get location information from mobile."

That really depends on many factors. The interface towards the emergency services in Germany has ways to transmit either an address or a set of geometrical figures indicating the location. In the US, for example, virtually all phones have a way to capture a short burst of GPS data which then will be sent to the base stations in order to get a location fix for the phone which will then be transmitted.

Christian Berger

Re: Yeah right

"I know VOIP is better than it was some years ago, but it certainly seems that overall phone call quality has gone dramatically down over the years."

Well that depends on many factors. There are providers and PBXes insisting on the god awful G.729 for example, while any decent provider will use G.711 which is just as good as ISDN (but with a longer delay), good providers will support G.722 which does much better quality at the same bitrate. Another problem are really bad ATAs. Quality doesn't seem to correlate with price. The best ones (I've seen) for home uses are the "Fritz!Box" series from AVM, which you can get refurbished for about 70 Euros, but cost around 150-200 Euros for the top of the line model... which includes an internal ISDN port, a DECT base station, as well as a V/ADSL modem. Software support usually is several years for feature updates, and longer for security updates.

Christian Berger

It depends

First of all you already have that problem with regular ISDN, there the solution is simply to have a local battery backup... which your PBX will need anyhow.

If you still get a network connection depends on the way it's handled. For example classical ADSL tends to come directly from the old "switching office" where you have battery backup, so it should work fine. VDSL, particularly when done at the "curb" would need decentralized battery backups which may work. It won't work for vectoring as those boxes need _insane_ amount of power. If you have a dedicated fibre to your "switching office" to your home, it's likely to work. DOCSIS has many amplifiers and media converters, some of which are powered by the "groundstation" some are somewhere hidden inside your home.

The good thing about VoIP from a reliability aspect is that you just need any kind of decent Internet access. At work we've had many companies using even things like LTE when their wire based connection broke down. For a competent administrator it's easy to patch together a perfectly acceptable emergency solutions. This is far harder with ISDN as if your provider's ISDN switch goes down, you're toast and there's nothing you can do about it. ISDN equipment used to be highly reliably, however now 30-40 years into the lifetime of the equipment you find more and more failures, but no more spare parts.

So in short it's hard to say if VoIP will be more or less reliable given a certain situation. The main problem on current networks is that operators are trying out every new feature they can find. The result is that things like DTMF won't work, because one operator wants to do them as telephony-events, while the other one wants to do them inband (the saner alternative), and they somehow mess up signalling so both sides have different opinions on what's been negotiated.

OK, this time it's for real: The last available IPv4 address block has gone

Christian Berger

That's called 6to4 and already works nicely

It's for people who only have an IPv6 connection to connect to IPv4 hosts. AFAIK it uses some sort of NAT mechanism for this. It cannot be done directly as the legacy host would only get the truncated address and therefore couldn't reply.

Your suggestion would essentially be the same as IPv6, but with much shorter addresses. You'd still have all disadvantages of the switch, but without any of the advantages.

Christian Berger

Re: Time to claw some back

"What's the point in trying to claw back IPv4 addresses? It would not fix the problem, just delay it for another couple of years."

There's actually an interesting thought there. There are multiple groups of people who are "anti Internet".

One is the Facebook Crowd, they only want Facebook, not the Internet. Those people typically either don't use E-Mail at all or use one of the few largest mail providers.

The other one is the people being fed up with their ISPs meddling with the Internet and certain agencies sniffing it all, so they create their own overlay network using the Internet only as a transport network for their VPNs.

So there's a chance that in a few years people don't want the Internet any more.

Christian Berger

Re: IPv6 in the DMZ

Well actually many companies are already working on getting IPv6 in their internal networks, as those private blocks are already to small for them, but yes, if you are contempt with E-Mail and the Web, there is no need to have IPv6 on your internal network.

Christian Berger

Well first of all...

it can coexist with IPv6 and for most applications you can easily mix them. Essentially everything that runs though NAT also works through 6to4.

Also it's kinda hard to extend IPv4 to longer addresses in a compatible manner. Feel free to give some actual ideas. Putting everybody behind NAT is _not_ a solution.

Cisco snuffs Spark, renames it 'WebEx Teams'

Christian Berger

Multi-Standard RANs make a lot of sense

Particularly since since GSM, large parts of the base stations were implemented as an SDR anyway.

Besides LTE and GSM can perfectly well coexist on the same frequencies, if you manage to sync both basestations... which is trivial if they are combined. You can even ditch all that GSM fixed infrastructure and make the cells interwork with LTE more directly, greatly simplifying your architecture.

Surprise! Wireless brain implants are not secure, and can be hijacked to kill you or steal thoughts

Christian Berger

The question is actually rather irrelevant...

... we are not yet ready as we currently would still let companies do such implants. Once they become sophisticated enough to do complex things, you can bet that the manufacturers will use them for advertisement and other forms of attention monetarisation... just like they already did with Smartphones.

What Israel's crack majority-women Unit 8200 hackers can teach tech about diversity

Christian Berger

Re: Missed opportunity

This is a secret service, that's kinda the opposite of hackers. Those people use different kinds of force to concentrate information, Hackers share information.

Such a total conscription probably is even bad for the hacker culture in Israel as people don't get taught to think by themselves in military and secret services.

Intel's security light bulb moment: Chips to recruit GPUs to scan memory for software nasties

Christian Berger

Re: [C|G|F|S]PU Silicon shuffle

"Great, then we're going to call them Security Processing Units, add yet another $100 to the unit price and ship all that silicon anyways."

Seriously nobody would complain if they'd do it like that and sell that as an optional feature. It's shoving that "feature" down our throats that's the actual problem.

Christian Berger

Yet another itteration of the "anti-virus" concept

They'd gain more security if they'd remove their management engine and blocked the start of any office product.

Productivity knocks: I've got 99 Slacks, but my work's not done

Christian Berger

Re: Productivity

It's a bit like with messies who believe that if they just have enough things for organisation, they can do so easily.

Ohh and there are certain people who haven't learned to distrust marketing. So they actually believe that products like "Office packages" increase productivity, when they in fact just make a large part of your organisation waste their time on things they can't do well.

Christian Berger

Fascinating how a whole industry can be created...

...just by companies having incompetent enough IT departments to set up a private IRC server, or people being forced to use terribly bad e-mail clients which do not even quote propperly.

Seriously, if you want instant communications, there's XMPP or IRC, or the telephone. All three of which should be used in moderation, as their real time nature means that they are disturbing the recipient. (well maybe except for IRC which comes with a scroll buffer)

If you want something from a person, and it doesn't have to be _RIGHT_NOW_, E-Mail is your best chance to get it within a day or so.

Huawei promises to launch a 5G smartmobe in second half of 2019

Christian Berger

From what I've heard, the main innovation of "5G" will be...

... that it's essentially the same as LTE, but with every network internal message being now sent in a different format over web based protocolls.

Source, the Q&A session of this:

https://media.ccc.de/v/ARMP3D

Microsoft has designed an Arm Linux IoT cloud chip. Repeat, an Arm Linux IoT cloud chip

Christian Berger

Re: Embrace Extend Extinguish

Firefox now forces you to use PulseAudio.

Christian Berger

Re: DROP

Well either that, or it would be like with VBA or Active-X which everybody hoped they would drop it ASAP.

Christian Berger

Re: Remember when..

Yes, though the stronger vendor locks exist with SoC Companies like Broadcom or Allwinner, at least in the mobile market.

In a way it's like with home computers. We have lots of different vendors there, all with their own lock-in hardware, but most of them ran some version of Microsoft BASIC.

Christian Berger

Apparently the real news is that Microsoft freely licenses the chip designs

So the good that could come out of this is that manufacturers could use this as a single hardware platform. That's something that's desperately needed in the ARM world, as currently everybody needs to do their own Linux kernel if they want it to run on ARM.

Christian Berger

Embrace Extend Extinguish

It's a classical Microsoft strategy. They tried the same with the world wide web.

Though this is probably just a side project. The real damage is done by the SystemD/Freedesktop/PulseAudio people

'Well intentioned lawmakers could stifle IoT innovation', warns bug bounty pioneer

Christian Berger

My favourite would be the way it's done with electrical appliances...

... just have a set of evidence based measures the device has to do. For example there has to be input valiation which satisfies some constraints. Depending on your language, the compile could even check for such constraings automatically. So in the ideal case you would have a log from your compiler. If something bad happens you just have to show the log as well as the source code so you can proof that you did everything correctly, satisfying the rules of the time you shipped out the box.

For appliances this works a bit differently. For example there is a rule in the German regulations that no dangerous situation may occur if a single part fails. This is checked by laboratories looking at the schematics and trying to find the parts which would get closest to a dangerous situation. They then break those parts and test the safety again.

Christian Berger

"Financial pain is probably the only incentive. Or jail time."

That only works if you can still find that company or that company still exists then.

A developer always pays their technical debts – oh, every penny... but never a groat more

Christian Berger

Re: One way to avoid technical debt: experience

Well I don't think it's even possible to do decent software development in an outsouced environment. Software development without knowing in depth what the software has to do and what it's all about is utterly fruitless.

Christian Berger

One way to avoid technical debt: experience

Essentially most things developers do in the real world are utterly trivial. There rarely is an actual challenge. That's why developers often get bored and try to solve the trivial probems in more and more complicated ways. A good example are web applications. The web was made for (quasi) static "pages" of "rich text" with hyperlinks. Somehow people now try to cram interactive applications into this. That way, things that could be done in Delphi via the built-in "create a database application" wizzard within seconds, now take months.

If you have experienced programmers, which have worked in different areas, you can reduce your technical debt. Just let them choose the propper tools for the job. Let them build prototypes so the users can already play with the product long before any details are set in stone.

Imagine you're having a CT scan and malware alters the radiation levels – it's doable

Christian Berger

Can that even happen?

I mean an X-Ray CT needs a certain range of radiation power, after all the stronger your source is the more expensive it will be. Shouldn't there be hardware saveguards in place to keep the (moderately expensive) X-Ray tube from being overloaded? I mean every CRT TV has internal overvoltage and overcurrent protection to make sure the TV turns off immediately in case the CRT is operated out of spec.

It seems to me that this could just be some cheap alarmism to attract attention. Just like we had with the guy who claimed that running your own firmware on a printer would cause fires.

Obviously though you should never run any part of that equipment, not even the GUI, on unhardened Windows.

Skype for Business has nasty habit of closing down… for business

Christian Berger

Re: Suggestions?

There's the telephone network which slowly even becomes video capable.

No password? No worries! Two new standards aim to make logins an API experience

Christian Berger

The proponents of biometry would say...

... that somehow biometry has magic sensors which cannot be fooled and those sensors somehow securely talk to the authenticator and authenticate themselves, etc.

How does this work? Magic!

Gemini: Vulture gives PDA some Linux lovin'

Christian Berger

"Planet is a tiny company with a shoestring budget."

Well yes, of course... but so is "Open Pandora" who are working on the Pyra and already released the Pandora, both made with open SoCs so a propper Linux was available from the start. (way before Android)

What Planet is doing is shipping their devices before they are ready. I can understand why someone would do that, but it's a strategy that will lead to some unsatisfied customers. After all it can be more frustrating to have a device you cannot use and eventually will have to update, than not having a device at all.

To their credit they have done some things to even make Android usable, namely offering a rooted version of it. If they would now release the apk of their new keyboard app, the device would be good enough to critique.