* Posts by Christian Berger

4851 publicly visible posts • joined 9 Mar 2007

Linus Torvalds fires off angry 'compiler-masturbation' rant

Christian Berger

Yes, but it may be one of the few cases of him being wrong

There's a rather good argument that he's wrong. Essentially using the compiler built-in function is more efficient and in a way more readable as everybody understands what this code is about. (checking for an overflow)

Overflows are one of the hard parts of C(++/#) and even Java.

Here is the full argument by someone who professionally finds integer overflows:

http://blog.fefe.de/?ts=a8c95274 (In German of course, this is about computing after all)

Raspberry Pi grows the pie with new deal allowing custom recipes

Christian Berger

Put it into a "Nokia Communicator" case

Complete with a wide screen LCD and a standard battery, as well as a "dumb phone" in the lid, so the Raspberry Pi can be in "suspend to RAM" when the case is closed.

Flickering screens turn Microsoft Surface Books into Microsoft Surface paperweights

Christian Berger

Are you sure it's not supposed to be that way?

I mean seriously, with recent versions of Windows it's hard to tell.

Verisign warns new dot-word domains could make internet unstable

Christian Berger

This comes from the company...

which redirected all unallocated .com domains to their own advertisement site and used to have a subsidiary in Germany called "Jamba" which defrauded millions of school children by selling them ring tones.

Mostly Harmless: Google Project Zero man's verdict on Windows 10

Christian Berger

Re: Windows security is like a heavily armoured gate...

Actually no I'm not saying that systems should be closed. We see what happens there with iOS and Android, you end up with a system that needs to be rooted/jailbroken in order to be useful, but still isn't secure even if you stick with the stores. (It's the same with other mobile OSes, but I'm just to lazy to list them all)

What I instead propose is a system like it's used in Linux Distributions. It doesn't keep you from installing your own software, but it provides a save and very convenient way of installing software. Distributions feel responsible for the software they have in their repositories. That's why you won't find software like "Acrobat Reader" there. If a software package has to many security problems and a safer option is available, a distribution may actually remove the unsafe package in a future version.

Of course this is a form of censorship (though easy to circumvent as mentioned above). However I can choose which distribution/repository I want to have. I can choose whom I trust. And again, I can simply get the source of any program and compile it myself if I don't like what the distribution is doing.

Christian Berger

Windows security is like a heavily armoured gate...

....standing around on a field with nothing to keep people walking around it.

Seriously as long as the form of software distribution is "random people installing random stuff from random sources" or "companies pay us to put things into a store", there will be not even the slightest bit of security. After all if Microsoft would refuse to carry Adobe software in their store, they'd probably get sued even if most people would agree that it would help security a _lot_.

Twitter CEO Jack Dorsey hands out shares to remaining staffers

Christian Berger

What do all those people do?

I mean seriously you'd expect a service like Twitter to be run by, at most, a dozen people, probably _much_ less. It seems to be far more feasible to just get rid of the idea of selling ads in tweets and just sell normal ads or even go completely donation based.

Joining the illuminati? Just how bright can a smart bulb really be?

Christian Berger

A lot of money for a short term solution

After all that system relies on an App being installed on your phone... so in 2 years you'll be faced with re-installing it on your new phone, so you'll need to get enough use out of it to make that worth. In 5-10 years you'll be faced with that company probably having moved to something else (e.g. new products or bankruptcy) so you'll slowly have troubles getting that App to run on your new phone.

For something like this to succeed, we need simple and open standards. We need standards which are so simple you could use them with a shell script.

Job alert: Is this the toughest sysadmin role on Earth? And are you badass enough to do it?

Christian Berger

Doesn't seem to be that bad

After all you are surrounded by rather smart people (scientists) who are really doing their job because they like it. Working conditions probably aren't to bad, as most of those stations are evacuated and closed down during the winter.

This is the home page of one of those stations:

http://www.antarcticstation.org/

And here's a German language podcast interviewing one of those scientists on her working conditions:

http://www.wrint.de/2012/01/26/wr040-holger-ruft-an-in-der-antarktis/

She even noted that during the Antarctic summer you can even sleep outside in a tent, which she was actually encouraged to do.

Kill Flash: Adobe says patch to fix under-attack hole still days away

Christian Berger

Re: If companies had to pay for their mal-ware, Adobe would be in debtor's prison

"Actually MS's OS products have had fewer holes than competing options like OS-X, Redhat and SUSE every year for the last decade!"

That's because you compare a stripped down OS with a whole operating system. (Well except for OS-X, but compĺaning about that is like beating a puppy)

Junk your IT. Now. Before it drags you under

Christian Berger

The problem may be in the way we develop software now

Today many people write in languages/environment which try to abstract complexity away from you. Essentially this makes you write hugely overcomplex pieces of software without even knowing.

Adding to this is that many people now grew up on badly designed systems. They never experienced the joy of having a small subset of orthogonal features which add up to something great. That's why they design systems piling feature upon feature.

US taxman slammed: Half of the IRS's servers still run doomed Windows Server 2003

Christian Berger

One should note that it's precisely the same in most companies

It's just that in the IRS, we get to know about it.

Of course the underlying problem is the same for all organisations. In the early 2000s they bought from Microsoft believing that they would continue to develop Windows in a reasonable way. Instead they got XP (which needs more than 2 Gigabytes for the OS alone!), Vista, 7 and 8, as well as their equivalents on the "server" front. All systems which don't offer any useful functionality, but require new hardware and introduce new incompatibilities.

Shocker: Net anarchist builds sneaky 220v USB stick that fries laptops

Christian Berger

It's not like USB was meant to be used for such things

I mean plugging in devices didn't work even in the early staged demos.

https://www.youtube.com/watch?v=ajmn-_jkpdc

The protocols running over USB are far to complex and ill defined, the hardware makes bit errors very common, which make your bus reset.

Ring Chime: Needy wireless doorbell or $30 bling t'ing?

Christian Berger

Will it at least still work...

...when the cloud service (or your Internet connection) is down?

Is streaming pirate video legal? Europe's highest court will take a look

Christian Berger

We are still addressing the wrong problem

Instead of trying to enforce laws made in the 1930s before you could easily tape music and films of radio or TV, or download stuff from the Internet, we should move forward and accept the existence of tape recorders and the Internet.

The question we should ask ourselves is how we make sure artists get a fair amount of money. For musicians that's actually not much of a problem as they make most money from concerts anyway, nearly no musician makes money from record sales.

For films that's harder since all the work is in producing a purely immaterial good, in Germany most movies are financed via tax money or via TV stations, both are models which can still work today.

In 2015, your Windows PC can be owned by opening a spreadsheet

Christian Berger

Re: Software

"Furthermore TCP/IP needs to be replaced as it is not really secure. Network devices relying on plain text MAC addresses to communicate is pretty backward."

a) TCP/IP does not rely on MAC addresses, those are part of Ethernet.

b) Networks cannot provide security in a sense of integrity or secrecy, this has to be done on different levels.

Australian Prime Minister runs private email server

Christian Berger

Considering that "professional" hosters don't exactly have any different tools...

... I'd say his server probably is save. I mean if he has a fixed IP-address to ssh into it, he can even just block the rest of the Internet. And e-mail servers are simple enough to probably not have any serious security problems. The worst that could happen in a DOS.... unless of course he uses a stupid password or something.

PGP Zimmermann: 'You want privacy? Well privacy costs MONEY'

Christian Berger

Privacy doesn't cost money

Privacy costs effort and comfort. You cannot simply outsource privacy to some company, no matter how much money you pay them.

Google and pals launch Accelerated Mobile Pages project

Christian Berger

If you want to optimize something, go for code size...

...both in the webpages and on the browser. More HTML/CSS/JS code, particularly on more domains, kills performance. Many web pages now load _much_ slower than full sized screenshots of them!

More browser code means more bugs and makes it harder to optimize the browser.

Linux kernel dev who asked Linus Torvalds to stop verbal abuse quits over verbal abuse

Christian Berger

Let's look at what are facts here.

She didn't specify what in particular pissed her off. That's a bit of a shame since it leaves things open to speculation, but it's obviously her right.

Her note can be read here:

http://sarah.thesharps.us/2015/10/05/closing-a-door/

Some Slashdot commenter has tries to find the cause of it:

http://linux.slashdot.org/comments.pl?sid=8123533&cid=50664697

Apparently there was some bit of bantering discussing that people need to learn to say "no" to Patches, and that sometimes it might be necessary to "yell at people".

She apparently interpreted this as violence, which I personally find way overblown.

According to her website, Mrs Sharps has "been running Linux since 2003, and I’ve been a Linux kernel developer since 2006". So that's 12 years of Linux experience, no information on how long she's programming was given. Now unless she is a genius, which I cannot rule out, that's not a lot of time to learn how to develop software. I've been writing software professionally since 1997 and I'm slowly starting to write something that could be considered semi-good. So it's very likely that her code just may not have been very good. Most people write absolutely shitty code in their first decades of programming.

The Linux Kernel is one of the most important software projects of this world, maybe not _the_ most important one, but certainly among the top 100. It is vital that this development happens in a rather safe environment. Any change needs to be considered carefully so nothing sub standard gets into the kernel. In a way it's like an operation room at a hospital. Though you may look into some through a window, you may not enter it unless you are medical personnel.

Now imagine how a doctor would react if you were walking into the room during an operation with the expressed intent of messing around with the patient? It would seem very likely that most doctors would certainly get you kicked out, certainly by making one of the assistants push you out. When something greater is at danger, you are allowed to be rude.

Linux faces a new problem. While in the past, not having enough programmers may have been a problem, we now have lots of people who want to write both user space and kernel code. In principle that wouldn't be bad. However just like children, developers need to have spaces where they can learn and fail. In my time this used to be Turbo Pascal and Delphi, where you wrote lots of shitty software. This is where the mountain of really bad legacy 1990s software comes from. Today that proving grounds are mostly apps, but unfortunately also the Linux user space. Just like in the 1990s it was not seen as a good idea to let those people loose at writing kernels or banking software, it's now probably not a good idea to simply let everybody mess with the mainline kernel or other important software projects. You need experienced people there. People who have learned from others.

Christian Berger

Re: The problem is, usually Linus is right

Well yes it sounds like "Poettering", if you ignore one point. Poettering usually just claims things which are quickly disproved. The Linux kernel community typically claims things and backs them with a shitload of facts and empiric studies.

If you proove Linus wrong, he will change his opinion and admit that he was wrong, if you proove Poettering wrong he'll just ignore you. That's the difference.

Christian Berger

Re: The problem is, usually Linus is right

That still leaves the question unanswered if the speech was abusive (whatever that means) or if speech can even be abusive.

On the other hand, there's more and more people who are overly offended by things which are just normal. People are offended because opinions conflicting with their own are presented. This article here sums it up nicely:

http://www.theatlantic.com/magazine/archive/2015/09/the-coddling-of-the-american-mind/399356/

Christian Berger

The problem is, usually Linus is right

Without knowing what the issue is, there's no way to decide if that treatment was justified or not.

Yes, the treatment is rough, but simply put there is a lot at stake here. Just like you cannot simply enter a NASA control room to have a go at steering a Mars rover, you cannot go and expect your kernel patches to be accepted without a heavy dose of scrutiny.

It's a fact of life that most people heavily over estimate their abilities.

I can understand Linus getting angry. He's probably like many more famous physicist being bombarded with lots of theories why Einstein was wrong, all of which could be easily disproved by putting an hour of work into it. I mean just look at the Freedesktop people who wanted to get dbus into the Kernel in a project called kdbus. Even today they won't shut up even though Linus empirically proved their point to be wrong.

Again, I have no idea if this was justified in this case or not, but the Linux kernel simply is to important to be taken over by immature people who think that being a victim counts as qualification.

Startup promises to cancel your hated Comcast subscription for you for just $5

Christian Berger

Actually half of the company I work for...

...acts as an intermediate between companies who want their employees to have cell phones, and cell phone companies. So instead of having to talk to the cell phone companies, they talk to us.

Ever been burned by a bad IT decision? Of course you have!

Christian Berger

Well so far...

I've seen a project kinda fail because we relied on a supplier which, though having the top most support level, still had worse support than the lowest unpaid (!) support level of the competing dual license product. It also had a lower code quality (we had a source license).

Rise of der Maschinen: Daimler trials ROBOT LORRY in Germany

Christian Berger

How that would be cool...

except for the "Bundeswehr Universität München" having done pretty much the same thing in the 1980s.

The Steve Jobs of supercomputers: We remember Seymour Cray

Christian Berger

Re: The genious part was to simplify the problem

Well of course it used all the tricks that were known in processor design back then, after all it was already a vector machine and used pipeling and stuff. However they avoided problems wherever they could, turning an "impossible" problem into one you can solve with a handful of people in acceptable time. Once you have done that, development will go rather quickly as you don't have large teams to worry about, just hire good people and let them solve their problems and the job will get done.

Christian Berger

The genious part was to simplify the problem

I mean that's what distinguishes him from modern day computing company managers. A C64 probably took more engineering effort to design.

The Cray 1 didn't use any custom silicon. It used generic ECL gates which you could buy in bulk in any store. It used careful design to get speed out of it. For example every board was designed so the propagation delay was constant. Every line between 2 components and particularly between 2 boards was a well run propagation line. Every long line between 2 boards had the same length. All of this suddenly makes the problem much easier as you could count on certain universal preconditions. For example your signal would arrive 1 clock cycle later at the other board because of wire delays. It would _always_ do that and you could count on that.

ECL also has the nice effect of taking a constant amount of power. That way there are no current transients on your boards which are a huge problem today. That's why, under most CPUs in modern PCs you will find a whole battery of capacitors to satisfy the current demands. The Cray just took a constant current. This also simplified the power supply. It was a simple 6 phase rectifier with a bit of capacitors after it. The regulation was done externally with an electromechanical converter converting both the line power to 400 Hz 3 phase as well as regulating the output voltage for slow variations of the supply voltage.

There are 2 talks by him on Youtube. They are worth watching, even if you are not into engineering. He's a rather good speaker:

https://www.youtube.com/watch?v=vtOA1vuoDgQ

https://www.youtube.com/watch?v=xW7j2ipE2Ck

BTW Steve Jobs was a salesperson, Seymour Cray actually designed most of the logic in boolean equations. So comparing those is kinda offensive to engineers.

Christian Berger

Re: Flight Of The Navigator

http://dave.zfx.com/f1.html

It was the Foonly F1

Patreon patrons: It's password-reset time

Christian Berger

That was rather predictable

I mean seriously, the people working at that company think having a login screen that depends on external Javascript is a good idea. They ignored bug reports for _months_. They work with newbie web developers who apparently pride themselves in their experience (at least the Patreon website does).

Obama brain trust sidesteps mandatory hackers' backdoor idea

Christian Berger

That doesn't mean its not done

I mean seriously there are many forms back doors can take. In fact if you have the resources you can even encourage back doors without the people writing the code actually knowing. You could do this with complexity in mandatory standards.

Just look at UEFI. It's way to complex for the simple task it needs to do. More complexity means more code. More code means more bugs. More bugs mean more security critical bugs which in turn means more exploitable bugs.

So if you manage to convince people to solve a problem in a to complex way, you effectively make them add back doors to those systems without them even knowing.

Blighty's GCHQ stashes away 50+ billion records a day on people. Just let that sink in

Christian Berger

Re: Imagine how many more lives would be saved

Yes or education. Good and widespread education is the best way to pacify a society and make your economy stay competitive. However that would also be a thread to the upper class. Educated people might question your decisions, like to kickstart a society bankrupted by banks by austerity measures, etc.

Cookies MONSTER your security, even with encryption

Christian Berger

Re: Cookies are one of the missfeatures of HTTP

"There are two sorts of state involved here."

That's actually a very good point here. Having a protocol with sessions (like Websocket) would solve both problems in a way I'd find better for the user.

First of all you wouldn't have the session itself. It would have a user transparent beginning and end. You close down your browser tab and your session has ended.

For in between sessions there are logins or perhaps some future authentication token. You'd get that token on your first visit, store it in your user agent (perhaps encrypted with a password) and the next time you visit that site again, you'll be asked to use that token. That token could also be implemented with public key encryption (it would be your public key then, for example). This would be much more secure than your usual username/password combo.

As a side effect it would eliminate one obvious abuse of cookies, tracking cookies.

Christian Berger

Cookies are one of the missfeatures of HTTP

I mean it's one way to cram state into an otherwise stateless protocol. We should abandon cookies and just use a different protocol, for example Websocket, or Remote Frame Buffer (VNC) or something.

This would make clients and servers _much_ simpler and reduce the number of bugs. It would probably even be faster since we won't have to reconnect so often.

NOxious Volkswagen diesel emissions scandal: Chief falls on sword

Christian Berger

But they already found the culprit

http://www.der-postillon.com/2015/09/der-hausmeister-wars-vw-prasentiert.html

It was Hans Böbner, the Janitor. In a recording made in the Caribic he confessed to personally modifying all those cars. Guess his recent 4.3 million bonus was not enough, so he turned on VW.

Crash Google Chrome with one tiny URL: We cram a probe in this bug

Christian Berger

Why does it even unescape that string?

I mean the URL will be sent verbatim to the server just as it's entered and stored everywhere. There is no reason to turn %20 into a space or anything, let alone doing this multiple times. There may be reasons to do the opposite, for example on forms, but unescaping a string should never be done by the user agent.

Microsoft to splurge $75m on computer training for kids

Christian Berger

It's a battle for the minds of the future

As Microsoft sees their market share erode with no new markets in sight, they as well as many other companies, try their best to capture the minds of the people. The earlier you start, the more likely you are to make someone believe that your particular product is the future.

Sharp's new TV has over 7,000 lines of pixels – but there's NOTHING TO WATCH

Christian Berger

I see this thing in engineering offices

Having worked on CAD workstations I know how frustrating it can be to have a team hunched over some tiny little screen showing a fraction of a design through a peep hole. With such a screen, you could finally show a significant part of the design and discuss it with others. No more scrolling, just your whole blueprint on one big screen. Everybody can just go there and look at the parts they are interested in. No more printouts just to talk about a design.

Brown kid with Arab name arrested for bringing home-made clock to school

Christian Berger

Maybe we should write letters to that school

...explaining that though being afraid of something doesn't mean it's bad. Maybe we can convince those people to make the mental leap that something they don't know and they don't understand isn't necessarily something bad. Maybe we could even go as far as to telling them that this letter went over the Atlantic via flying machines called Aeroplanes, which fly like birds. Maybe we could even attach pictures of those wonders of the world explaining that those are pictures and no real things are squeezed into those sheets.

Three VoLTEs to victory as it jumps into UK 4G voice offering

Christian Berger

The question is, will it work

I mean VoLTE is VoIP over LTE with _lots_ of complexity added to allow things like international roaming and handover to 3G and GSM networks. Given that today many companies (cough Cisco, cough Mitel, cough 3CX...) can't even properly implement the comparatively simple subset of SIP you need to make everyday phonecalls, I doubt that it'll work reliably any time soon. And even when it works it'll be a security nightmare, as all the miss features of classical SS7 networks have been re-implemented.

The last post: Building your own mail server, part 1

Christian Berger

Re: It's nice to see someone normal for a change

Well first of all, why in the world should I install a mailserver on Windows? And why should it be something rather obscure like HMailServer when I can probably just get postfix or something to run on Windows?

BTW there's also a lot of "groupware" solutions out there replacing Exchange and or Outlook.

Christian Berger

It's nice to see someone normal for a change

I mean usually Reg-authors spend their time installing Exchange and Outlook and then boast about their new tools which enable them to do essential and trivial things.

E-Mail also has the great advantage that it's error resilient. If your mail server goes down, you won't loose any mail as the other mailservers will retry for a week. This makes a great learning ground.

US braces for WW3 with Cyber Command 'Vision' of integrated cyberops

Christian Berger

Re: Why would they mention Skynet?

"Why would they want capability to take out the UK Military Satellite network in this day and age?"

Because the wars of the future are not between nation states as such, but between ideologies. Currently the US and the UK are best buddies as both are still in their "neo conservative" phase. As far as I know this was started in the US by Reagan and in the UK by Thatcher. Many countries are now seeing the effects, an ever widening gap between the rich and the poor. Currently most governments still follow the "neo conservative" ideology, mostly because the poor have little choice in the elections. There are virtually no left or middle candidates or parties. Also there's a public narrative that our current situation is the fault of the poor/foreigners/etc and not the banks. So many people turn on foreigners and burn refugee homes instead of banks.

But imagine the tides turn, and, like in Greece, a moderate government gets elected in, lets say Germany, or the UK. Unlike Greece there is little you can do against this, except for starting a war.

Intel's 6th gen processors rock – but won't revive PC markets

Christian Berger

Re: It's not about the processors

Yes, there's also a weird marketing push into directions nobody wants. For example the "Ultrabook" which tries to be as thin as possible, which is usually reached by having a hard to replace battery.

The big problem the manufacturers don't realize is that the future of the PC is not with Windows any more. Microsoft essentially wants to chase the Android market, by making Windows just like a mobile operating system. The people who still care about privacy are switching towards Linux or some BSD.

Microsoft will essentially pull out the rug from under their main market. They have already tried with Windows 8 and they have apparently not changed their mind with Windows 10.

'Major' outage at Plusnet borks Brits' browsing, irate folk finger DNS

Christian Berger

This is why we need more European television

If you had a multifeed dish also directed to 19.2°E you could have gotten HR-Fernsehen, a German public free to air channel showing cat videos at night. In fact they probably are the inventor of cat-based video entertainment.

Feeling ripped off by your ISP? It's getting cheaper to pipe your packets globally

Christian Berger

Logical consequence of technical progress

I mean optics and routers have a limited lifespan. After 10-20 years maintenance costs will rise, which means you will want to replace them. Also if you want to get rid of your equipment earlier, there's a decent refurbishing market so you can recover a large fraction of your costs.

Plus equipment costs pale in comparison to the wages of the people maintaining them. A network engineer will easily cost you 100k$ a year if you count all costs directly associated with hiring a person.

ARM wants you to jump into mbed with it – IoT open-source OS in beta

Christian Berger

The beauty of embedded projects is...

... that when they are well designed they become small, and therefore easy to implement. Plus if you stay below certain thresholds, low memory requirements actually save you money.

Therefore you can get operating systems like FreeRTOS/OpenRTOS which can run with very few kilobytes of RAM.

TCP is a wire-centric protocol being forced to cut the cord, painfully

Christian Berger

Re: Why TCP over POTS? The Royal Mail handles packets

Well TCP/IP is _much_ cheaper thanks to cheap Ethernet and cheap IP equipment.

In any case, TCP/IP won't perform any better or worse than X.25 given the same optimizations.

What we have here is a typical case of someone trying to sell some boxes by not addressing the problem (unsuitable mobile networks) but trying to build a new layer of complexity around it. WCDMA/UMTS simply were drafted in the early 1990s and back then nobody cared about packet switching networks. The vision was 64k ISDN channels, not packets.

Mozilla's ‘Great or Dead’ philosophy may save bloated blimp Firefox

Christian Berger

Re: Unfortunately Mozilla already behaves like a large coorporation

"Except what happens when these copies turn out to have holes in them?"

Well, first of all, we shouldn't need Javascript libraries, and most Javascript libraries seem to be just there to work around some old browser bugs which have long since vanished.

Then second, embedding objects from a foreign server is a security problem by itself as you suddenly leak information to that server.

Third, the more likely scenario of that code having holes is that someone hacks that central server. It's a very likely target as you just need to replace a file.

Hackers spent at least a year spying on Mozilla to discover Firefox security holes – and exploit them

Christian Berger

Re: Browsers are getting _far_ to complex

"I hope it gets you over your misinformation regarding http2"

Actually it just repeats the points that are debunked everywhere else. What you call "misinformation" is actually a reply to the arguments brought forward in articles like this one.

I mean if I pick a part from that article at near random, "The HTTP 1.1 request sizes have actually gotten so large over time so they sometimes even end up larger than the initial TCP window"

Yes that's correct, but the problem here is that this is because of abuse. People put more and more junk into those headers because they are trying to implement things like state into a stateless protocol. If you want a session use Websockets instead of cramming huge cookies into your HTTP headers.

Then there's stuff like Multiplexing connections... which may sound like a good idea until you realize that that means that you somehow have to prioritize the individual requests at the server. Browsers can do that rather well, as they know how to display the contents so they can prefer downloading the pictures you should actually see at the moment. This is _much_ harder on the server side of things.

And even in the most favourable tests, HTTP2 is just a bit faster, given that it requires lots of code even for the most minimal implementation, it's simply not worth it. And using libraries won't cut it as we have seen with TLS.