* Posts by Christian Berger

4850 publicly visible posts • joined 9 Mar 2007

Malware-flingers can pwn your mobile with over-the-air updates

Christian Berger

"...but the operating systems used are pretty old and thus fairly robust."

I'm sorry, but just because software is old, it doesn't mean its good. Windows for example had perfectly well documented exploitable flaws in its API for decades (LNK Autostart "bug" used in Stuxnet).

Baseband code isn't looked at by many people. Large parts of it were developed in the early 1990s when people didn't know about security. It was never tested against malicious attackers.

In fact if you look into the whole picture, you will even find deliberate security holes. For example your operator can use the SIM toolkit to just change the number you are dialling to everything you want. This probably even works for other operators when you are roaming. Trusting that your call actually arrives at the number you have called is the trusted element in many "secure" systems. You'd be surprised how many PCAnywhere installations relied on call-back for security.

Mobile phones (both smart and dumb ones) aren't secure devices, they probably will never be. That's why the part the operators care about is in an extra module (the SIM). We need to stop thinking that those devices and networks are just secure black boxes.

Gnome cofounder: Desktop Linux is a CHERNOBYL of FAIL

Christian Berger

Re: Fragmentation

"Why would you want to change the task scheduler of your OS while on vacation?"

Uhm, because it's a vacation. People do fun things on vacations.

Christian Berger

Re: Minority Report

Actually in real life he'd probably have been faster. Gesture control is very low bandwidth, you not only have a very fuzzy, but also a very slow language. Voice would be better, particularly for constrained systems. Saying something like "zoom 25" is fairly quick and precise.

I'm not sure however if voice would be faster than the keyboard. Although most people are faster speakers than typists, typing is considerably more precise. You can afford to have commands like vim, consisting of only 3 letters and one syllable. In voice based system that wouldn't be possible. Commands would have to be longer and you would need more redundancy for less probable commands. (You can still have context dependent commands like the single letter commands inside of vim, those would be like the "zoom" command in the above example.)

Christian Berger

Re: Fragmentation

"They just want the (expletive) thing to work, first time every time. Turnkey simplicity."

Fascinating. Every time I have tried commercial software in the last decade, this is what I've been missing. You know for the last 10 years you simply install a Linux onto a normal computer and it runs with full hardware support no drivers to install, no configuration to be done, the base system simply works and you even get a browser.

While on Windows you first need to somehow get drivers for all your hardware since next to nothing is included with the operating system. If you connect even simple devices like USB to serial adapters you are greeted with a cryptic message asking you for drivers... even though all of those devices use exactly the same protocol.

MacOSX is better when it comes to hardware. Things often just work, but then again if you need any kind of software you are typically screwed. At least current versions of MacOSX have a rudimentary package manager mostly aimed at commercial applications.

There are frustrating times when I file bug reports for things obviously done by someone not thinking, but often when I look at commercial software I don't understand why anybody would voluntarily pay for this.

Christian Berger

Re: the Unix vs. Windows battle in Linux

Actually NetworkManager is a good example why you should have text configuration files. What NetworkManager does is that it tries to somehow magically find out what you want. It's great when it works, but horrible when it doesn't.

In an ideal world, the parts of NetworkManager would not communicate via an opaque dBus protocol, but via configuration files, allowing you to swap automatic detection for manual configuration if you choose to.

XML for configuration is not much better than having a registry, since editing XML can be difficult and it's easy to screw up an XML file completely. XML is great if you have huge tree-like things to configure, but for things like network configuration, a simple stanza-based format is far more robust. You have a series of configuration options, grouped into stanzas by empty lines. If you come across an unknown option you print out a warning during parsing. That way It's easy to detect typos, but you can still parse the file.

Further more you have directories instead of simple files, if you have some piece of software creating a configuration (i.e. the part that detects modems), it'll simply create a file called 10-modemmanager.conf in some interfaces.d directory. This file will then usually not be touched by other programmes and modemmanager can just overwrite it.

Trying to create a "one size fits all" solution is hard and usually results in systems far more complex than needed and next to unmaintainable. The better way is to choose the simplest way to achieve a certain goal.

Christian Berger

the Unix vs. Windows battle in Linux

I personally interpret this as the Unix vs. Windows battle in Linux. On one hand you have those people who who have a Unix background, on the other hand you have people with a Windows background. There are fundamentally different approaches in both.

Lets just look at configuration files. On Unix you always have text files, since you have a great bunch of tools to deal with text and every programming language can deal with text easily. There may me rare exceptions, but simple things like /etc/password are certainly simple text. On Windows this is all binary. In order to access it, you need to learn a special complex API or use the GUI provided.

Also on Unix programmes communicate via text over files and pipes and maybe via the network. On Windows you have more complex process communications systems like OLE or DCOM.

What is now quite interesting is how both groups defend their positions. While the Unix crowd typically relies on basic principles formulated in books like "The Art of Unix philosophy", the "Freedesktop/Windows" crowd answers criticism with things like "Do you want to halt progress?" or "DO YOU HATE BLIND PEOPLE?" (sorry for the caps, but that particular quote was screamed at a talk).

In my personal opinion the Freedesktop people have gone to far. Though they may have had interesting ideas, things like NetworkManager have become unmaintainable. It's lacking important features to make it work if it makes an error.

Don't believe the IT hype: Ye cannae change the laws of physics

Christian Berger

Sometimes SQL-servers are not the right solution

A few years ago I was involved in some project where large series of measurements had to be displayed in a web app. We are talking about 30 million data points here. The first solution the web designer came up with, was something based on MySQL. It was far to slow to be of any use. Getting a subset of the data took many seconds. Then I took my time to write a specialized piece of software working on simple files. It provided the same data in fractions of a second.

Christian Berger

Re: TCO

Well true, the licensing cost is only a tiny fraction of the TCO. However with open source solutions there is the great thing that you can have multiple sources of support for the same product. So you can choose the one you prefer most. Plus you might even be able to find employees involved in the development.

Bank whips out palm-recognition kit - and a severed hand won't work

Christian Berger

Re: Fixing the wrong problem

Yes and think of the instances where the victim will be killed afterwards so he won't be a witness.

Essentially this changes a crime from "steal an EC card and find out the pin" to "kidnap and perhaps murder a person". I don't see how that's an improvement.

If you want to do something against people stealing money, start regulating investment banks more heavily.

Christian Berger

Re: Still Snake oil

Exactly, and once you have a second instance using the same system, you'll have the same "secret key" on both systems. The next step is to build some sort of model hands with the right patterns. Maybe it's even possible to use some sort of modified LCD.

And that's all not taking into account brute-forcing those systems which may be possible.

Torvalds asks 'Why do PC manufacturers even bother any more?'

Christian Berger

it's the Windows handbrake

You cannot comfortably use Windows on a high resolution display. First if you enlarge your font your windows will look funny (as most Windows toolkits don't scale), then you will end up with either ridiculous full screen situations where you have just a fraction of the window actually used, or you'll get one of the many non-resizable windows where you have a tiny little view into something larger (i.e. a log file) you cannot enlarge.

Most Windows applications simply were designed in the 1990s. Back then 640x480 was still a common resolution and more than 1024x768 was virtually unheard of in the PC crowd.

Christian Berger

traditional "business models" aren't that relevant in open source

Most companies use open source software to "outsource" part of their own internal software development. Why bother making your own kernel/ip stack for your router when you can just use Linux.

It just makes sense to contribute to a larger project instead of creating that large project all by yourself and locking it away.

That is by no means something new. When colour TV came to Germany, manufacturers designed a "common chassis" for all colour TV sets which manufacturers would then license and build. The only difference with open source is that the monetary aspect disappears. So instead of charging symbolic fees you charge nothing.

Christian Berger

Re: Agreed

Well most GUIs can be upscaled for people with bad eyesight. For people with normal eyesight most screens/guis are far to large. Particularly on mobile devices you want to have small text.

SimCity 2000

Christian Berger

It was responsible for a large part of ParityBoot B infections in Germany

Because SimCity 2000 only ran on 4 Mb PCs if you had special minimalistic boot setups. So many people booted their PCs from a diskette in order to be able to play the game. And booting from diskette is the main infection vector for bootsector viri.

Big Blue touts superfast analogue-digital converter

Christian Berger

Re: data rate explanation?

This is probably just a research prototype leading the way to considerably faster ones.

Christian Berger

Re: Speed is impressive

Well it's a great step up from the 5 Bit converters you currently have in fibre optic connections. (and even there only in the really fast ones) And even those converters are already in the price range of several $100.

If this one could be cheaper it could be a revolution.

Stop saying 'Cyber Pearl Harbor,' RSA boss pleads

Christian Berger

Re: "... and the cost in terms of reputation that victims could face. "

It would be nice if Reputation was important, but companies usually don't care, they can just blame it on the hackers. Since the dumb customer doesn't understand a thing, they can leave their passwords as 1234 and won't get blamed for it.

Christian Berger

Re: " VP of Microsoft's Trustworthy Computing Group"

Well seriously as much as I dislike Microsoft, but that group has actually moved something. They are responsible for Windows going down from a random infection every 30 minutes after connecting it to the Internet, to nearly nothing. Now you need user intervention or the Flash or Java plugin to own a Windows machine. (or good SEO and a warez site)

Still they are also the ones mandating locking down computers with things like "Secure Boot", so it is a double edged sword.

Of course then there is also the group of people who find Microsoft trustworthy just because it's a big company. Those are common among industrial control company.

Christian Berger

We really should increase security levels at critical infrastructure

Stop using proprietary protocols like DCOM (used by OPC, OLE for Process Control). Stop using overcomplicated protocols like OPC-UA which are likely to have huge security implications and have _never_ been even close to someone with any knowledge about security.

Stop using operating systems which are _way_ to complicated to be managed. After all one of the security holes in Stuxnet was actually a well documented feature in the manual. (executing the stub code of .dll files loaded because they contain an icon referred to by a link file) If you don't understand Windows and aren't prepared to _learn_ about it, don't use it. You can easily get a stripped down version of Linux which is far easier to understand and secure, or some minimalistic micro controller running a minimalistic protocol.

However the opposite is happening. People are currently talking about "SCADA in the Cloud", of course with Microsoft Azure. In those areas choosing Microsoft is still fine as it's a "big trusted partner". (That's usually the only justification you'll here)

Four firms pitch hi-def DRM for Flash cards

Christian Berger

As Wau Holland once said

"Es gibt keinen Kopierschutz nur einen Kapierschutz" (There is no protection from copying, but only protection from understanding)

McAfee dumps signatures and proclaims an (almost) end to botnets

Christian Berger

Can be done simpler

There is some research going on into assisted proof of software.

Essentially whenever you write a piece of code you need to proof that it works correctly. This proof will be checked by the compiler. (just like some compilers can already check for array boundaries, etc) The current research is about how to make a language which integrates code and proof in a good fashion so it's not to much overhead.

In the end you can for example proof that data marked "private" will never reach the network card driver. And that you will never overwrite your stack. Some people even go further and add types to the memory so your CPU can check for types. Those types can include features like "private" or "local" or whatever you want to.

This is of course a long term goal, but it's being worked on. And ideally you don't loose any/much speed.

North Korean citizens told: Socialist haircuts are a thing... go get some

Christian Berger

Re: Resistant to western influence?

"Elvis was a communist!"

You might be confusing him with Dean Reed, "The Red Elvis".

Christian Berger

@Rampant Spaniel

"Exactly, and why is the leadership focusing on haircuts and nuclear weapons when there is a slightly larger problem of most of the populous starving to death."

That can be said about most governments. Why are governments talking about stricter copyright enforcement or (anti-) terror laws, when there are slightly larger problems of education and, in the case of some countries, most of the populous starving to death.

Governments very seldom actually solve problems. That's because if you are rational you will agree with most of your peers and never stand out rising to power, and most government positions are filled with people who don't have problems.

Hands-on with Ubuntu's rudimentary phone and tablet OS

Christian Berger

What about the cool features?

How does one access the package manager? How does one access the shell?

The great thing about having a normal OS on a mobile device is that you can run normal software. This is particularly useful for non-GUI applications like VPN clients.

Happy birthday, LP: Can you believe it's only 65?

Christian Berger

Actually even most cassette tape recorders were perfectly able to normalize audio.

Christian Berger

LPs might have a bit of a comeback

Last year I've been to a flea market, and I bought some LPs. Now the wonderful thing about those today is that they are darn cheap. You can get one for one Euros. Sometimes even 5 for 4 Euros. And there's lots of different stuff in there.

Then when you get home, you carefully pull them out of their sleeves and put them onto the turntable, curiously waiting for what's on there, as the stylus tracks the groove. That way you get to know lots of unusual music you would have never bought in the first place. You may find lots of it shit, but nevertheless you might find a new band you like... only to find out it dissolved in the 1970s. :)

BlackBerry squashes W-TIFF-F bug that's ripe for malware squirters

Christian Berger

Wait? It needs admin permissions? What for?

It only needs to act as a proxy between the mail server and the mobile device what on earth could it need admin permissions?

Christian Berger

Not the first time

A few years back, a bug in a popular image processing library was found. Some months later Blackberry, which apparently used that library, admitted to having a security hole.

Acer's Wang: Size of PC shipments to shrink month after month

Christian Berger

:) They have an employee called 'Wang' :)

Must be hard for someone working at Acer to be called after another company. Next thing will be someone working at IBM called "Compaq".

Amazon ditches 'neo-Nazi' security firm over alleged harassment of workers

Christian Berger

ARD is not exactly a state broadcaster

Though there is some influence (which is already to much of course) from the government, it is legally designed not to be a state broadcaster. (except for one flaw)

Besides the ARD is a working group of broadcasters. The ARD by itself does not actually produce stuff. Local broadcasters provide content for it. (or commission content from external companies, etc)

Bill Gates: Windows Phone strategy was 'a mistake'

Christian Berger

Re: Sorry, Billy, You blew it with Windows CE ....

Hmm, I wouldn't see it that way. Of course Windows CE wasn't good. It lacked essential features, crashed a lot and was limited in strange ways, but at least you could get your own software onto it easily without having to mess around with keys. It was a serious competitor to Java ME. It was, in a nutshell, an approximation to the win32 API.

Now imagine Microsoft would have just ported the Windows NT kernel to ARM (as they already did with PPC, MIPS, Alpha, etc) and added an x86 emulator (as they already did on Alpha) and they had an interesting product. You'd have to change the GUI guidelines of course, but other than that, porting to it would be easy and sometimes you wouldn't even have to do any porting. Plus you'd immediately be able to run all your "non-visual" software. Need some special VPN software? Just run it, it might be slow but it'll work.

What they have now is a deliberately incompatible version of Windows. It has all the disadvantages of the desktop version, but no advantages. Microsoft seems to have misunderstood that their lifeline, particularly in the business sector, is their compatibility with their previous products.

Inside Microsoft's 'Cloud OS'

Christian Berger

And again, many people will missunderstand the title

While it was probably meant as "Why Windows Server 2012 is better than other Windows Servers", and probably meant to be something close to a marketing blurb, many people will read it as "Why Windows Server 2012 is better than something unixoid" and start complaining about that.

Those are different markets. People considering WS 2012 would probably never run a Debian, and people running Debian would probably never touch WS 2012 except for legacy applications.

IDC: Android, iOS now own 91.1% of global smartphone sales

Christian Berger

Hard to say

I'd say the market would be more fragmented. Maybe Windows Phone would have had a chance gathering some of the "don't want Apple" crowd, while Apple would gather the "don't want Microsoft" people.

Android is just a huge pot for people who don't want any of those.

I'm not sure if Android was _the_ game changer. It's just the "cheapest" (regarding license costs) of the mobile touch and slide OSes.

Microsoft exec: No 'Plan B' despite mobile stumbles

Christian Berger

Or with Windows CE

Windows CE at least had something of a point. It was at least open to your IT department so they could install programs on it. Currently they are just chasing the IOS and Android crowd, ignoring that those people already buy IOS and Android.

Windows CE, despite of all its limitations, would have been something businesses already know and trust. The current offerings simply alienate existing customers without bringing in new ones.

Billionaire baron Bill Gates still mourns Vista's stillborn WinFS

Christian Berger

That's the Windows philosphy

Just like there's a Unix philosophy which mandates small single function programs and file formats in very simple text formats, the Windows philosophy wants to have everything in complex binary formats. Both has its own beauty, though you may find one more usable.

The Art of Unix Programming summarizes this quite nicely. It contrasts the simple file API of Unix, where you can essentially read and write text to files, with the more complex APIs you have on Windows which allow you to create complex file formats. The big problem with those APIs is, that they have a certain learning curve. If you wanted to create software writing into a database-like file system, you'd need to learn the APIs and write your structures in a way the rest of the system can handle them. That's something few Windows software developers care to do, so even with such a file system, they would still write their files themselves.

Intel's new TV box to point creepy spy camera at YOUR FACE

Christian Berger

Re: Tape

OK, then the system probably will refuse to work. Previous systems have done that.

Christian Berger

That's why you want open source

I mean a camera can have its advantages. For example you can video phone or you can have the device lower the volume when you are doozing off, etc.

However you don't want to have to trust a company like Intel to not abuse this power. That's why you want to have open source. Software which is transparent, which you, any everybody else can examine and change. And if _you_ don't like it, you can use an alternative version.

Register reader Ray revs radio-controlled Raspberry Pi race rover

Christian Berger

Nifty, but the camera is missing of course

To bad USB cameras don't work well with the PI. Ohh and maybe one can add UMTS, so it's truly mobile. :)

Clash of the Titans: Which of you has the greatest home lab

Christian Berger

Re: Maybe some more detail on my setup

Yes, they are certainly the way to go for home storage. Where else do you get ECC systems that cheaply and with such a modest power draw?

Christian Berger

Re: Maybe some more detail on my setup

Ohh and BTW, I do have one of those HP-microservers, but it's currently not in use. I need to move and it'll probably be my main server in the new flat.

Christian Berger

Maybe some more detail on my setup

Well the NTP server was already mentioned. It gets it's time from a GPS receiver.

It also has 4 DVB-S2 tuners and acts as my "PVR". Of course it has about 3 Terabytes of disk in a RAID-5. It also acts as a streaming server to the "Freifunk" network.

My main computer has ECC-Ram (16 Gigabytes) as well as 8 2 Terabyte disks running in a RAID-6 configuration, something I wouldn't do again.

Other than that I'm running some OpenWRT-based routers as part of the "Freifunk Franken" meshed wireless network, and a rented virtual server running outside handling e-mail, web as well as an Asterisk server I like to fool around with. :)

My current Internet router is some random Atom box connected to the DSL modem. It also runs a transparent proxy for fun and provides me currently with IPv4 and tunneled IPv6.

Mind out, Apple: Ericsson leads charge against the SIM

Christian Berger

Re: eCall

Actually till recently you could even call the German emergency services without a SIM card.

Christian Berger

Why not make it user accessible?

I mean that would obviously be the way to go. It would be just like a password.

I mean it's not like it hasn't been done before, the German "B-Netz" (second generation analog radio phone network, now with direct dialing) did it like this:

http://www.oebl.de/B-Netz/Technik/Loet.JPG

The solder bridges defined your phone number and wherefore where it was billed too.

Christian Berger

Re: Good ol'SIM

Well the problem of GSM interception lies in 2 parts.

1. Man in the Middle attacks are easily possible. (Basestations can turn off crypto)

2. The crypto is fairly weak. (by todays standards)

CDMA is probably not much better in that regard, and packets have nothing to do with it. There's just a far smaller crowd of people dealing with CDMA security.

3 million Freesat receivers now out there, and boxes to get YouTube

Christian Berger

I have a VDR

I can't get Freesat branded devices in my country, so I'm using VDR with the eepg plugin. It works reasonably well. The upside is of course that I have a fully open source solution, so I can record and store anything I want however I want.

With normal DVB-S compliant receivers (like the one inside my TV) you only get "Now and Next" as well as Ceefax. Your country is weird in that it doesn't carry TV listings on Teletext, only subtitles.

Playmobil punts bank-heist set to wide-eyed kiddies

Christian Berger

Re: Good to see they still make...

Well there's also "Bruder", they make a fire truck with an actual pump. :)

http://www.youtube.com/watch?v=RC--OhVOh28

Christian Berger

@Ian McNee

Actually I'm surprised to see an ATM at all. I've been to Playmobilland before. It's a little enclave inside of Germany. As far as I know they are not a member of the EU and you need a Visa, which you can get at the border for 10 Euros.

I have not seen any ATMs in the country. Even if there were some, they probably would be heavily guarded. There are lots of guards in Playmobilland. Just like the palace guards they usually stand around doing nothing.

Curiosity raises mighty robotic fist, punches hole in Mars

Christian Berger

Re: That pic would indicate...

Oxidised rock? That would mean there were chemists on Mars, wouldn't it. Or at least laboratory assistants.

Pope resigns months after launching social networking effort

Christian Berger

Re: @ShelLuser

Of course.

Christian Berger

It takes a great man...

... to admit that ones strength of mind is deteriorating.

Although he wrote that in Latin as far as I know, so that's a man saying he's to stupid for the job, who probably is still more intelligent than most heads of state. :)