Posts by Paul Crawford 5665 publicly visible posts • joined 15 Mar 2007
I am always amazed and appalled that such systems are accessible either directly from the internet, or even internally from PCs used for web/email.
That level of security fail should result in senior executives facing jail time, maybe then they would pay more attention to having a network system designed on the assumption the bad guys are not only trying to get in, but are already in your web browser.
Year and a half old switch without trouble. Recently firmware updated and a month later all PoE power drops off, though "switch" is still working for traffic that is not dependant on PoE, unlike the security cameras for example...
Soft reboot recovers PoE. New firmware bug, or random glitch? Makes me wonder how often such upgrades are worth the risk of new exciting bugs versus any genuine fixes they include.
Time for some of this =>
We had Sun hardware from around 1988 until the mid 2000s when Linux was good enough and PC hardware sufficiently better value for money to move away. Early on we were also impressed by how good Sun's support was, not just getting spares but also technical queries, etc.
Alas our last Sun purchase was a 7410 storage system just before they were bought by Oracle and both that system, and the quality of support, turned out to be dreadful!
I have tried the 'sudo rm -rf /' on an old machine that was due to be reinstalled just to see how it would go.
The answer was very far indeed! Eventually the GUI display lost all text when the fonts were deleted, and when the disk LED finally went off I rebooted in to a live CD to view the results - pretty much everything had gone bar a few in-use directories like /proc and similar. rm had even rm'd itself!
While it is true that all Linux systems have the root/UID=0 account, in most cases now you can't actually log in to that account (you need to setup a password for it if you want to enable it).
Generally most distributions now have some user created at installation that has 'sudo' rights and that allows exactly the same permissions as root, but you have to know/guess the sudo accounts and their passwords. That is where the Rasbian version was dumb as it had no-password sudo on the 'pi' account and easy to log in if exposed to the internet, etc.
Also many systems disable SSH as root, so even if you have a root account enabled, you first have to SSH in as someone else (username & password/key) and then 'su' to root to use it.
If you worry about easy to guess passwords allowing that chain of attack, then you can set SSH to only allow key-pair login, so you have to have added the desired user's public key(s) in to the account's .ssh/authorized_keys file first. That effectively blocks brute-force SSH login, but is someone's machine is compromised they can then use the key to get in, so it is wise to limit login accounts so at least a password is needed to actually do much of note, or to have a password added to the SSH key (which breaks automatic login for checking/backup where key-exchange is usually used for no interaction).
I suspect many come over thinking the west is bad and a cesspit of moral decay as they get told at home, then find that things are actually not too bad here when all is said and done, moral decay is available for a small rental fee if desired, and there is a whole world of news and history outside of the great firewall.
I have only written recursive code ones - and that was to kill a process tree in Linux.
There so you execute stop on the parent so no more processes launched or reaped, deal with children, then kill the parent with SIGTERM (nice way) or SIGKILL (if needed). The "deal with children" is exactly the same but on a search for process with that have that as parent ID, so you can see how you just recurse the main routine on each child, then grandchild, etc, all the way down....
But knowing how the stack works I put a check in that if it recursed down more than X levels it would return instead of deeper recursion to avoid that process-corrupting (ideally segment violating) result.
Sadly this is a charity who bought a "professionally installed" system a couple of years back using MaxxOne DVR. That make has this monumental stupidity in terms of interface!
Of course someone "upgraded" one of their win10 laptops and now they can't access the DVR, other than via the shitty cloud service it also claims to offer.
So much fail on both sides.
You can create OS and applications in any language really.
But some lack the dirty aspects of memory management (and even lower like CPU protection switching) so they need bits in assembler or something C-like. Equally such low-level code has enormous potential to screw the system.
Horses for courses really, and most decisions come down to what will do this job well enough to get by.
Probably because the original was created before there were standard solutions, and many "standard" solutions turn out to be hopelessly missing some key feature or another?
Nothing to do with being a Uni, you will find the same issue of odd-but-critical systems lurking in many businesses older than a decade or so.
MISRA is the obvious one, based on automotive safety concerns, and then the is also the ones drawing up for the Joint Strike Fighter systems:
https://www.stroustrup.com/JSF-AV-rules.pdf
Another good overview and guide comes from the Numerical Recipes books, they cover many things but mostly it is about being consistent and readable. If only programmers could start with that!
An obvious example is The operation can't be completed because the disk is full when attempting to delete files (a Mac issue, I believe) . It simply shouldn't be possible for this to occur.
Same with windows 10: disk too full on cheap thing with fixed SSD so try and do a factory reset to clear the crap off it. Could not be done due to disk being full!
The "PC up to date" issue is often a case in science due to other factors, such as not wanting to (or being able to) interrupt running software, or some old but essential program that can't run properly with some update or newer OS.
That is OK provided said machines are sufficiently isolated, but usually there is no discussion between IT department and scientists on that sort of dirty detail, or you get a conflict problem when some IT manager simply won't accommodate it so it gets hidden so they can actually get on with important work.
The side effects are just as you describe...
Wow - full marks to her for doing something that significant.
I think many in the UK also thing Boris is a useless buffoon, but sadly none of his party have had the balls to kick him out yet (possibly due to a shortage of alternatives that would do better than the already very low bar he has set).
The problem is how do such "robots" deal with odd situations. After all, and in spite of the hype, AI is not intelligent, it has no internal/conscious model of the world and understanding of how to move a car and avoiding things. It is a neural net that get loads of training data thrown at it with the hope that all cases end up being covered.
So it fails, and often in cases that to any human are obvious. How safe in the world at large, i.e. beyond the specific training grounds used, can it be trusted to be? Are the companies behind it going to prioritise safety, or profits? As we all know the answer to that one, how do we (as a society) make sure that they are punished financially and with jail-time as needed for failing to maintain the highest standards?
Yes, humans are not reliable but the goal for an automated car is not "better than human average" as that includes many bozos, it should be better than a good driver who is fully alert. I.e. it has to be well in the upper quartile of accident statistics.
An "absolute air gap" is very hard to maintain, but the reality is having the equivalent of no external connection massively reduces the attack surface.
In many cases good security practice (e.g. simply disabling macros in Office, making user-writeable areas non-execute, etc) and segmenting external web/email machines from the rest is going to seriously impede an attack.
You mean to dick around with a functioning UI so it "looks cool" and is less productive?
Or is this about making the same mistakes over again?
All businesses need succession and new folk/new ideas coming in, but equally the new folk benefit from the guidance and experience of those who have been there and bought the T-shirt. A sudden plan like this smacks of the very leaders needing a bit of a clear-out. Still, at least the Japanese are being a damn sight more honest than IBM.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
