* Posts by Vic

5860 publicly visible posts • joined 7 Dec 2007

Samsung: Don't install Windows 10. REALLY

Vic

Go Apple if you want forever support -my Macbook Pro from 2007 still running, now tricked out with SSD and max RAM, works great.

I have four Macs of varying vintage[1]; none of them are usable with any Apple software[2] that could even vaguely be considered "current".

Vic.

[1] One of them is *so* old that I can hardly expect anything to run on it. But the other three are younger than most of my computers.

[2] I did get Fedora running quite nicely on one for a while - but I haven't used it in ages, and I don't know the current state of that Fedora spin.

CERT warns of hardcoded creds in medical app

Vic

Re: @Vic (was: Remember back when ...)

In the second, I alluded to perception of the difference between hardware and so-called "software"

You didn't. You merely claimed a different type of storage medium was used on those machines than might otherwise be expected. I neither know nor care whether your claim is correct.

If you think this was drawing a distinction between hardware and software, I've got some bad news for you...

Vic.

Vic

Re: Remember back when ...

but the root/passwd on early SUN gear was stored in EEPROM, not on disk.

What difference would that make?

Vic.

ISS pump-up space podule fully engorged

Vic

Re: How space-junk-proof is it?

Since the fabric of this is flexible, there is an opportunity to deform slightly without breaking

As such an impact will dissipate a little energy from the foreign body, I imagine they could use the discarded BEAM to clean up some of the debris already in orbit...

Vic.

As US court bans smart meter blueprints from public, sysadmin tells of fight for security info

Vic

Re: I thought I recognized "Sensus"... We have met the enemy and he is (Sens)us

The process to disconnect a customer with a smart meter is exactly the same as the process without one

...At the moment.

What happens when the baseload supply diminishes as power stations are closed, but demand keeps on rising? My money's on emergency powers being brought in to enable temporary disconnections via smart meter to protect the grid. And we're straight back to the 1970s again.

It's always a mistake to assume that a greedy/desperate government won't change an existing law to protect themselves.

Vic.

Vic

Re: GPl

They are obliged to provide a copy of relevant code on request to anyone who owns one of their products

No, this is competely wrong.

Under GPLv2, they have the *choice* to distribute under Section 3(a) or Section 3(b). A Section 3(a) distribution would have the source code issued with each and every meter, and any recipient is free to redistribute under the usual GPL terms. Very few companies do this.

Under Section 3(b), the distributor must deliver code to any third party who asks for it. The promise must be valid for at least three years after last distribution.

For anything uder GPLv3, Section 6(a) replaces Section 3(a) above, and Section 6(b) replaces Section 3(b) above. Sections 6(d) and 6(e) cover digital transmission of the object code without reducing the obligations.

Also, provided they've done things correctly, they only have to provide the base OS and its supporting programs, their application code is still theirs and is not subject to the GPL.

If they have provided a "mere aggregation" of GPL code and their own proprietary code, then they only have to provide source for the GPL works. But this is rarely the case; far too many PHBs seem to think that they can comingle GPL code with their proprietary code, and not offer source to any of it. This is what is frequently (and wrongly) called "piracy", and can land the offender in very hot water...

Vic.

The Windows Phone story: From hope to dusty abandonware

Vic

Re: "Universal" anything is always a disaster...

Java has seemed to do the job of write once run everywhere to the best degree

Can't agree with that. There's a reason people have coined the term "write once, debug everywhere"...

Oh, but that's assuming you don't need gui, controls/input and all the other os/device specific stuff that is impossible to predict.

One of the biggest problems, IMO, is the inability to have much control over different threads of execution - which is explicitly prevented by insisting on this "run anywhere" goal. If you can't dictate the underlying threading model of the platform, you can't dictate the run order of your threads. And in a multi-threaded environment, that can be a real problem...

Vic.

Vic

Re: Hopefully

Linux amounts to "do it yourself"

This isn't true, of course - full-service Linux support companies exist pretty much everywhere.

But with Linux, the option to do it yourself exists. That doesn't mean you have to take that option.

Vic.

Vic

Re: Track Record

I didn't count keyboards as they are dumb units, just an array of switches

They're not. There's a micro in there.

On the 286, the keyboard controller was actually used for context switching...

Vic.

$10bn Oracle v Google copyright jury verdict: Google wins, Java APIs in Android are Fair Use

Vic

Re: C'mon guys, we should cut Oracle some slack here.

Why?

Because you want the body to drop a foot or so before the noose fully tightens...

Vic.

ISS pump-up space podule refuses to engorge

Vic

Re: Sunlight

Couldn't the ISS crew try to re-inflate this once every 90 minutes if necessary?

Mate, when you get to my age, ...

Vic.

Bank in the UK? Plans afoot to make YOU liable for bank fraud

Vic

Re: Grey area

If they're thinking of shoving fraud liability onto the customer, they should at least start by making sure all their sites are A+ at the very least.

They should do a whole load to improve security.

I'm thinking primarily of the "3D Secure"[1] system. The banks are actively promoting putting (fragments of) a password into an iframe on a website that does not come from the bank's server. IIRC, even the iframe does not come from the bank.

This is just asking to be MiTMed...

Vic.

[1] Ha!

Dropbox gets all up in your kernel with Project Infinite. Cue uproar

Vic

Re: Why kernel driver?

Do you really think the people at Dropbox are idiots?

I never used to...

Vic.

Whitman deletes another chapter in HP history as CSC and ES borg

Vic

not producing growth, while at the same time consuming lots of management attention

Yeah, those two are often strongly-correlated. Can't think why...

Vic.

Beleaguered 123-reg customers spot price hike

Vic

"hit me up next time u need hosting or web services, was my prev job, i'm a right geek wen it comes to this"

Someone so clearly challenged when it comes to linguistic accuracy would not be getting my business for something that so clearly requires getting textual settings right...

https://www.spamflame.com/

First post, spamming us a link to a commercial organisation. That smells a bit funny...

Vic.

HP Inc-eption: Our new 3D printers print themselves, says CEO

Vic

Is this really news?

The RepRap has been printing its own parts for years.

HP has had one of those reverse premonitions again...

Vic.

Microsoft won't back down from Windows 10 nagware 'trick'

Vic

I think the real reason for M$ getting this desperate is their precouses Windows Mobile platform took a heavy knock recently due to the dearth of apps in the App Store

I think it's the other way round...

For years, Microsoft has made a fortune selling software of variable quality because its customers know where they are with Windows, and often fear to try something different - just look at how often we see the "Linux means retraining all my users" canard here.

With the advent of mobile computing, people are already taking their first steps away from Microsoft - and are realising that they no longer need to Redmond Behemonth. Too much of that, and Microsoft's empire will crumble.

Thus we have the Windows Phone play (of whichever recent flavour - the strategy is the same, it's just the implementation that keeps changing); MS is trying to get mobile users to associate thei mobile computers with their desktop/laptop/other computers by giving it the same interface and - largely - the same ability to run software (we'll ignore RT for the time being). This is the mechanism by which Microsoft expects to prop up its desktop monopoly.

But it's all going wrong - Windows Phone is a rounding error, so it isn't going to prop up anything. And by gluing the mobile-style UI on top of the desktop product, MS has alienated a huge number of its long-term customer base. The end result of pursuing this policy will be to cause the MS desktop saturation to decline.

There is a simple way out of this for MS - drop the GWX bollocks, drop the spyware, drop the forced upgrades, put the Win7 UI onto the chassis of Win10. The result will be something that plays much like Win7, but with the improvements[1] of the Win10 OS. And that will involve eating a lot of humble pie; I don't expect them to do this until it is far too late to save the empire...

Vic.

[1] I am told - by people who know - that the improvements under the covers are very real indeed. I don't have sufficient eperience with Win10 to be able to prove such claims, but I am happy to acknowledge them.

Vic

Ubuntu 16 went on happily enough. ui not very good

Pick another one - you have choices now. Find something you like, rather than something you're required to use...

Vic.

US nuke arsenal runs on 1970s IBM 'puter waving 8-inch floppies

Vic

Because the electronic ones suffered from Braun-outs?

That was a Krupp pun...

Vic.

London to Dover 'smart' road could help make driverless cars mainstream – expert

Vic

Re: Traffic lights

They have all this technology and IMHO it's not implemented correctly

That's your opinion. The junction designers will, obviously, disgree.

you will notice a vehicle at the lights say 200 yards ahead and the lights go on green but by the time you get there it's back to red, no vehicle has come onto or through from the junction from either side

This is frequently the case if you are trying to drive between lights above the speed limit[1]. It is deliberate.

can't we have a system that sees say ten cars on the main road and two on the minor road and adjust the lights accordingly?

Yes, you can. And, moreover, you've got it. Junctions have counted cars and measured approach speeds for *decades*. The behaviour you are seeing is almost certainly the behaviour the designer wanted. There might well be a good reason for him wanting something different to what you want.

This road is a particular pain in the bum as the speed limit on parts of it have been reduced to 40 MPH because of a few pedestrian accidents and at least one bicycle death.

If you've got pedestrians and bicycles on the road, that really doesn't sound unreasonable to me. Have a go at walking/cycling along a road with traffic coming past you at 60mph - it's really not pleasant, especially when certain drivers can't estimate the width of their vehicles as well as they think they can[2].

It's a three lane road in some places FFS the same as most motorways

It's very different from a motorway. A motorway is entirely populated with performance motor vehicles driven by trained and qualified drivers.

If traffic lights were clever and detect that one side of the junction was far busier than the others it could instead of just being on a timer and adjust accordingly, maybe this already exist to a degree but I've never seen it in action

It is probable that every major junction you've seen in the last 40 years or so has done exactly that - you will usually see at least two sets of tar-filled trace cuts in the road (diamond or rhomboid depending on manufacturer) and often IR and doppler sensors on the signal head. That this system gives different control signals to the ones you want might give you pause for thought.

Disclosure: yes, I've worked in this industry.

Vic.

[1] I've seen - and made - many claims that the target speed is actually less than the speed limit. I cannot confirm that it is so - but that might be appropriate at highly-congested times, when a small reduction in speed leads to a large increase in throughput.

[2] I was walking along the road in Lymington a couple of weeks ago, and actually had to jump into the hedge twice to avoid being hit by vans. It is time for motorists (including me) to be held accountable for their actions...

British cops to film you with 59k body-worn cameras by end of year

Vic

Re: Can you film the cops in Britain?

You can do this in the US, when the cops are in the public, can you do this in the UK

With very few exceptions[1] - yes, you can.

Of course, that won't stop them trying to confiscate your equipment and claim you're acting unlawfully...

Vic.

[1] e.g. when your use of a camera would inadvertently record images of a secure establishment where photography is not permitted.

Vic

Re: I'm reminded of this advice...

I'm reminded of this advice:

http://www.kirkpiccione.com/10-reasons-not-talk-police/

Whilst this is all reasonable stuff, be aware that this is very much US-only advice. The UK has different "rights"...

Vic.

Vic

Re: I wonder how this will square with PACE?

So why are they spending what must be quite a lot of money in advance of those changes that will be required?

I think this works best without changes to the law.

In the event that a police officer is accused of malfeasance of any sort, the camera will usually answer the question immediately - so an innocent officer can be exonerated the same day, and a guilty one shown up for what he is[1].

Changes in the law to remove the PACE safeguards would be an enormous retrograde step.

Vic.

[1] Neglecting any camera fault / flat battery -type excuses (which would probably be grounds for increased scrutiny).

LinkedIn mass hack reveals ... yup, you're all still crap at passwords

Vic

Re: And move to what ?

there are also people I know abroad and phone calls are not cheap

Phone call pricing is really quite bizarre.

I phoned my brother in Sydney the other week. A phone call to the other side of the planet - and it was cheaper than ringing my next-door neighbour...

Vic.

Vic
Joke

Re: Attitudes to risk

In the case of LinkedIn they could get in touch with your contacts and tell them they're a c**k, that you shagged their mum, that you worked somewhere disreputable, that sort of thing.

...Or they could say somthing that's untrue...

Vic.

Labour scores review of Snoopers' Charter's bulk powers from UK.gov

Vic

Independent?

an independent reviewer ... appointed by the government

It's always easier to get the result you want from an independent when you get to choose who he is...

Vic.

IETF spikes government metadata collection with DNS request crypto plan

Vic

an attacker, upset at the comment could correlate DNS access times and post times to retrieve the posters IP address

No, I don't think so.

When we first come to these fora, the browser loads forums.theregister.co.uk, which will result in the first DNS lookup. That returns the appropriate record - in this case, a CNAME to the address of the www server, and potentially a couple of A records.

Eacjh of these records has a "time to live" value associated with it - for these fora, all the records currently seem to be set at 300 seconds (which is a bit short, but there you go). That means that your computer won't even try to look up those records again if you do something within 5 minutes; a visit to the fora is indistinguishable from a post to same if you're quick, and from an upvote/downvote if you're not.

On a sufficiently busy site, with a reasonable TTL, and reasons for interacting with the server (e.g. the voting buttons), correlating DNS lookups with posts is going to be incredibly error-prone. You might be able to find something over a *very* long period of analysis, but I wouldn't consider it realiable.

Vic.

Don't tell the Cabinet Office: HMRC is building its own online ID system

Vic

Re: Holy crap

Use Verify to Authenticate an individual, and it's own internal system to Authorise that individual to do something.

That's a potential minefield when you have firms of accountants; you need to authenticate someone as a member of that firm, and that means having the firm's owner/controller maintain a list of people who are authorised for each potential client.

It gets messy real quick...

Vic.

Shakes on a plane: How dangerous is turbulence?

Vic

I was on one back to LHR from BRU that felt like it had its wheels on the ground the whole way. Bloody bumpy it was.

The most worrying turbulence I've ever had was early on in my flight training.

It was a perfect flying day - plenty of visibility, little wind. I was flying a 360° level turn. As I turned back onto my original heading, there was a pronounced bump - I thought I'd hit something.

I had hit something - my own wake. And it was lumpier than I was expecting...

Vic.

Vic

Re: Betteridge's law of headlines.

For some reason it reminded me of this:-

I was reminded of this one.

Vic.

Airbus to build plane that's even uglier than the A380

Vic

Re: Beluga Fans in Uproar Shocker

Thank you for confirming that I am doing my job!

You'd do it better if you arranged a few facility tours. There are quite a few plane geeks on here...

Vic.

Vic

Re: @Bruce

That seems to be contradicted by ...

http://www.seatguru.com/airlines/Air_New_Zealand/Air_New_Zealand_Boeing_777-200_NL.php

Although slightly old now, there's an interesting diagram of the Delta seat layout available. I suspect other airlines will be quick to copy that.

Vic.

Vic

Lockheed SR-71 Blackbird - sexiest plane EVER.

Bit shit for carrying large cargo loads, though...

Vic.

Flying filers and Game of Thrones: Jon Snow? No, latency is dead

Vic

Re: So where's the details?

It reads like marketing fluff.

There have been some changes around here lately. There was a missive about it at the beginning of the year, IIRC.

This is the new El Reg.

Vic.

A UK digital driving licence: What could possibly go wrong?

Vic

Re: Trust DVLA?

After long calls with DVLA I was told to just forge a signature.

Long before SORN, I went in to a DVLA office to pay the back-tax on a car I had that hadn't been taxed for over a year.

They wanted my reference number from the Police. I didn't have one.

The (rather condescending) clerk then explained to me that I would have been gevin a reference number when the Police caught me without road tax, and that was what they wanted.

I then explained that I hadn't been caught, and simply wanted to pay the back tax because it was the right thing to do, and I didn't want to get caught.

They had absolutely no idea what to do with this situation.

In the end, a senior manager had to be brought out to deal with me, and we thrashed out a mutually acceptable solution. But the comedy value was enormous...

Vic.

Vic

Re: "People are living increasingly social lives"

You know the paper licences are not longer valid don't you?

No, I don't. Because they are still valid.

What they are not is an acurate record of any endorsements you might have - that now needs to be looked up online, which might confuse car hire companies. But the licence is still valid.

Vic.

Vic

Re: "People are living increasingly social lives"

Wait. Once it next expires, they will charge, and it will be a plastic one.

Once it expires. I shall be 70, and probably[1] not safe to drive...

Vic.

[1] I've seen how I drive...

If you know what's good for you, your health data belongs in the cloud

Vic

Re: I would have loved (and hated) this as a kid

but the point of using "the cloud" is that the data becomes available through existing connectivity: it does not require a new bespoke network.

Putting your data in the cloud does cock all good.

Using existing connectivity to pass messages is a good thing.

The latter does not imply the former - indeed, the former is actively harmful to any real-time reporting, whereas the former is a good thing - and has existed for far longer than anyone has been spouting crap about "cloud".

The Internet is not "cloud". The ability to pass messages cross the world is not "cloud". Sending emails, as we have done for some decades now, is not "cloud".

Vic.

Vic

Re: I would have loved (and hated) this as a kid

As much as we may get stressed about the possibility of data getting to unwanted parties, it is impossible to ignore the health benefit

Yes, but the benefits arise from having sensors with the ability to send notifications; putting the data in the cloud for processing is a net detriment, since it requires connectivity and availability to be of any use whatsoever.

This is a puff-piece about Cloud. Cloud is the last thing you want in this sort of situation.

Vic.

Vic

Re: Welcome to the future

I wish somebody in the government would give me a public/private key pair. Then I could encrypt my data in the secure knowledge that only I and people who I authorise could access it.

Well, not really.

If you encrypt with a private key, anyone can decrypt it with a public key. And that's public.

But if you encrypt with your public key, the recipient needs your private key to decrypt it. And then it's not private any more.

What you actually need is to know the recipient's public key, and the encrypt with that. And then we're straight into the usual problems of key verification and making sure that the holder of your data actually follows procedure and encrypts with the right key, rather than just sending it all in plaintext.

TL;DR: the author of this piece made up the bit about sharing health information[1] without really thinking through how it will work. 2/10 must try harder.

Vic.

[1] And the rest of the article, really...

The ‘Vaping Crackdown’ starts today. This is what you need to know

Vic

Re: Next time you're in France...

IIRC, that's also in the TPD: There are tight restrictions on cross-border sales of e-cigs and related products.

I've heard this a few times.

That would seem to inhibit the free movement of goods, and is thus contrary to the EU's fundamental freedoms[1]. That would appear to be a breach of the Treaty on the Functioning of the European Union.

I wonder if this legislation will end up being struck down for being unlawful?

Vic.

[1] Their words, not mine...

Hacked in a public space? Thanks, HTTPS

Vic

Re: Corporate networks decrypt SSL

Or installs some malware into the machine, or has to install a certificate to connect to a VPN, or ...

None of that is an SSL issue, they''re all trsut compromises.

In summary if your computer belongs to a domain you can assume that the corporate firewall is decrypting your traffic.

This is why I use an invalid certificate on my server - if I *don't* get a warning, I know someone is intercepting my traffic.

Vic.

Vic

sslstrip downgrades the connection

It doesn't. It just replaces https:// links in HTTP with a corresponding http:// link, pushing your browser to use HTTP rather than HTTPS. If you use HTTPS, it does not and cannot downgrade the connection.

Vic.

Vic

So the article is wrong

The article is very wrong.

Take a look at Moxie Marlinspike's page on sslstrip. It doesn't do anything like what the article claims.

Really, this article is very poorly-researched. You might want to spike it...

Vic.

They take to it later, but when women FLOSS, they mean it

Vic

Well, the beer is basically breakfast cereal

The "Breakfast Stout"[1] is becoming very popular these days. It's brewed with oatmeal. so it takes the harsh edge of the stout, making it far more palatable to those who aren't normally stout drinkers...

Vic.

[1] I think Founders did the first one[2], but there are a few doing the rounds now.

[2] And it is very pleasant indeed...

LinkedIn plays down '117 million users' breach data sale

Vic

Re: SSO

Only if you used an email account with LinkedIn that you used elsewhere

LinkedIn seem to have done a load of email scraping somewhere.

They sent me the email[1] telling me to reset my password - but they sent it to an address I've never given them. The address on my profile has not been notified...

Vic.

[1] I thought it was a phish at first - but it checked out.

Time to talk about stupid and preventable failures

Vic

Re: Not sure if this counts but...

I'd probably have opted for making the cables myself

Alright, that's three of you now who have downvoted me without bothering to mention why.

So here's a question for you downvoters - how many of you have actually cabled a building before? Because I've done a few now, and whilst the first mile of cable I ran[1] was hard work, it's one of those skills that does come to you. A skilled wireman[2] and his mate can cable a building far more cheaply and far quicker by running cable from a box than by buying pre-built cables. Which is why they do it that way.

Vic.

[1] I was employed for that, so I wasn't taking the financial risk. Which was nice.

[2] I don't consider myself highly-skilled in this area. But I do have sufficient nouse to know when it's worth terminating ends myself...

Hacker finds flaw in teleconference tool used by US Army, NASA and CERN

Vic

For those who don't know...

... /etc/passwd doesn't contain any passwords.

Its disclosure is certainly very embarrassing - and there might be some mileage elsewhere in this exploit - but it isn't the heinous problem that the article implies.

Vic.

Politician claims porn tabs a malware experiment, then finds God

Vic

Re: They always find Jeebus don'[t they

I found Jesus again the other night.

Marvelous. If a little heavy on the wallet[1]...

Vic.

[1] £7 for a 330ml bottle. We split it 7 ways :-)

Adpocalypse 'will wipe out display ad growth' by 2020

Vic

Re: Protection?

Providing the content incurs costs. One way to finance this is to ask an ad-broker (eg Google) to fill some space

There are other way to pay your costs.

An obvious example would be Groklaw. It was a high-volume, high-quality site for a decade. The reason it shut down[1] wasn't to do with a lack of funding - it was a lack of ensured privacy.

Groklaw had a tip jar. We all put a few quid in - often a *very* few*. But it was enough to pay the bills - and when money was running out, PJ would ask for more money, and more would appear. That's the thing with community - people do their best to support the things that matter to them.

Funding your site by advertising is more like dipping into your users' posckets without their say-so; you'll get away with it for a bit, but no-one really likes it.

Vic.

[1] Technically, Groklaw hasn't shut down - it just isn't very active any more. But it was extremely lively for a good decade...