* Posts by Ian Michael Gumby

4454 publicly visible posts • joined 11 Apr 2006

FreeRADIUS fragged by fuzzer – by invitation – and fifteen fails found

Ian Michael Gumby
WTF?

A long program of static tests – the post name-checks Coverity, Clang analyser, cppcheck, and PVS-Studio – clearly hasn't been enough to turn up all the bugs, which arise because “C is a terrible language for security”.

C is an excellent language for security and for systems that need to be fast and efficient. C++ on the other hand is a lousy language to debug because people who write in C++ tend not to know how to write clean code and there are better OO languages around. (Objective-C as an example.)

Today most coders are like drivers, and those that can code in C are like professional race car drivers. You can put a professional driver in your average car and they can drive. You try putting an average driver in an F1... boom.

Apache says 'no' to Facebook code libraries

Ian Michael Gumby
Boffin

This is actually really good advice, my startup company already Cat-X's GPL code, I think I'll put Facebook's stuff on that list, too.

GPL code is FOSS but it protects the rights of the original authors. Apache, you sign away all rights and anyone can use , modify, even charge for your code.

If your startup used GPL'd code you have to follow their license requirements and that has some implications. TANSTAAFL

Ian Michael Gumby
Boffin

@AC ... Re: This isn't a kudos moment.

You contradict yourself.

FB revokes your rights to use the code if you are 'involved' in a patent lawsuit. This means that the rights FB is granting in their code are conditional rights. This is a risk which Apache does not want to accept.

Essentially FB's poison pill would put Apache at risk.

As to Hadoop. remember that Hive was donated from FB and its FB's code at its core. Same for Presto.

Ian Michael Gumby
Boffin

This isn't a kudos moment.

The issue is that there is an incompatibility with the Apache license.

The terms of the FB code release is that if there is any patent litigation, then the rights to use the code are revoked. That puts FB in the position to blackmail anyone who uses FB code or code derived from FB code. (In theory and that's all it will take to cause Apache to Stuff it.)

Not a good thing and it means potentially quite a bit of rework to be compliant.

I wonder what this does to Hadoop (Hive), or Presto....

Apache is protecting their own arse here so don't thank Apache for doing anyone a favor.

Ian Michael Gumby
Boffin

Re: Bravo for apache - you're either fully open source

This isn't "fully open sourced" or not...

GPL is fully open sourced however because of how it protects the rights of the authors, its non-compliant for Apache.

You really need to have a solid understanding of IP rights to understand that under Apache, you relinquish your rights to Apache and agree to indemnify them if they get sued because you claimed rights you didn't have.

FB's anti-patent wording means that you can't transfer the complete rights to Apache such that they are on the hook, as well as you if there is any question or claims to a patent infringement lawsuit.

Its Apache protecting themselves and allowing anyone to suck up and license the works as their own and sell support around it. (e.g. Cloudscape / JavaDB) [actually cloudscape is the original code that was donated by IBM...]

The hidden horse power driving Machine Learning models

Ian Michael Gumby
Boffin

@John Smith ... Re: Why £100K. Convenience of course

The hardware cost is relative.

You have expensive hardware, yes.

But you also have the expense of the R&D in developing the hardware which has to be expense d over the entire product line and its based on the estimate number of cards they expect to sell.

Its less about understanding 'Tensor Flow' than it is to provide the hardware and basic framework to allow tensor flow.

Ian Michael Gumby

@DrBobK ... Re: Why is the DGX-1 so expensive? Why is it needed?

There's a bit more complexity under the covers when you go from 4K to 40K cores.

That's why.

You are also paying a premium for the latest and greatest kit. But the premium isn't as much as the cost increase due to complexity. Said complexity could be in manufacturing (lower yields due to higher percentage of defects... or something else.) Higher cost in terms of design complexity in terms of interconnects... or something similar.

Does that help?

Jodie Who-ttaker? The Doctor is in

Ian Michael Gumby
Boffin

@ AC Re: Overstated importance of fans

Too close to Glasgow?

Like Stirling? Or Edinburgh?

Sorry, but some of us Yanks are used to living in a big country. ;-)

But seriously. I'm with you.

Being here in the states we were introduced to Dr. Who on PBS and the first Doctor I saw growing up was Tom Baker.

With respect to a female doctor... we saw this coming in the last season. The Master was made in to a female and the Dr.'s companion was a Lesbian. (Short lived, but it made the relationship between Dr. and Companion have less of a sexual nuance that it picked up over the past couple of years.)

Google unleashes 20m lab-created blood-thirsty freaks on a city. And this is a good thing, it says

Ian Michael Gumby
Trollface

Re: "Sexist approach?" No, even though --

Only the ladies bite and suck. (Back in the shower for you...)

We are still talking about mosquitoes right?

Sorry, I couldn't resist.

Ian Michael Gumby
Trollface

@Khaptain

Next weeks news ( Fake or not) When the mosquitos we released into the wild the interaction with "X" provided a completely unexpected result...and as such the human population of Fresno was suddenly rendered sterile....

No real loss there.

Supernova bubble clocked at 19,000,000 km/h

Ian Michael Gumby
Alien

Re: A long time ago and far, far away...

At a distance of 10K light years, that would mean that the explosion happened in 8428 BC

Right around the time man was domesticating dogs, learning to herd sheep and make boats.

Yes Virginia, the Universe is really a big place.

Kerberos bypass, login theft bug slain by Microsoft, Linux slingers

Ian Michael Gumby

@LDS ... Re: "It's a statistical thing."

Here's a better example...

Suppose I can show you a Tablet of Ancient Sumerian text. I then show you a translation of the text.

Then we have 100's of people view both the text and the translation. They find nothing wrong.

Contrary, I show the text to two individuals who then say that the translation is wrong.

By your reasoning, 100 vs 2, you'd go with the 100 people. Yet the group of two actually know Sumerian. So what good is a number of eyes when they don't know Sumerian?

And that's the point. Your code is no better off when your set of eyes lacks the knowledge and skills to comprehend the material.

The danger is that this simple fallacy and assumption that just because you know how to crank out code, regardless of quality means you are capable of doing a proper code review.

Ian Michael Gumby
Boffin

@LDS ... Re: "It's a statistical thing."

Its not the quantity but the quality of the eyes...

Many moons ago, I wrote some code for a client. I was pulled off the project to work on another client's systems. A couple of months later, I got called back in to the office because the rest of the team had 'fixed' my code and in fact broke it.

Why? Because they didn't read the comments and understand what I did and why I did it.

BTW, the original code worked as designed and was sound. (Someone wanted an enhancement.)

And it wasn't just one guy, but half a dozen people looking over the code. I then had to go back to the original code. Spend a long day walking them through the code, showing them why it works and then showing them how to make the mode for the new feature request.

The point is that unless you have a set of eyes attached to a brain of someone who knows what they are doing... you will end up with a mess.

Ian Michael Gumby
Boffin

@ One who crashes in flames...

And you've missed the point.

I've had several clients in the past say that they want to use FOSS and shunned the use of proprietary systems. I asked why and I got the same blathering that it was more secure and better code because you can see the code...

The fallacy is the following:

1) It assumes that you or your staff are skilled enough to actually read the code to understand what is going on.

2) It assumes that if there is a problem, you could fix it. Meaning that you actually have the skills to understand the problem and fix it. (95% of those who use the software don't.)

3) It assumes that you can fix it... meaning that if there is a problem that you could fix the code which would then violate your support contract because you're using a modified version and the company that is selling support has no way to support you or your code.

One of the reasons some companies looked to FOSS and supported FOSS is that it reduced their cost of development and support because the cost of supporting those developers is split among several companies that used the tools but did not get revenue from the tools. (e.g. Google, Facebook, Amazon, etc ...) It also lowered their overall IT budget for staffing.

Ian Michael Gumby
Boffin

@John Smith,,, Re: What an interesting set of comments.

Whoa!

You have a lot of misconceptions on software is developed. Especially these days...

Altman believes that the longevity of this particular vulnerability challenges the notion that open source code is magically more secure than closed source code. "The fact that this has been around for as long as it has been in open source, I think, is just one more case that should debunk the theory that open source programming is in some way more secure than closed source programming."

This is a very telling and very significant statement because the myth of superiority of FOSS has been promoted with no counter example. Now you have one.

You seem to think that anyone can just open up and look at some goop (you call code) and immediately understand what is going on and what the author's intentions are? There are two fallacies here. One that the person attempting to debug the code knows what to look for in the code and is familiar with the underlying problem that he or she is trying to solve. The second... That the coder actually took the time to write clean code that is easy to read, understand and debug.

Back in the 90's I stopped taking on projects written in C++. Not because of the language, but that I got sick and tired trying to figure out and fix poorly written and documented code that was full of bugs.

Many concepts of software engineering are not being taught properly or if taught at all.

Seriously, I doubt you've ever really worked with Kerberos and could walk through the code. Or have the free time to do so.

Trump tramples US Constitution by blocking Twitter critics – lawsuit

Ian Michael Gumby

@Handleoclast ... Re: @handleoclast ... As I understand it

Again, I suggest that you actually learn something of the law.

First in the court system, the burden of the proof is on the plaintiff. So, if the claims are made, the plaintiff has to prove their case in court.

With respect to Twitter, they are a <u>PRIVATE</u> company. They set the T's & C's and the features. Not the government.

Here's the simple litmus test:

1) Did the user violate the T's & C's of Twitter?

2) Did Trump violate the T's & C's of Twitter for blocking a follower from following them?

3) Assuming that Twitter didn't ban the user... Did Trump's blocking the user remove the user's ability to tweet on his own? gather and maintain his own set of followers? (Note: this is your interpretation of 'assembly' )

Then answer to each of these questions is no.

There's more... none of which supports your argument and views of the law.

Seriously, the lawyers who bring these types of 'creative' lawsuits should be sanctioned by the bar. Using the law to harass

Ian Michael Gumby
Flame

@Velv Re: @ Ian Michael Gumby

Again, I suggest that you get a handle on property law.

Your First Amendment right to free speech is that you have the right to speak your mind as long as it isn't hate speech and/or qualifies as protected speech. Note that not all speech is protected under the first amendment.

If Trump or the WH block you from their account, does that mean that you can't post using your own twitter account? The answer is no. Unless you violate the rules of Twitter which is a private company, you can set up your own account and tweet whatever you want as long as its not a violation of Twitter.

So your argument falls flat.

There's more, but that alone kills the lawsuit.

You say " But they are being used to make official government statements, and therefore fall under the laws that control official government communications which must be available to all citizens equally."

Again, I suggest you actually learn the law before making such a silly statement.

<boom mic drop>

Ian Michael Gumby
Boffin

@handleoclast ... Re: As I understand it

Whoa!

You want to play Perry Mason, first go to law school and learn something of the law.

Trump tweets.

You do not have a first amendment right to retweet. That doesn't mean you don't have the right to make a new tweet on the same topic.

Seriously.... you really need to think about the law and what it covers and doesn't cover.

Look at it this way... Trump is in a crowded stadium. You and your best buds decide to go to the event and then unroll a banner that is anti-Trump. While you have your rights to the first amendment, that doesn't mean that security can't tear down your banner and physically eject you from the event, or you getting arrested for trespassing.

Ian Michael Gumby

Re: @ Steve 124 ID 10 T alert

So Twitter says George Stephanopolus can be a weenie?

Works for me.

Ian Michael Gumby
Boffin

@Big D ... Re: ID 10 T alert

Dude, you're so wrong its laughable.

1) The official records act does not cover tweets, snap chats, or whatever... it would have to be updated to include these forms of communication. (It would also imply that all phone conversations should be transcribed and stored.... Same for videos of Trump's speeches and all photo ops. )

2) You're confusing property rights and the Official records act. Assume that the Official records act did require the tweets to be saved. That can be done without claiming that this is now property of the US.

3) The Obama administration set up the POTUS account. So were all of those tweets saved? Did Obama's Admin eject people from the stream?

4) Property rights. Twitter owns the servers and provides a server. By your logic because Trump uses a phone, then the government owns the phone companies.

Bottom line. The case should be dismissed with prejudice.

Ian Michael Gumby
Boffin

@John Brown... Re: ID 10 T alert

Trump has two accounts. His own personal account and now the WH account that was created by Obama. While they may have rights to control the account, Twitter owns the system so you can't say that the twitter account is an extension of the government. You are essentially rewriting the laws on property ownership and rights.

Having said that...

If you look at Clinton's server, which is her own property, set up at her house... with the sole user being her and her staff and was her sole form of communication... you would have a better case making your statement that it was in fact a defacto work system and hence she ceded the property to the government.

(I'm sure that there exists case law that would support that.)

If you get bounced, what's to stop you from creating another account and then following Trump?

Or having multiple Twitter accounts?

Ian Michael Gumby
Boffin

@ Steve 124 Re: ID 10 T alert

Within the US, even illegal aliens have rights.

But here's the thing...

1) Twitter is not the US Government.

2) The burden is on the plaintiff to show that their first amendment rights were in fact violated.

Trump has his personal account and the WH account. In both he and his staff have the right to control or block whom they wish. Its a feature of Twitter.

So if Trump blocks George Stephanopulos for being a weenie, that doesn't stop George Stephanopulos from creating another account to listen to Trump's tweets. Note: I do know George from way back when and yes, he's a weenie. ;-)

The case is noise and should be dismissed outright.

Wi-Fi firm Purple sneaks 'community service' clause into its T&Cs

Ian Michael Gumby
Boffin

Nothing new here.

We all know the dangers of shrink wrap contracts ... including unenforceable clauses.

This was parodied by South Park.

But what is interesting is the whole GDPR thing.

Want to be compliant?

Just say no to selling customer data. Or sharing data with your 'partners' who aren't really 'partners' but other companies that are paying you for the data.

If you keep your data private, provide industry standards on securing your PII data... you will be compliant.

IO, IO, it's off to Weka.io we go: Let's take a look at a file system upstart

Ian Michael Gumby

Funny...

"The deployment model is as a hyperconverged architecture where both storage and application services are run on the same infrastructure.

Hmmm. Sounds a lot like Hadoop.

Ready, aim... Ignition! Valley VC bigwig ejects after conduct complaints

Ian Michael Gumby
Facepalm

He should move DC.

He would fit right in with all of those politicians. Does anyone remember Ted Kennedy?

Ian Michael Gumby
Devil

Funnily enough, back in 2016 Ignition hired “an expert consultant to conduct sensitivity and anti-harassment training.” Based on the above revelations, it should ask for its money back.

Yeah, he should have learned how not to get caught.

Viking storms storage monastery wielding 50TB SAS SSD

Ian Michael Gumby
Thumb Up

Re: 50TB! I'll take twelvety.

The SSD prices have been kept high due to chip shortages.

For SOHO / Consumer, you'd need to have at a minimum 2 drives mirrored per machine and more likely a set of 4 in RAID 10. 50TB should be enough to store 20 years of data (docs, photos, movies, music, etc ... ) for the normal family.

Very cool and looks like a spinning rust killer.

His Muskiness wheels out the Tesla Model 3

Ian Michael Gumby
Boffin

Re: It will retail for just $35,000

I am surprised Mr Musk hasn't followed the Porsche example and de-tuned the cheaper cars so that they don't compete with their more expensive cars on performance. Don't want the masses being able to overtake the <1%.

He's actually already done that.

Top of line. 0-60 in under 3.

More space, longer distance.

So this car will have good (ok great) acceleration but not as good as the higher priced models.

It is smaller than the other sedan and doesn't offer 4x4/AWD .

So its a good deal, if you can house the car and charger. Note that the price of installing the super charger at home isn't included or has decreased.

The one thing that you have to watch out for is that when you do a software upgrade, you can't downgrade. This is a problem for those who own earlier models and the software upgrade may create problems. (My brother in law has one) The other thing... if you're over 6", you won't be comfortable in the back seat. Not enough head room.

RED ALERT! High-speed alien fugitives are invading our Milky Way

Ian Michael Gumby
Alien

Ringworlds?

While you can see these fast moving suns, did you notice the Dyson ring?

One-third of Brit IT projects on track to fail

Ian Michael Gumby
Facepalm

Re: In other news

Haven't you heard?

Someone heard that it takes a community to raise a child, so they got nine women together so that they could shorten pregnancies down to a month.

Ian Michael Gumby
Mushroom

@Rocket Rabbit ... Re: With maths and syntax like that

The flame is because as you say you're nearing 40 you still have issues with reading comprehension.

The story is a bit self explanatory with the sources of the numbers.

I would say that the inability to pay attention to details is a major cause of failure, however this is probably under reported or grouped in with one of the other categories like staffing.

Seriously... all of the reasons provided are valid reasons for project failure in some cases all of the above.

GitHub flub spaffs 8Tracks database, 18 million accounts leaked

Ian Michael Gumby
Boffin

@Korev Re: Lesser of two evils?

I hate giving them this much power;

Then don't.

Just to be safe, I went to Github, set up 2 factor authentication and then changed my password.

Murderous Uber driver 'attacked passenger and the app biz did nothing. Then he raped me'

Ian Michael Gumby
Boffin

@Adam52

No,

Uber is responsible for performing necessary and required background checks on its drivers.

Even cab companies have to perform background checks, including fingerprinting of potential drivers.

(This will vary state by state.)

The fact that Uber didn't means that they are liable. They will settle before this goes to trial.

There is no way Uber will be held harmless and while they will fight it... if there's a police report, hospital reports and the story checks out... e.g. the drive signed up under an assumed alias to hide his identity and his criminal past... Uber is going to be paying out a settlement in the high 6 to 7 figure range.

Sony open-sources NNabla neural network learnings

Ian Michael Gumby
Boffin

Re: Eh?

"Neu - ral Net-work Li-bra-ies"

Neural (2 syllables) , Network (2 syllables), Libraries (3 syllables)

versus

N (1 syllable) Nabla ( 2 syllables)

So 7 Syllables shortened to 3 Syllables.

Does that help?

Ian Michael Gumby
Boffin

Re: Eh?

Neu - ral Net-work Li-bra-ies

1 2 3 4 5 6 7

N Na-bla

1 2 3

Does that help?

SpaceX nails two launches and barge landings in one weekend

Ian Michael Gumby

@John Brown Re: Even old curmudgeons are happy!

Exactly.

Everything we have today... from Tang (if you remember it) to your PC and phone would not exist were it not for NASA and DARPA. Or even velcro or other things. People forget the R&D that went in to putting a man on the moon.

Ian Michael Gumby
Boffin

@John Smith ... Re: Even old curmudgeons knows nothing of any use about subject they are posting on.

John,

Elon Musk's wet dream: Launching a rocket, recovering and relaunching within 24 hours.

(Not going to happen for a long time. )

That said, launching from two different sites within 44 hours? NASA hasn't done that, have they?

And both landing and able to be recovered... also impressive. Even the reuse of boosters is impressive.

Now if someone could invent a rail launcher that can safely launch satellites and other non human payloads in to space... even better.

Ian Michael Gumby
Boffin

Re: Doesn't compare.

This is why some smart SOB invented the pee-pee tee-pee.

Not Apr 1: Google stops scanning your Gmail to sling targeted ads at you

Ian Michael Gumby
Black Helicopters

Legal Liability out weighs the value.

There is some issues with this.

If Google is scanning the mail, then they have some legal liabilities.

Imagine if a terrorist used gmail to communicate in "code" of an impending terrorist strike.

Or even if it was in plain text.

If Google intercepted and scanned the email... and failed to act.... what would you say their chances of surviving a civil lawsuit? Or be able to turn down a subpoena request from Uncle Sam?

So much more, but you get the idea.

Florida Man to be fined $1.25 per robocall... all 96 million of them

Ian Michael Gumby

@Adam Will Re: Er....

Both.

The caller id spoofed with the local number.

The content is made to sound like its Trip Advisor or Expedia or Hilton.

Ian Michael Gumby
Boffin

@Number6

There is spoofing the Caller ID which has some legitimate reasons although technically its not spoofing.

That said, the phone company knows the correct number from the call.

They know where the call originated.

The problem is if the call comes from a SIP provider. (E.g. Vonage) They don't know the IP address of the originating caller, just the number which would be registered to the SIP provider. Once you know this.. you can shut down those robodialers and call centers in India running the scam. (Or some other country where its harder to track down the caller. )

If you made the SIP provider liable... you can bet they will be much more cooperative.

Ian Michael Gumby
Boffin

Re: Good luck with collecting that fine.

The problem is that most don't fill out the form of the offender.

While you may have the fake phone number, you don't know the company that they represent.

So what do you put in the form?

The other issue is that the scammer will do two things. First live off the proceeds knowing that he's going to get caught. Second keep a set of dodgy books to hide money and also not report all of the income.

So if the guy made millions, he'll end up saying he can't afford to pay even though he lives in a 30 million dollar mansion in Florida and his 'divorced' er separated wife lives in another 30 million dollar mansion which by law, can't be repossessed or forced to be sold in order to make restitution. (Primary residence only.)

They'll make some token restitution and 6 months later, open up shop with someone else as the corporate officer and continue the scam.

The only way to nail them is to make it a felony with mandatory jail time.

Ian Michael Gumby
Boffin

@BillG you may not want to block those numbers.

The problem with the 'neighbor spoofing' which I've been getting on my home phone and cell, is that the numbers being used may be a legitimate number to a real person.

I've had one of the spoofed calls and I called it back just to see if it was real.

There was someone on the other end and I asked why they just called me. They said that they didn't.

Most of the spoofs are from numbers that are not currently in service.

The truth is that if the FCC wanted to, and if they made this a priority, there are a couple of things that they could do to help shut these guys down. One of them includes mandatory jail time for repeat offenders.

Google to remove private medical data from search results

Ian Michael Gumby

Re: Removed from search results ...

Bingo

Hence this is one of the world's largest class action lawsuits waiting to happen.

Ian Michael Gumby
Mushroom

Re: "no opt-out for patients who do not wish to share their data."

I have to question the legality of this.

Here in the states, it would be a direct violation of HIPPA.

If anyone knows of Google doing this or anyone doing this without the direct consent of any and all patients involved... its a lawsuit.

The combination of this data with any other data set that further violates or erodes the protections granted by HIPPA or any other privacy statute would also be an actionable offense.

Tesla death smash probe: Neither driver nor autopilot saw the truck

Ian Michael Gumby
Boffin

Re: Bleh

Actually a coat of paint to create a pattern so that the white truck didn't blend in to the sky.

Or use LIDAR sensors that would have reflected off the Truck's trailer.

Of course some have said that the camera wasn't properly aligned so there could be truth in that.

Worried about election hacking? There's a technology fix – Helios

Ian Michael Gumby

@Voland Re: "Because you can"

Huh?

On election day, you have more than 20+ items.

Depending on the year, you could have POTUS, then State Senators, Reps.

Inside the state, you have various offices, Governor down to local judges, aldermen (councilmen) before you get to referendums and at the end non-binding referendums. (Things you can vote on that don't directly go into a law, but give an indication of what you favor. )

When we said don't link to the article, Google, we meant DON'T LINK TO THE ARTICLE!

Ian Michael Gumby

Not so easy...

While you have 'free speech' this isn't a case of it.

Suppose you are in NY and you open up a Fast Food joint called 'Bullet Burrito'. You've gone thru all of the legal filings, paperwork, established a brand, and a web site.

But suppose you find out that 10 years ago, there was another place in West Virginia that was also called Bullet Burrito and was shut down because of a case of food poisoning and not being up to code.

Clearly not you.

But if you go online and Google Bullet Burrito, voila, there's a news story talking about Bullet Burrito getting shut down because of not being up to code.

You go to Google and ask them to take down the link. While its a valid news story, its outdated and its causing you harm. People just see the link on the first page and assume its about you and doesn't see the date of the article or that the place was in a different state.

Who would be right?

Uncle Sam bungs rich tech giants quarter of a billion bucks for exascale super R&D

Ian Michael Gumby

If the US builds it ...

China will have the tech within 6 months.

Take a look at all of those companies.

Now take a look at who does business globally and the fact that any improvements made for the US government will flow to consumer equipment after they build it...

BA passengers caught in crossfire of Heathrow baggage meltdown

Ian Michael Gumby
Devil

@AC

No, it was yet again system failures as their power supply crossing over caused them to crash.

No need to blame the off shore team for this... its a local pesky problem of an ignorant engineer who accidentally caused the problem which is why we need to move more jobs to India!

Do I really need to add the <sarcasm> tags?