* Posts by Graham Cobb

1466 publicly visible posts • joined 13 May 2009

Millions of Gigabyte PC motherboards backdoored? What's the actual score?

Graham Cobb Silver badge

How do we defend against this? - Linux edition

So, I gloated for 30 seconds that this didn't affect me because I use Linux. Then I started thinking about how to defend against this sort of thing... at least from entities trying to be "helpful" (not trying hard to be malicious).

It is certainly true that EFI code can do anything it likes to the disks, or to the RAM contents before dispatching the kernel. However, all my disks are encrypted (data disks and root disk). Except for /boot (which contains the kernel and the initrd) and /efi. /efi is trivial for the board EFI code to change, but that doesn't do anything the board can't do directly so isn't much worth worrying about, I think.

The kernel and the initrd are more of a problem. But hacking my kernel image is unlikely for something trying to be helpful, I think. I suppose it could manipulate my initrd either on disk or after loading it easily enough - as far as I know it isn't signed or encrypted? I ought to check.

On the other hand, my normal Linux boot uses grub (or refind on some systems). Unless the EFI code decided to bypass those boot loaders and load the kernel and a modified initrd directly it isn't going to get anywhere. And I would certainly notice bypassing those (still assuming it isn't malicious and replicating my normal boot output to hide itself).

Individual data platforms for all health providers under controversial NHS plans

Graham Cobb Silver badge

US provides the real-life dystopia warning

Some people have felt that those of us insisting that health data be kept very private, not shared without exceptional justification and not accessible to third parties such as software platform providers are over-reacting. That our concerns are unrealistic.

But the last few months have, unfortunately, proved our fears to be justified and that we have even underestimated the dangers.

It is less than a year since the US Supreme Court overturned Roe vs. Wade. And state governers and lawmakers have been queuing up to pass dystopian laws aimed at controlling women and turning them back into slaves. State after state has criminalised abortion, even in cases no one imagined would ever be restricted (such as saving the life of the mother in some states). And not only that, they have gone further: requiring that healthcare data be used to detect and prosecute those women - with a legal requirement on data providers to report the lawbreaking to the authorities. Even for actions carried out outside their own state.

How long before a resident of Utah who has an emergency life-saving abortion in an NHS hospital while in London is reported to the authorities in her home state by Palantir, who will have no choice but to follow the law in the US?

Microsoft has made Azure Linux generally available. Repeat, Azure Linux

Graham Cobb Silver badge

Re: The distrust I still feel was

After all MS is all about Windows isn't it?

No, not any more. That much is obvious.

Desktop is still about Windows. For now. In Microsoft's world the future of desktop is dumb clients and Web apps (Office apps, Teams, ...). But they are not there yet.

But server - nah. Servers are all about Azure. With Linux kernels. And containers for the services.

Social media may harm kids. US Surgeon General says so

Graham Cobb Silver badge

Sure: extremism & intolerance is present. But it just doesn't appear in most people's feeds. Ordinary people get a feed of (in my opinion) dull stuff about what their friends and neighbours are doing. They seem to like it. The "bad" stuff that goes by they can ignore - just like they ignore the drunk guy ranting on the street.

I do agree that the media are choosing to try to "compete" by dumbing down. That is unfortunate but hardly the fault of a tool which provides people with easier ways to gossip and chat instead of reading serious media.

Graham Cobb Silver badge

Life "harms kids"

Come on El Reg - let's see some real journalism here. The US Surgeon General makes some populist claims without, apparently, citing any evidence.

There is no mention in the article of any actual data. You know, evidence, one way or the other.

I don't use or like social media. But I don't see any justification for whipping up a witch hunt without evidence.

My guess (which is no better than anyone else's, but no worse either) is that many more suicides are prevented by social media (friends, family, even influencers persuading people that their problems can and will be solved) than are encouraged by social media. Most ordinary people, even kids, don't spend their time on 4chan - they spend their time on Facebook with their friends, family and very dull "celebs".

Life "harms kids". Is it more or less bad if the kids are on social media? That is what we need to know - evidence and data for forming policy, not hysterics.

Graham Cobb Silver badge

Don't be silly.

I am not a user of social media. But I know many people who are. And almost without exception it is a major benefit to them. They keep in better contact with friends and family, they can access interesting content and services they need, they can get information on new or important topics, they can be comforted by their friends when they have problems, etc etc. Some of them are disabled and it is literally life-changing to be able to be in contact instead of isolated as they would have been in the past.

Sure - social media wastes a lot of time, but so does TV or any other entertainment. Although I don't use it, I respect that 99.999% of people who do find it beneficial.

UK's GDPR replacement could wipe out oversight of live facial recognition

Graham Cobb Silver badge

Re: The reward for your support

A bit of both.

The story goes that when Ken Clarke arrived a the Home Office, the spooks and police had a private meeting with him at which they showed all the Bad Things that would apparently happen if they didn't have Massively Increased Surveillance powers. He told them to piss off and sd a better job with the powers they already had. Apparently the meeting was very friendly and the spooks said at the end "well we had to try, didn't we?".

Pushing for decreased civil liberties, and a massively surveilled and over-policed society, is nothing new and should always be resisted by the Home Secretary. Nothing particularly bad will happen.

On the other hand, since Ken Clarke we have gone through an era of many Home Secretaries who do not understand what freedom is or why it is important. I understand why Blunkett felt that way - his disability meant he relied on the state for his day-to-day life and he was bound to feel the state was a power for good. However, most Home Secretaries have just cynically seen these powers as ways to damage political opponents or increase their non-democratic power.

Activists gatecrash Capita's AGM to protest GPS tracking contract

Graham Cobb Silver badge

Re: Eh what?

The fact of entering the country without paperwork is not usually in dispute. The point is that there are many laws which permit that. One major one is the Human Rights Act which brings the UK's treaty obligations to provide refuge for refugees into law.

Privacy Framework draft isn't 'future-proof', say MEPs

Graham Cobb Silver badge

Re: I don't understand why this is so hard

No, you have that "right" anyway. I exercise it frequently. for example, I don't do business with Google.

This is about additional rights granted by EU legislation. That is what the various national "data protection" laws around the world are about.

Microsoft Azure CTO believes confidential computing is the future of targeted advertising

Graham Cobb Silver badge

Re: Good news?

They do? I've never met anyone who has asked for more personalized advertising. Just less.

Graham Cobb Silver badge

Re: No thank you.

Well, Russinovich isn't a jerk.

But I am disappointed he agreed to allow his name to appear on a press release like this. I am sure the confidential computing technology can increase security and reduce unintended leaks. But it has nothing at all to do with who is allowed to do processing, or what processing they are allowed to do - which is nothing to do with the technology as it is a social and legal question.

EU-US Privacy Framework could make life easier for a data biz, if it survives

Graham Cobb Silver badge

As Northern spring is well underway, and almost over, it is either ambiguous or just wrong. In either case, as El Reg has readers (and, indeed, journalists) in Oz, it is sloppy writing.

Cisco: Don't use 'blind spot' – and do use 'feed two birds with one scone'

Graham Cobb Silver badge

Re: It's subversion

So that's why Linus created git!

Graham Cobb Silver badge

I always assumed it referred to a pass with a sword, and dated back to medieval combat. But I haven't bothered to look it up.

India calls for all mobile phones to include FM radios

Graham Cobb Silver badge

I suspect a hidden agenda

The Indian government love Internet shutdowns. They've never met a citizen they couldn't ignore just by shutting down the Internet in the area.

But, But!... They have realised that with no FM radio they can't issue the (one-way) instructions they want to send to their (now silenced) citizens!

How can we run an increasingly authoritarian government without being able to tell people what to do? I know, we will insist that FM radios are included so we can give orders, without allowing them to discuss or organise.

Major decision on GDPR compensation rights expected soon

Graham Cobb Silver badge

Re: Word

Yes - they have no direct benefit for us. But they have significant (and potentially almost unbounded) impact on the company - much more than the tiny "fines" our bought-and-paid-for politicians are willing to impose on their corporate friends.

So should start to achieve the changes in behaviour we want to see.

Graham Cobb Silver badge

Re: The easy way to avoid being sued for data breaches

Well, if this case goes the way of the plaintiff then everyone who's data has been unlawfully processed will benefit.

Let me know next time I can help you understand something.

FCA mulls listing rules after Hauser blames 'Brexit idiocy' for Arm's New York IPO

Graham Cobb Silver badge

Why?

So the FCA wants to reestablish London as a centre for companies to list by removing regulations that protect the investors in those companies and allow genuine, stable, risk-aware, long-lived companies to thrive without unfair competition from fly-by-night entities that have no business plan except transferring money from cheated customers, well-run competitors and suppliers and their conned investors into their real owners pockets.

Why?

There are already plenty of locations for these fake companies. They are well established and have a price list for bribes to regulators, police, etc. I don't think London is going to be able to complete very well with the well-known tax and listing havens. So it will destroy the value of a London listing for real companies, bankrupt British investment funds and private investors, and not even deliver a successful crooked business because foreign crooks do it better!!

CERN celebrates 30 years since releasing the web to the public domain

Graham Cobb Silver badge

Re: The only reason that WWW ...

I'm not sure that it wasn't the other way around: the creation of full-text searching led to the removal of the "information professional" role.

I remember, in the early days of the web, playing with a side-project of indexing all the internal discussion sites (they were called "Notes" sites) at DEC - initially with a gopher interface. I was fairly quickly told to stop wasting my time by the guys on the West Coast who were busy developing what became AltaVista. I would say that at that time we had started to see the decline of project librarians but there were still a lot of professional technical writers. The ideas of engineers writing web pages, or tools to develop reference manuals from comments in the code, were not yet mainstream.

Graham Cobb Silver badge

Re: Mirage of democracy

Nowadays most HTML is pretty legible.

I beg to disagree. While it is perfectly possible to write legible HTML and create useful, clean and functional websites, no "web designer" ever does. They would be thrown out of their union!

Between the horrible hack that is CSS, and client-side javascript frameworks, it is impossible to read almost all HTML documents on the public web without presentation.

The truth about those claims of Qualcomm chips secretly snooping on you

Graham Cobb Silver badge

Re: The chipset

Not quite. The real issue is that it isn't under the control of the user.

I rarely use my phone for location services. I should be able to leave them off and only turn them on if I want them. The 50 bps is fine for me most of the time.

Don't put privacy-impacting services on my phone without telling me and providing on/off switches!

Graham Cobb Silver badge

Re: The phone privacy fallacy

We should insist that all personally identifiable information being communicated outside the device is listed somewhere, for all devices. That includes any form of "identifier" for the phone, SIM, or any other component or attached device. So, obviously, IMSI, etc, but also any serial number for any hardware or chip, or any other id which can identify the user or device. That is a reasonable request and is probably a legal requirement in most jurisdictions.

Even the IP address may be important. Observing a sudden increase in the number of mobile phones using IP addresses associated with a military network might give away information about an operation about to start.

Just what the universe needs right now: A black hole with wind

Graham Cobb Silver badge

Re: Another Big Bang?

I am not an expert, but I am fairly sure it is well understood now that the universe will continue to expand, with everything getting further apart, and has no chance of collapsing back again.

Of course, new discoveries could change our underlying scientific understanding but, with current science, we will just get further and further apart. Already most of the obversable universe is completely unreachable to us (we cannot send even a speed-of-light signal fast enough that it can ever catch up the objects we observe from the past, which are all moving away from us).

Happy to be corrected when an actual boffin joins the discussion!

Amazon, Bing, Wikipedia make EU's list of 'Very Large' platforms

Graham Cobb Silver badge

I'm getting the popcorn ready for Twitter's submission

"clear information on why they are recommended certain information."

Seeing as the Great Twit has pretty much abandoned algorithms, and recommendations are based on whoever Elon likes and dislikes today (and swap around without warning tomorrow), I can't wait to see what they claim. Are there any actual penalties for the information being false, which it is likely to be under its current boss?

Brit politicians, Big Tech grumble about India tech laws

Graham Cobb Silver badge

Re: 'government-run "fact checking" unit'

A government-run fact-checking unit could be a useful service. As long as its determinations are openly published, with the source ("government fact-checking unit") clearly marked, and free to be ignored.

Those who trust the government (in a particular area of competence) can find them useful. Those who do not should be free to ignore them. Each person's view on their competence may change over time.

No communication platform should pay them much attention (although providing optional filtering for users who wish to either hide or amplify based on the determinations would be useful to some).

Florida folks dragged out of bed by false emergency texts

Graham Cobb Silver badge

Re: Running SIMless

Almost all of my phones have no SIM card. All of them work perfectly well without any SIM card (except for mobile service, of course). Some of them I sometimes put a SIM card in for a while (e.g. a local data card in a foreign country).

ChatGPT fans need 'defensive mindset' to avoid scammers and malware

Graham Cobb Silver badge

Certainly true, but the article is warning about sites which steal stuff in the background, not just the stuff you tell them.

Unfortunately, most people will visit random sites on the web without taking any precautions. They think "private browsing" is for accessing porn, not the setting you should use for access to any new website.

Wrong time to weaken encryption, UK IT chartered institute tells government

Graham Cobb Silver badge

Re: Help! I'm confused.

One thing I do know was on the cards some years ago was passing on the cost of the NHS's increased mental health care costs (for children suffering the consequences of online bullying, grooming, etc) to Facebook, Twitter, etc. I don't think it came to anything, but it was reported in the newspapers at the time.

Which was always a bloody stupid idea. FB etc would just point out that, in fact, well over 99% of participants (including kids) have a better quality of life and better consequences due to the existence of social media. Many, many more child suicides have been prevented than induced by the wider access to information, help, views and diverse experiences created by Internet services. I wouldn't want to go back to the days of school bullying with no access to online friends, help and other outlets.

And I say all this as someone who chooses not to participate in social media myself, except El Reg comments!

Graham Cobb Silver badge

Re: Whose Encryption Might Be "Weakened"?

if you wish to draw attention to yourself go ahead and use tools that create data blobs that are clearly encrypted... whilst I suspect you will get away with the occasional encrypted communication, repeated and regular usage will raise your profile...

But that is the point. The government are claiming that this law (and their intent) does not ban encryption. It just insists that anyone operating an encrypted messaging service has to be able to decrypt it. But if a significant part of the population decides to use the not-really-encrypted-any-more commercial service to deliver encrypted messages then no laws are being broken. Most of those people won't care if it "raises their profile" as they are doing nothing illegal - the bad guys will easily hide amongst the noise.

So, as soon as this law goes in to place, many hackers will provide tools to make it easy to encrypt your messages and then send them using a legally compliant service and decrypt them at the other end. I would certainly use it for all my messages - which are mostly about what to buy for supper, etc. Many of us do that today with gpg-encrypted mail and given the popularity of messaging, and the pushback from all the messaging companies, it will very rapidly become much easier than using gpg for mail is today.

Fancy trying the granddaddy of Windows NT for free? Now's your chance

Graham Cobb Silver badge

Re: Free VT240 terminal...

And, by the way, I still have a Gold key on my keyboard!

Well, my keyboard manufacturer seems to have written "Pause --- Break" on the keycap, and forgotten to colour the key properly, but to me it is the Gold key. I bind many of my emacs keybindings to Gold sequences (for example - Gold-l is goto-line, which is what I used in 1980).

If I remember correctly, my VT52 in 1980 actually had a key coloured gold.

Graham Cobb Silver badge

Re: Kernel design

Logical names and search lists (together and separately) are the things I still miss from VMS. I have, several times over the years, idly thought about implementing both within the C RTL.(not the kernel).

Now I'm retired I have no excuse not to have a go. But I think I have been worn down enough not to care any more.

Graham Cobb Silver badge

Re: Free VT240 terminal...

VT240!!!! Luxury!!!!!!!

And definitely not around at VMS 1.0 time.

When I started (not 1.0 but early - a few utilities still used the RSX programs in emulation - wasn't PIP wonderful?) most people were using VT100's. As a lowest-of-the-low summer student employee I was stuck with a VT52. I am sure I didn't see a VT240 for a couple of years after that.

Stratus ships latest batch of fault-tolerant Xeon servers

Graham Cobb Silver badge

Re: Close (but no cigar)

This is engineered for particular requirements. It is when you need 5-nines availability (less than a few minutes a year) meeting the committed response times, No opportunity for failover or retries.

Two examples back from my day:

1) Banking transaction processing.

2) Mobile network number portability lookups (needed to allow call requests and other transactions to be sent to the right destination network once it was no longer possible to use the first few digits of the number to know where to send it).

Both required response times measured in milliseconds, with 99.999% availability. Particularly important when the transactions are designed such that no retries are allowed - it either succeeds or fails and the end customer is pissed off if it fails.

Graham Cobb Silver badge

Nice to see they're still around

I worked for Stratus for a while about 25 years ago. Same idea back then. In those days they had 2 target markets: telecoms and financial services.

It worked well, although it was expensive - with proprietary hardware, OS and software - and not high performance. But if you needed the fault tolerance, you would pay.

The company got split: the telecoms business was acquired by another company which bought it for its international customer base and for the software and telecoms expertise. They weren't very interested in the fault-tolerant hardware.

I knew the financial services side had retained the FT hardware design but I will admit to being a bit surprised it is still around. Good luck to them!

Pentagon super-leak suspect cuffed: 21-year-old Air National Guardsman

Graham Cobb Silver badge

Except that downvoting here has absolutely no effect so the spooks aren't going to waste time on that.

On some platforms (Twitter in the old days, I think), downvoting might affect the visibility of comments, which is a different matter altogether.

Frankly we all just think you are a right-wing-nut. WTF has Biden got to do with this??? Take your trivial US politics antics somewhere else.

Oh, and if you want anyone to engage with your political discussion seriously, put your name to it.

Energy efficiency starts to rock telcos' 5G infrastructure choices

Graham Cobb Silver badge

Re: "coming ahead of concerns even such as security"

I strongly suspect that the people who actually answered 451's questionnaire (very rarely actual engineers) assume security is a solved problem. They trust their suppliers (they have to - if their suppliers have not solved the security problem then they might get fired for selecting them).

Power, on the other hand, is a visible, and increasing, operational cost. It is probably very high up their list of concerns because the telco knows user prices are going down and they have to find a way to make their costs go down.

UK govt wants standalone 5G by 2030 but won't shell out to help hit target

Graham Cobb Silver badge

Re: Definition

SA is mostly about software - the various network subsystems running as software that can be moved between central servers, cloud servers, or near the end-user. It gives the network more flexibility in what services it deploys where, including the ability to provide service for different users in one place from different servers in different locations.

It won't have much impact on consumers though. Possibly some improvement in download speed, reliability and, maybe, latency for some city-centre locations (yuppie gamers in their Docklands lofts). And maybe, one day, the fabled interactive phone features in sports stadia (although why you are watching your phone instead of the winger running down the pitch about to score beats me).

SA mostly enables the business advantages. Industrial automation (if we had any factories left), maybe some transport and distribution services.

Graham Cobb Silver badge

Re: Would you ignore the referendum?

I doubt very much that rejoining will be that feasible

There will be very high prices to pay. Obviously it will mean dropping the pound: when I woke up on the morning of the referendum result the first thing I said was "well, that is the death of the pound then" as it was obvious that we would apply to rejoin within 20 years and that during that time one of the non-negotiable terms would certainly be switching to the Euro.

Experience since then has shown that, in fact, we will be even more desperate. I did assume that Brexit would be made to work for a while, just at great financial cost. But in fact the impact has been much harder than even I, a remainer, predicted. As we can see from the number of people already admitting that they voted to leave but it was a disastrous mistake.

So, what else is doomed when we are desperate to rejoin? I think, probably, Scotland. Not sure what else.

San Francisco fog defeats pack of Waymo robo-taxis

Graham Cobb Silver badge

Expectations

there are very long-standing conventions, expectations, and human interactions

This is an excellent insight. A lot of driving in cities is built on these sorts of conventions and expectations. Experienced city drivers know that bus drivers will start to move shortly after their last passenger steps on, taxis will jump into a tiny space in front or beside but most other drivers will be more open to taking turns, some cars will take a "no right turn" that is clearly only there to improve traffic flow, cyclists will pull in front of you as they cross the traffic lights before they are green, etc. This isn't about what is legal, but how real road users behave on city streets - which is very different from how they behave on suburban roads or highways.

There is no replacement for the experience from driving down Shaftesbury Avenue at 7PM, Marylebone Road at 8AM or tiny streets in the City at 3PM. Autonomous cars should be much better than us because they can (instantly) share the experience their whole fleet has acquired over their whole history. However, it doesn't look like these makers are concentrating on learning from experience like humans do.

Smile! UK cops reckon they've ironed out gremlins with real-time facial recog

Graham Cobb Silver badge

It isn't 1 in 6000 times you/me/whomever pass a camera. It is 1 in 6000 people who pass a camera at all.

So, 1 in 6000 people will be stopped every time they go out because they "look a bit like" someone on a list?

The whole concept of using public surveillance in policing is abhorrent and appalling.

Euro privacy regulators sniff Italy's ChatGPT ban, consider a pizza the action

Graham Cobb Silver badge

Re: Extreme Right or Left Politicians...

No, it is authoritarians who feel the need to ban stuff.

Authoritarianism/LIberty is an orthogonal dimension to political left/right. It exists just as much in the centre (which is what we are actually seeing with Italy banning ChatGPT) as it does in extreme left and right.

Of course, very few people go into politics unless they feel the need to tell other people what to do. For examples of non-authoritarian-ism across the political spectrum consider gun-rights right-wingers in the US, trans-rights left wingers in Europe and laissez-faire capitalists roughly in the centre.

Astronomers (re)discover never-before-seen phenomenon on Saturn

Graham Cobb Silver badge

Boffins?

Hmmm. I don't see the word "boffin" used in this article! Has El Reg capitulated to the criticism of earlier in the week?

Boffins: Microgravity impacts cell repair systems in proteins

Graham Cobb Silver badge

Re: Somebody did not get the memo

I assumed ElReg is running a non-cooperation campaign. I fully expect that the instructions have gone out to all Reg staff to make sure the word "boffin" appears somewhere in each article.

FTC urged to freeze OpenAI's 'biased, deceptive' GPT-4

Graham Cobb Silver badge

Re: The Last One

Hey - I liked APL! My first professional programming job was using APL.

But I guess I will admit it is pretty write-only...

Psst! Infosec bigwigs: Wanna be head of security at HM Treasury for £50k?

Graham Cobb Silver badge

Well, arguably, that is what some of the large consultancies do: they have Government practices, which have staff who work on these projects long term and their knowledge has the chance to be reused on other projects. They do have some very good people, with masses of relevant experience. Effectively they are the government IT dept.

But, of course, they charge much, *much* higher rates than anyone actually working in the Civil Service can be paid.

Tails 5.11: Secure-surfing 'amnesiac' live distro arrives

Graham Cobb Silver badge

Re: Never Gnome

Ah! I see what you are doing there... when the police come and claim you have been using Tails as a hacking tool, you can say loudly "Don't be silly, my man! It uses Gnome. Maybe good for those who like that sort of thing, but I would never use it." Then you can point them to your long history of public statements to that effect.

Ooops... maybe I've just spoiled it...

Graham Cobb Silver badge

Re: I high tailed it out ...

Don't forget that Tails is intended for the paranoid (yes, I do have a copy!). So, it is important that it minimises the ability to make choices or customise the experience. Adding a choice of desktop (or browser, or editor, or mail client, or anything) just adds more information to help the spy who finds your setup to identify who is using it and maybe even what for ("yes, your honour - in all our previous work we have never before come across any other person so sick that they use LXQT as their desktop and xjed as their editor. We can say with certainty that the TAILS hacking USB key recovered from the site of the crime was owned by the defendant").

It also massively increases the task of testing - every choice you allow doubles the number of combinations to test. And as they are testing not for functionality but for things like data leakage, the testing they do is very different from the testing focus of other distros using those same apps.

Basically: the more you hate using it, the better it is for you.

Just like medicines, really.

How the Internet Archive faces potential destruction at the hands of Big Four publishers

Graham Cobb Silver badge

Re: The IA have themselves to blame

...but libraries have to buy their books and for digital have a licence for each simultaneous loan.

Which is what they do. They buy the book and they make sure they only lend one copy at a time. They don't offer straight downloads.

The UK's bad encryption law can't withstand global contempt

Graham Cobb Silver badge

Re: One rule for them, another for the rest of us.

Not quite. There are two, separate, issues with using one-time pads correctly.

1) They must be used one-time only. If two messages are encrypted using the same OTP then you are completely lost. Just subtract one message from the other and the pad has been removed completely! You now have a text which is message A minus message B. Which is much easier to decrypt.

2) The pad must be random. If there are any biases in the pad (like using a book, or even just readable text) the codebreaker can make use of those biases.

These two mean that the distribution problem is really hard (you can't disguise the pad as something else, like a letter) and it is massive (you need hundreds of pads so you can keep communicating with several people).