* Posts by John Smith 19

16330 publicly visible posts • joined 10 Jun 2009

Smart meters: Nothing can possibly go wrong, says gov

John Smith 19 Gold badge
FAIL

AC@17:04

"2) The security framework used already assumes that meters ARE compromised and is actually working on how to restore the effects of the INEVITABLE compromises with the minimum of effects and disruptions."

So makes *no* attempt to try securing them in the first place.

Odds are these meters will be tweaked versions of the same meters used in the US, which (when security researchers have been able to get hold of them, companies have been *much* more reluctant to supply test units) have proved embarrassingly easy to compromise.

"WRT to potential benefits, there are some proven by research. 1) When peeps have instant feedback (ie In home display unit) on their energy usage they DO adapt their patterns to save costs "IIRC the energy display package in the UK system is *optional* and it's effects can be duplicated by people who want to do energy accounting down to the device level.

"2) In cases of extremes (heat waves on southern climes, cold snaps in the north) it makes sense to inform people to switch to absolute minimum so as to avoid larger-scale blackouts."

The thought this might be fairly obvious and could be done as easily by statements given to TV and radio news services.

It remains massively expensive and massively unnecessary.

UK cops must justify using new mobile interception tech

John Smith 19 Gold badge
Big Brother

"Give me 6 lines from an honest man"

"and I'll find something to hang him."

No one complains when this sort of thing is used against people we don't like.

The only problem is *whose* definition of "people we don't like" is being used?

Record flight is step toward HYPERSONIC SPACE AIRSHIP

John Smith 19 Gold badge
Boffin

*Awesomely* mad

And yet not *entirely* impossible.

The puzzle is.

With near zero drag and low acceleration (IE Acceleration *force* > drag force) you could take as long as you like to reach orbital velocity.

But near zero aerodynamic drag -> near zero aerodynamic *lift* -> *very* big gas bags.

At some point you rising *not* due to density differences between the bag + payload and the atmosphere but the increase in the kinetic energy of the vehicle.

Can your increase in KE outpace the loss in lift so you don't loose all the KE (and hence velocity) you gained as you sink back into the (relatively) denser air you just left at *much* higher velocity and start to cook?

B****ed if I know.

Ofcom to finally yank sat broadband biz off the air

John Smith 19 Gold badge
Boffin

Lower latency was one of the *key* selling points of this technology.

satellites closer to Earth -> shorter slant distance -> lower round trip delays, shorter (undetectable?) pauses in conversations.

Key failures seem to have been.

1) Did not see how much the mobile phone market would grow with dramatic drops in tariffs, sizes and prices.

2) Too long to roll out so mobile phone had momentum.

3) Can work anywhere *except* in doors, so still need to carry 2 phones. WTF?

4) Serious over estimation of how many subscribers wanted/needed what is effectively *universal* roaming and prepared to pay for it.

5)Inmarsat had an *existing* service which they continued to refine, and had a solid brand already.

Note that most of these are not *technology* failures, they are marketing, management and economic failures.

John Smith 19 Gold badge
FAIL

So they seem to have spent more money on lawyers & litigation than building sataelites

But note the case against Boeing (which ICO won) found "Boeing guilty of fraud, tortious interference and breach of contract."

The lessons of the constellation satellite network seem to be starting to crystallize.

1) Make sure you've got a market

2) Don't have huge management boards (Iridium)

3) Make sure the terminals can work indoors.

4) Launch early. *If* you can get a revenue stream you can show a market exists and keep funding more work (preferable) or more lawyers (if necessary).

I'll note that Orbcomm, whose network was IIRC the *least* capable of the 1st generation commmercial sat comms networks, seems to be the only one still operating *globally* on a commercial basis given Iridium seems to be entirely leased to the US Govt.

UK.gov threatens to 'pull plug' on smart meter rollout

John Smith 19 Gold badge
Meh

@mark12

Which they will take out of your bill anyway.

Now if you say "Take it out of their *profits*" that might cool them off a bit.

John Smith 19 Gold badge
Alert

@AronG

"Surely the main reason this project should never happen is that it will be a field day for hackers. How long until the security is bypassed, weeks, days, hours?"

And why exactly would any UK utility company care about that?

John Smith 19 Gold badge
Flame

What benefits?

Bear in mind this got included because some energy company paid one of their Lordships to *have* it included in the relevant legislation.

It (in principle) eliminates *all* meter readers (which they like) and facilitates remote cut off (which they like) and lets them change the tariff your on in near real time (which they like).

And they will probably not be too expensive as they will get the ones the US have been using with some changes to quote in metric units. Of course they won't have the security issues already found in the US meters because well they will meet the relevant UK standards (not sure what they are exactly, much like those insulin pumps El Reg has reported on ).

So what's in it for the UK consumer? Well they *could* be designed to shift you to the best fit for your choice of tariff (cheapest, most "green", most energy sourced locally etc). No actual *promise* to do so, just a possible capability.

BTW Those nice "whole house" energy displays were (and AFAIK still are) *optional* (and 3rd party units can do the job just as well). So might not get one even if you liked them.

UK gas meters are *designed* to be +/- 2% correct *except* the ultrasonic digital types which are allowed -2/+3%. A design dating from the 1850's can be 1% accurate (not a transistor in sight) but they could not make it work with with the materials technology of the 1850's.

I'll take a wild guess that 150 yrs later it would be possible *if* the British Standards required that level of accuracy.

Britards, perhaps it is once again time to put pen to paper and suggest the relevant BS should be tightened (It's greener and with gas prices at an all time high fairer) and make your feelings on "smart" meters known to your elected representatives.

They don't have to do much and it saves HMG about £12Bn (who else do you think will be paying for this govt initiative).

Ofcom tarts up telco report with pretty coverage maps

John Smith 19 Gold badge
Unhappy

Presumably if this is the baseline

The only way is up.

Airbus brews Scandium smackdown for carbon Dreamliner

John Smith 19 Gold badge
Meh

"I fly from Washington D.C. to the San Fransisco area at least three times a month, every month; for 3+ years now."

Surely that sends you through Reagan National, supposedly one of the fastest airports in the world for getting people through (all those Senators and Con-gress people can't be kept waiting on some security nonsense).

There is no direct DC/SF flight?

Olympus gets government grilling after firing nosy Brit boss

John Smith 19 Gold badge
Happy

@heyrick

"Lie, cheat, and steal what you can when you can, then do a runner when somebody mentions the word "irregularities"..."

In Japan it is the whistle blower who has to run.

The "consultant fees" were IIRC c34% of the *whole* deal.

They are usually <5% and in this case a fair chunk of them went to some outfit in the Cayman Islands whose owners are unknown and which appears to have shut down.

Frankly it smells like someone is ripping off the stockholders to line their own pockets.

As to *who* that might be...

University students chase cluster victory

John Smith 19 Gold badge
Boffin

So how far away are they from the DARPA petaflop computer?

Just asking. I'm guessing they are getting closer.

CERN boffins re-running neutrino speed test

John Smith 19 Gold badge
Thumb Up

Whatever happens will be interesting.

Either CERN learns more about the sort of subtle errors that can mess up this sort of experiment (no difference) or it learns something new about the physics.

Good result either way.

MPs back more powers for ICO

John Smith 19 Gold badge
Flame

The only *real* threat for an organisation.

Fines, so what.

For large bodies (*especially* govt, local govt, NHS) *only* the prospect of the CIO or someone *senior* being held *personally* responsible and doing time will actually get some action.

Note this was being talked about when Tony Blair was PM.

Cheaper competition? Right, we're outta here

John Smith 19 Gold badge
Unhappy

Ah Microsoft and Intel

A folly a deux.

Just never call either one of them a monopoly

Insulin pump hack delivers fatal dosage over the air

John Smith 19 Gold badge

Let's recap

Some insulin pumps (which are *not* implanted but can be worn under clothes) can report their insulin usage by a wireless link, which is more frequent and can update the monitoring database without human error.

But the app is coded in Java and needs Internet Explorer, although no one knows why.

But the link is not line of sight, does not require user authorisation (like inserting a tag) and uses the unlicensed radio band at 900Mhz

It allows remote adjustment of flow rate and pump activation possibly because *some* users are children (whose insulin needs presumably vary too wildly to be adjusted any other way). This *might* explain why the alarm and vibration warnings can be shut off. Too distracting for the little darlings) and *some* users might have a wireless insulin monitor (from the same company?) which could update pump settings.

Maximum flow rate on the pump would require 200 (c3 hours) mins to dump the whole reservoir. If you wear it while asleep or while driving you might not notice it or be unable to do something about it. So do diabetics wear them to sleep?

Insulin tolerance amongst diabetics varies by an order of magnitude.

This product has been on the market since at least 2006 and possibly as early as 2001 which predates Stuxnet but not the case of the radiation machine whose faulty software dosed patients with 10x the set dose, and a few other cases of embedded systems working incorrectly.

European rules appear to say that since there are so many other ways to tamper with the insulin supply the mfg have a get out of jail free card.

The combination of security-by-obscurity (*despite* the fatal consequences to patients *if* someone tampers with the product) coupled with the circular logic of only-trusted-devices-will-update-the-settings-because-only-trusted-devices-know-how makes this a crime waiting to happen (it would *not* be an accident), always assuming it has not *already* happened.

BTW I first read about "artificial pancreas" research using pumps and an optical sensor in the late 1970's. It needed blood vessels *very* close to the surface to get a clear reading so you

had to "kiss" it. Not really convenient for update rate of every 10 mins.

Despite *huge* advances in MEMS, DSP, stem cell and genetic modification we still seem no closer now than we did then to dealing with Type 1 diabetes. Type 2's best bet seems to be trying to stay on a 900Kcal/diet to shock their cells back into insulation production and reception.

John Smith 19 Gold badge
Thumb Up

AC@13:45

"Cripes--the $200 remote engine start fob has more security."

On this showing it does.

John Smith 19 Gold badge
Meh

@Unicornpiss

"It's depressing that anyone would even think of exploiting this."

Welcome to plane Earth.

We are the human race.

Some of us are pretty bad. Some of us are pretty good. Most of us are somewhere in between.

John Smith 19 Gold badge
WTF?

AC@15:44

"The device must be designed to prevent accidental or corrupted commands being actioned. If it was required that medical devices were safe even when attacked by technically sophisticated people who aimed to cause harm then I do not think we would have any medical devices approved at all."

IOW because there are so many *other* ways to mess with sort of product it is categorically *not* the mfg's fault that this was not allowed for.

That must make users feel so much *better*.

John Smith 19 Gold badge
WTF?

@Stupidscript

There's an old DDJ article about someone reading the serial protocol from their Insulin monitor that's more than 10 years old so the fact the *data* was available and (at least on some models) decodeable has been around for some time. IIRC they were reading the stream to do *exactly* what you are describing.

But what I think surprises a *lot* of people (including me) is being able to *adjust* it as well.

Snooping someones insulin level is odd but *relatively* harmless but who designed in a way to dump the *whole* reservoir in one go? Override the change alarm?

Either the control protocol is *very* low level (more or less bit twiddling) or someone has designed in a "remote homicide" function.

Icon shows my surprise. Incorrect insulin levels can *kill* and US insulin pump companies should be very aware of this.

Boffins teach old radios new channel-hopping tricks

John Smith 19 Gold badge
Happy

@FaultyWarrior

"Although in the context of this article, good luck using a USRP for something like wireless mics. The mics are what, $200 USD? The USRP is around $1200 USD"

That's sort of the problem.

With enough volume in a product hard wired *always* wins in terms of complexity (fewer metaphorical knobs to twiddle), simplicity (works or does not work) and cost (high volume).

It's also likely to be *vastly* more power efficient.

Now if you want *flexibility* that's a different game.

This weekend: First ever iPADS IN SPAAAACE

John Smith 19 Gold badge
Happy

@Mike Flugennock

"Hell, for that matter, I'd be surprised if no engineers at NASA or Roscosmos aren't working on a way to repurpose iPhone or iPad hardware to replace the hard-copy "cuff book" checklists that astronauts have strapped to their wrists during EVA work. The things already have a gesture-driven UI; wouldn't they just have to write an app that downloads procedure checklists for a specific EVA so the astronauts can just "flip" through the pages...?"

Funny you should say that.

http://forum.nasaspaceflight.com/index.php?topic=27185.0

The referenced pdf goes into some detail.

Warning. Slow to load and "chewy".

John Smith 19 Gold badge
Joke

Simple

They will triple the stations computing capacity.

Seriously the ISS control network uses a bunch of Shuttle derived Multiplexer/Demultiplexers. The Shuttle MDM's are dumb but some of the ISS ones use 386s.

But as others have pointed out certifying electronic to work on ISS is *very* complex (IIRC batteries are especially troublesome) so how they managed to two on board so fast is a bit of a mystery.

Process, not just product, will save your IT department

John Smith 19 Gold badge
Unhappy

Hmm. System security is a process *not* a purchase.

Who knew?

‘Want to be more secure? Don’t be stupid’ redux

John Smith 19 Gold badge

@fenwick

Not really a solution but a suggestion.

Rule 1

Responsibility without *authority* (which includes being in the meeting where changes are being decided *without* including the impact on security) is *meaningless*.

This being some kind of govt (local or central should not matter too much) get out your job description (or get it from HR who should have a copy on file) and read it thoroughly.

Ask HR what the position is on what happens if a manager asks you to do something you're not trained and/or not qualified for.

Depending on the outcome notify your manager (and HR) in writing (and I would suggest take a hard copy for yourself to avoid any "amnesia" later on) stating you are not qualified to handle this task, have had no training to do so and lack necessary tools (IE PC access rights, passwords) to do the job . You request you either have training arranged for you (how is their problem) to give you the tools and skills or refuse to have anything to do with this.

Your manager has basically bullied you into doing this. If they told you "Hers a patient, perform a heart transplant on them" you wouldn't think twice about refusing them, would you?

How they respond will tell you a lot about if they are simply an under pressure manager or something more malignant.

US decommissions massive Cold War nuke

John Smith 19 Gold badge
Happy

May I be ther first say

Oh ere it's a *big* one.

On a slightly more technical note I always wondered how long one of these things could go without going back to the factory for servicing.

It seems very hard to believe this has been sitting on a shelf for nearly 50 years.

Top general warns of cyberspy menace to UK biz

John Smith 19 Gold badge
Joke

In other news....

A survey of British Turkey farmers has found that 100% of them were in favor of extending the Christmas season by 1 month.

The Chairman of the British Poultry Association said "It'll be a difficult job to grow that many more turkeys but somehow we'll manage".

Union enraged by secret driverless Tube plan

John Smith 19 Gold badge
Happy

£50k PA for a tube drivers job?

How many of you are above that?

Did you ever consider perhaps you were in the wrong job (at least temporarily)?

Cryptoboffin: Secure boot a boon for spooks' spyware

John Smith 19 Gold badge
Thumb Down

anyone remember "Paladium"?

Another of MS's "trusted computing" initiatives.

No more corporate documents being read by "unauthorized" machines.

It just needed *every* I/O device to support real time decryption of the datastream (so no back up copying of the *raw* data stream.

An end to industrial espionage (and investigative journalism) and piracy (or backup copying of your honestly bought software/movies/music).

Stupid idea then.

Stupid idea now.

And yes the idea that *any* system that relies on a secret key *remaining* secret will remain secure (IE its bi directional) for long ignores the history of *all* previous such computer security systems.

Rupert's MySpace mea culpa

John Smith 19 Gold badge
Flame

Corporate wellfare.

Where the penalty for buying a hugely over valued asset and running it into the ground is...

Another very well paid job.

I've often wondered if US executives have "agents" like professional sports people have sports agents to talk their remuneration package up and put a positive spin on their not-entirely-successful plans?

Head he gets a big bonus, tails he gets a severance package.

Meanwhile the stock holders (AKA the *owners of the company) get a chunk knocked off their dividend payments.

John Smith 19 Gold badge
FAIL

The Milly Dowler settlement realy was *small* change

After myspace.

Father of Lisp and AI John McCarthy has died

John Smith 19 Gold badge
Unhappy

@Louis Savain

"Still, McCarthy did as much as anybody (certainly as much as Minsky) to get AI research stuck in the hopeless rut of symbol manipulation for half a century"

I'd suggest you' restrain your annoyance for Marvin Minsky & Seymour Papert (who invented LOGO). Their book "Perceptrons" is credited with killing funding on neural networks in the US for decades.

http://www.jstor.org/pss/285702

For a description of the human behavior behind the AI.

Disk drive crisis: Economists are terrible weathermen

John Smith 19 Gold badge
Unhappy

So

Multiple sites in a country -> 1 site in a country

Multiple countries doing ti -> 1 country (at 1 site)

Site gets destroyed.

It's never a problem.

Until it becomes a problem.

Stuxnet-derived malware found infecting SCADA makers

John Smith 19 Gold badge
Happy

"Access to the source code"

How about ran a copy of stuxnet through a dis-assembler and did a cut and past on this?

It's already got some function you want and they're tricky to re-engineer, so why not just lift it from something that already works.

Just a thought.

John Smith 19 Gold badge
Happy

AC@22:12

Funding various Afghanistan guerrilla groups which turned out to include Osama Bin Laden and the Taliban.

I'd guess various assorted anti Castro Cubans who got into the US drugs trade around Miami.

I've always been impressed how the US has embraced the Moslem philosophy of "My enemies enemy is my friend"

Massive study concludes: 'Global warming is real'

John Smith 19 Gold badge
Thumb Up

what an unusual idea

Publish *all* your data.

Publish *all* your software.

That sounds like proper science.

Gov: DAB must battle on, despite being old and rubbish

John Smith 19 Gold badge
FAIL

So are most reg readers Luddites or do they actually reckon DAB in the UK is s**t?

Only I know which side I'd back in a technical discussion.

How many *more* digital transmitters have to be built now to get *partial* coverage of the UK?

I suspect this obsession has more to do with revenue generation (either by auction) or licensing than *any* nonsense about quality.

This is also the minister for the internet. Mr record-every-page-n-data-transfer-in-the-uk for "National Security" and filter file sharing packets Vaizey.

Groupon IPO seeks $11.4bn valuation

John Smith 19 Gold badge
WTF?

"Class A"

Friends tell me that is what I'd have to be taking to think this a good idea.

World's stealthiest rootkit gets a makeover

John Smith 19 Gold badge
Unhappy

Let me suggest a possibly radical ideal.

Building secure software systems is a *process* not an event.

Anyone who starts by calling a team meeting and telling them "We're going to right *secure* software from now on" is clearly a PHB who has f***all idea of how to create lasting change.

Does anyone think changing how a software development team does its work is going to be any *easier* than how (say) the NHS does its job?

I'd suggest it's not the lack of information on how to do this that is a problem.

It's *wanting* to do it in the first place that is and the skills to make the changes necessary for it to be applied.

World Solar Challenge: Why the winners were so good

John Smith 19 Gold badge
Thumb Up

"They are just a very good team with great attention to detail. And that’s how you win races. "

An excellent summing up. Thumbs up

If you want to win you have to take this fairly seriously.

It's that attention to detail brought on *by* wanting to win that may be the most valuable part of the lessons learned by the people who crew the teams.

But on a more surprising note "this post deleted by moderator" for 1st post on this article.

What could be so contentious?

Stallman: Jobs exerted 'malign influence' on computing

John Smith 19 Gold badge
Unhappy

The thing about walled gardens.

They have *no* doors.

You can't leave them.

Something you might like to step into one of them, *however* nicely designed they are.

John Smith 19 Gold badge
Happy

@PassiveSmoking

"He just stuffed an operating system build for the desktop onto a tablet and hoped for the best."

So pretty much like they tried this the last time.

Printable transistors usher in 'internet of things'

John Smith 19 Gold badge
Meh

So what?

Everyone whose tried this has trouble getting (IIRC) transistors much above about 5Mhz,

Now it's *not* the processor that's the problem. That's smart card territory. But

"Connected to the internet"

It's the *RF* link. WiFi? GPS enablement? 3G?

Try NFC.

Electron mobility is *the* key parameter here and since you can't do much of a device shrink ( the quick and dirty way to get a bit of extra speed) your materials properties have to be *phenomenal* .

But I bet they won't be quite that good.

1Ghz *printable* transistor. I think not.

Anyone remember the MIT Meja labs "Thinks that think?"

There are good ideas this technology *might* enable. Some of them I might pay for.

I doubt they will do any better than their (numerous) predecessors.

Energy minister gives grudging nuke endorsement

John Smith 19 Gold badge
Unhappy

The energy business is cost plus

There is *no* limit on what the ultimate price could be.

And with enough outside pricing factors that can be blamed for any "unfortunate" price rises.

John Smith 19 Gold badge
Happy

For another look on the Huhne speech, *especially* the "no govt subsidies" claim.

Check this.

http://blogs.channel4.com/factcheck/factcheck-huhne-far-from-clear-on-nuclear/8230

And note the result at the top.

It makes entertaining reading.

John Smith 19 Gold badge
Boffin

@I ain't Sparticus

IIRC the UK Govt commissioned a report on the "cost" of dealing with results of carbon dioxide release on the environment.

The price came to (at the time) £87/tonne of CO2 emitted.

So I guess that would be the cleanup cost (indirectly) of the output of a fossil fueled generating station.

John Smith 19 Gold badge
Happy

@hplasm

"Stoke the Atom Furnaces"

Yes, I am old enough to have seen this.

Ludicrous IRL but it is sort of a compelling image.

I'd like supporters of MSR's to adopt it as their symbol, but that's a long shot.

John Smith 19 Gold badge
Thumb Up

@Adrian Midgley 1

"If it is designed like the Rance Estuary scheme then it will produce power for those 6 hours as the water flooding into the reservoir turns the turbines,"

I had forgotten this fact entirely.

I suspect it's one of the *major* differences between conventional dams and tidal barrages.

Not obvious but pretty important.

Mass ASP.NET attack causes websites to turn on visitors

John Smith 19 Gold badge
FAIL

Looks like it works because of a basic misunderstanding.

Store information.

Hold in DB.

Output information back to user.

The implication is that this happens with text controls which deal with *passive* text.

But the DB executes code *regardless* of what kind of control it originates from.

The attackers know this. The "legitimate" developers do not seem to.

Now how many times had this been done *already*?

John Smith 19 Gold badge
Unhappy

@Tatsky

"So as others have pointed out, this affects any website which takes info, stores in a DB, and then displays back to users. Well, any website that doesn't sanitise the input data."

At last count the "designers" of about 614 000 of them.

But I'll make a small bet this will rise *lots* higher.