* Posts by John Smith 19

16330 publicly visible posts • joined 10 Jun 2009

Watch: Armed Ukrainian cyber-cops raid MeDoc in NotPetya probe

John Smith 19 Gold badge
Meh

Other accounting software accetable to Ukrainian tax office is available.

Handy, that.....

SpaceX halts Intelsat 35e launch twice in a row

John Smith 19 Gold badge
Coat

A small FH factoid. It's now within 8.86% of the baseline SLS payload to LEO.

I suspect SX could push it over that line but feel that would embarrass NASA.

OTOH once it's flying....

John Smith 19 Gold badge
Unhappy

"the Canaveral range is going completely down for 3 weeks for maintenance after this."

That could cause lots of trouble for SX. I think their launch pace from Canaveral is literally one every 2 weeks from either of the pads.

Any hold ups with it coming back up, or on their launches, will have substantial knock on effects.

John Smith 19 Gold badge

"it depends on whether the customer is willing to use a cheaper, second hand rocket. "

I think the term SX prefer is "pre used."

Shotwell (in a recent radio interview) said the current versions are good for 3 reuses, the block 5 for 12.

OTOH I think the satellite mass is above the SX baseline price for GTO payloads so there's no published pricing.

John Smith 19 Gold badge
Unhappy

SX have done well to increase their launch cadence

But I suspect they are also now keen to avoid any more stand downs due to rocket going boom, especially with Atlas V into the 50s and Ariane V in the 70's of successful launches.

Let's hope "third times a charm" for this payload.

UK.gov tips £400m into digital investment pot

John Smith 19 Gold badge
Unhappy

" Someone needs to ad DUPs to the units table"

You're a bit behind the curve.

It's already there.

John Smith 19 Gold badge
Coat

"its £400m Digital Infrastructure Investment Fund, "

Wot, 0.4DUPes?

That'll have to be very tightly focused investment to deliver that result.

America's net neutrality rage hits academia

John Smith 19 Gold badge
Unhappy

Seriously, this guy did not think a paper with that title might be a tad provactive?

Really?

Once people start threatening Messers Sue Grabbit & Run from day 1, no request to rebut, no request to mediate you know there's something smelly.

The original paper looks a hell of a lot like corporate astro turfing to me.

Automobile Association under fire for car-crash handling of data breach

John Smith 19 Gold badge
Unhappy

So all the details for a nice little phishing scam?

Only question is should it originate from the AA or the card provider?

Megacorp GSK inks AI drug development deal with Brit firm

John Smith 19 Gold badge
Unhappy

Remeber all those reports about AI taking white collar jobs.....

Guess what this..

Needless to say any reduction in the costs of developing a new drug (which given the approximate 4x increase in the speed of the process should be substantial) won't be passed on to the customers.

In after-hours trade on Monday, NYSE deployed test code to production

John Smith 19 Gold badge
Coat

No biggie. the NYSE has been having "flash crashes" for years.

During actual trading time.

Perhaps they should sort this out before business opens again.

Why, Robot? Understanding AI ethics

John Smith 19 Gold badge
Unhappy

"She frets about AI robots that may train children to be ideal customers for their products."

Which TBH is exactly what toy mfgs are doing as the technology advances.

I've often wondered how many staff at toy making companies have moved out of the industry and into more less morally ambiguous industries, like drug dealing, or used car sales.

One-third of Brit IT projects on track to fail

John Smith 19 Gold badge
Unhappy

I think most people were astonishied only a third are thought to be failing.

How many are actually failing is of course another matter.

As is how many are failing because.....

The PM is s**t.

Their staff are s**t.

The supposed "owners" of the project on the business side are s**t.

John Smith 19 Gold badge
Unhappy

" with an average of 2.57 reasons for each project in the sample set."

Paradoxically failure has many fathers.

None of whom will admit to being part of the failure.

Happy 4th of July: Norks tests another missile

John Smith 19 Gold badge
Mushroom

"just gabbing on until..Norks have the ability to nuke the whole US and..free to invade SK.

So flash fry the whole US just to get SK?

Sounds like overkill to me.

John Smith 19 Gold badge
Coat

Fat Boy Kim scoffs hot dog and feels feisty. Orders fireworks party on 4th of July.

This being NK, you know there's no pig in that 'dog.

GnuPG crypto library cracked, look for patches

John Smith 19 Gold badge
Unhappy

This is potentially useful to anyone planning to implement a new crypto algorithm with GPU's

Which makes this a pretty valuable result, wheather or not it compromises this particular algorithm.

Proving once again that "Crypto is tricky."

However those who bought Sky TV's premium packages can rest assured their content will not be pirated, as they use at least 2048bit RSA keys for their encryption.

Your content will continue to remain exclusive, and not to be enjoyed by the riff-faff, unwilling to pay the "Murdoch tax."

John Smith 19 Gold badge
Gimp

"One does wonder which side the TLAs are on ? ..general population or..shadowy masters ?

You may wonder that.

I do not.

T(and F)LA's appear to work for their governments. In fact they work for the agenda of their senior managers.

A bit like recruitment consultancies.

John Smith 19 Gold badge
Unhappy

"“We show for the first time that the direction of the encoding matters:"

Which TBH I doubt many people would have considered important.

Although that's in the open literature.

Who knows what various TLA's have investigated.

It's a library specifically labelled for cryptography. It's likely to have been high on their study list.

So. A cross-Europe cyberwar simulation. Of ransomware

John Smith 19 Gold badge
Unhappy

"Or what if they'd got control of _all_ the toasters, "

Already happened if you use some brands of web cam.

Then they go on to mount a DDOS on some poor ba***rd

John Smith 19 Gold badge
Unhappy

Run properly, what these show is what connections don't exist between countryies to cope.

So that they can be set up in time for the next case.

The point about "The Cloud" is well made as PHB types will continue to see the cost savings, regardless of just about every other feature of such a migration.

If 282-page doc on new NVMe drive spec is tl;dr, you're in luck

John Smith 19 Gold badge
Unhappy

It's a standard for disk drives using Non Volatile Memory.

Oh. Right. Good. Yes

Think I'll wait till the actual products start coming out.

SBU claims Russia was behind NotPetya

John Smith 19 Gold badge
Unhappy

Aren't TeleBots and BlackEnergy organized criminal groups?

Although in a kleptocracy it's hard to tell where government ends and criminal gangs begin.

As others have noted it's a cheap way for Russia to disrupt a regime Putin does not like, although the blowback would have been a bit annoying (nothing too serious though, given how well their corporations handled it).

OTOH Attribution is always tricky. The code is a totally artificial structure. You can treat it as a crime scene but you should always beware that any "accidental" slips may have been staged to decoy forensic investigation. That may sound paranoid until a job goes wrong and you p**s off a lot of people, like WanaCrypt with the Chinese and Russian governments.Then it could be the difference between sleeping soundly at night or digging that bag of fake ID out and starting your retirement early

Constant work makes the kilo walk the Planck

John Smith 19 Gold badge
Thumb Up

It's the reduction in uncertainty that's most impressive.

Roughly 3:1 in 1 iteration of the measurement procedure.

The potential revision in the Planck constant is also intriguing, given its intimate involvement in a lot of astrophysics.

BTW I had thought Kibble was also a brand of cat food, but it's actually for dogs. :-( .

NASA: Bring on the asteroid, so we can chuck a fridge at it

John Smith 19 Gold badge
Thumb Up

This is an outstanding idea. Asteroids are the only way to travel round the Solar System.

For the foreseeable future it's going to take a looooong time to get from A to B in our solar system, which means you'll get cooked by a lot of radiation.

Those elaborately crufted Aluminium cans that NASA, ESA, JAXA, ISRO are the Chinese build have roughly the radiation protection equivalence of 0.5% of the Earths atmosphere. OTOH 3m of Mars regolith will give you radiation protection equal to Earths atmosphere.

But that's a damm heavy lump of mass to get into LEO.

Asteroids are already in orbit. Even a small one one packs a huge amount of internal volume, and can still give you 3m thick walls.

This is the start of an actual viable way for humans to explore the Solar System.

What does an enterprise cloud look like?

John Smith 19 Gold badge
Thumb Up

Good to see a report that says what's not there yet, rather than just what is.

I'm always suspicious of any presentation that denies they have any loopholes in their product.

I guess the message is "A lot better than it was and mostly there, but still some parts missing."

German e-gov protocol carries ancient vulns

John Smith 19 Gold badge
Unhappy

Re: " secure, confidential, and legally-binding transmission over untrusted networks "

"This issue has nothing to do with Oracle the company or database, it is an attack against a crypto scheme"

Noted.

In which case it's much more serious that I at first thought. :-(

""the problems are in the OSCI-Transport Library version 1.2"

"Germany's public agencies are warned not to use OSCI-Transport until they've upgraded to the latest version of the library.""

3 problems with that.

This protocol has been around since 2004. No one knows if earlier versions have the same vulns

No one knows what the update process on those institutions is. If it's like the NHS some of them may still be running on library versions generations earlier.

The Updated version was released 2017-03-13, IE less than 4 months ago.

John Smith 19 Gold badge
FAIL

" secure, confidential, and legally-binding transmission over untrusted networks "

Given these factors perhaps a little more Teutonic thoroughness in the testing? Maybe an actual formal analysis of the protocol to find logical flaws?

But this is what really impresses.

"the OSCI-Transport library only needs to be in the classpath of an application - the vulnerable application does not need to actually use the OSCI-Transport library! "

Genius. A vuln you don't even need to use to make you vulnerable.

That said IRL. 1) This looks like an Oracle user issue. 2)How extensive is this protocols use (I'm guessing in Germany, quite a bit) 3) Who uses this version of the library? 4) Do later versions of the library carry the same bugs?

Depending on the answers this could be storm-in-a-teacup level up to almighty-clusterf**k-criminal-charges-deserved.

And yes. Being able to break the encryption of a message at will, which IIRC the German spooks are looking for, makes a mockery of "legally binding."

Intel AMT bug bit Siemens industrial PCs

John Smith 19 Gold badge
WTF?

" It..checks the number of characters of password received against the actual password,

and if there are no discrepancies, then it lets you in."

Just to be clear you're implying that they don't even check the actual password against the entered password? Are you sure that's what you mean as that's a real "WTF?" moment right there.

On the upside that limits the bug to Siemens systems only.

"And the code was written by Intel - this is built into the chips biut is NOT using the x86/x64 CPU (which is one of the things that makes it particulaerly nasty)."

I am aware of this. But Intel still mfg the chip, even if they basically cut and pasted the MIPS processor, and its code, without any apparent pen testing.

John Smith 19 Gold badge
Gimp

"intel Inside"

Spying on you.

"which was vulnerable to crafted packets over HTTP or HTTPS"

IOW someone had botched the implementation of an HTTP/HTTPS parser.

Question is was it written in house by Siemens or did they use a library from someone else?

If the latter then potentially anyone else who did will also inherit that set of flaws.

Google DeepMind trial failed to comply with data protection – ICO

John Smith 19 Gold badge
FAIL

"The Data Protection Act..not a barrier to innovation, but it does need to be considered

wherever people's data is being used."

and yet, despite the several decades since it was put on the statute books parts of the NHS still don't.

America throws down gauntlet: Accept extra security checks or don't carry laptops on flights

John Smith 19 Gold badge
Unhappy

"Especially in a country like US with a lot of internal flights from small airports "

Already happened.

All the 9/11 flights were internal to the US.

John Smith 19 Gold badge

Re: Does anyone know what pressurization and temperatur cycling does to Li battery packs?

Ooops.

Checked a bit further. Turns out all modern passenger jets with cargo holds within the main envelope will be pressurized, so not a major issue.

OTOH temperature depends on what they are carrying. The only actual data point I've seen is that a 767 hold will not go below 7c due to insulation but may be run at 18c.

So how do peoples battery packs handle 7c IE44.7F ?

John Smith 19 Gold badge
Unhappy

" Or there are other things stored in the container "

That argument cuts two ways.

Such a container has a lot of thermal mass. It all gets a bit hotter but nowhere near close to the average ignition temperature of most of it, smothering the fire.

That said Lithium sounds like something that burns very hot. OTOH water is a complete failure on burning Group I metals.

John Smith 19 Gold badge
Unhappy

"You appear to have aquired some serial downvoters.. What did you do?"

Impossible to say, as people who do so are unwilling to actually post a reason. Written communication does not seem to be their strong point.

I usually expect down votes from

Apologists for, or beneficiaries of (IE tax money) state surveillance

Believers in security theatre. I guess they're too terrified to leave their basements much.

Those supporters of the D who suspect I'm not wholly sympathetic to his vision.

John Smith 19 Gold badge
Unhappy

Does anyone know what pressurization and temperatur cycling does to Li battery packs?

Of the sort you'd get in an aircraft hold?

Or even if they are tested to survive such treatment?

Because it looks like quite a lot of people are going to be finding out.

John Smith 19 Gold badge
Unhappy

"Those countries were Obama's list of countries..greatest threat to the US..present time,"

How curious.

It seems there is something the D of Obama's that he does want to use.

Photobucket says photo-f**k-it, starts off-site image shakedown

John Smith 19 Gold badge
Unhappy

"I'd bet a bunch of those people would've ponied up for $5-$10/month."

That's the question of what constitutes "fair" pricing.

If you make money off the internet, shouldn't you pay something back to the internet?

Obviously that depends on how many people who use the service do make money, and what "something" should be.

IIRC $400 is around the Adobe subscription level for their tools.

John Smith 19 Gold badge
Unhappy

Let me suggest an exchange....

If you make money out of the internet

You should pay some money back too the internet.

Just a thought.

John Smith 19 Gold badge
Unhappy

"It'll be interesting to watch this space

It seems to work quite well for British banks.

Who are all pretty s**t.

John Smith 19 Gold badge
FAIL

"That includes free/cheap being a temporary illusion,"

You were on an upvote until...

"or socialist Ponzi schemes like a state national health service or a state pension scheme"

This statement tells us you are

a)Probably an American

b) Definitely an Ahole.

Hyperconverged infrastructure. It's all about the services

John Smith 19 Gold badge
Thumb Up

Another excellent (and short) tutorial on this area for the non specialist.

Thank you once again. One especially intriguing nugget was this point.

"Virtualization doesn't just mean x86 hypervisors. "

Now if you want to migrate off a 40YO instruction set design this sounds quite important. It also implies a way to sift out quite a lot of the HCI offerings quickly.

OTOH

"Windows is going to keep on storing profiles and folder redirections on SMB until the bitter end "

Is quite depressing.

Presumably the later versions are a lot more secure than V 1.0.

SMB is still a fine example of the former Chairman's policy of "Grab them by the protocols (at all levels) and the customers will follow you anywhere"

Shock: NASA denies secret child sex slave cannibal colony on Mars

John Smith 19 Gold badge
Unhappy

"Well Trump / The President listens to him."*

Hopefully this presidency will give USianns a solid grounding in the "halo" effect and why you shouldn't trust its effects

*Because bu***hitters love bu***hitters who can bul***it.

John Smith 19 Gold badge
Unhappy

Reigniting the debate on what constitutes an important skill

And spotting when someone is crazy as a s**thouse rat remains one of them.

How to pwn phones with shady replacement parts

John Smith 19 Gold badge
Childcatcher

sounds like a great way to extend the mfg ID chip on some printer cartridges to phones

Y'know, for your own good.

Yes I understand the theory.

No I do not want.

Europol, FBI, UK's NCA ride out to Ukraine's cavalry call

John Smith 19 Gold badge
Headmaster

"Surely, that would make it the Inter-National Crime Agency."

Depends if you view Wales, Scotland etc as sovereign nations or regions of the UK. AFAIK you can't get a "Scottish" or "Welsh" passport.

That would make this the "Intra-National Crime Agency" of the UK.

Civil rights warriors get green light to challenge UK mass surveillance

John Smith 19 Gold badge
Gimp

"government doesn’t need to spy on the entire population to fight terrorism."

And it never did.

It was always about the faceless, unelected (and basically unaccountable) data fetishists of the Home Office (has there ever been a Ministry whose incompetence and malevolence has caused as much misery and wrongly directed hatred?) and their like minded (and equally IT illiterate) friends in the Security Service.

Their dream is not a safer Britain.

It's a Britain where they (or their carefully selected friends) have something they can use on every man, woman and child in the country.

Normally people would qualify that statement by "important" men, women etc but this technology means they can afford to do it to everyone.

So they will.

Privacy, consent laws under 'unprecedented strain'. We need a data-watcher watcher

John Smith 19 Gold badge
Gimp

" an underlying fear among the public, "

If only.

Though if "the public" thought for one minute about the issues they should indeed be afraid.

Meanwhile data fetishists continue to walk UK citizens to their virtual, impenetrable cells for lifetime monitoring of every aspect of their lives "for their own good of course."