* Posts by -tim

790 publicly visible posts • joined 10 Jul 2009

Page:

It's that most wonderful time of the year when tech cannot handle the date

-tim
Pint

Thank you for all the birthday greetings

Long ago in the before times, I set up a facebook account. They insisted on a birthday but I didn't trust them so I used the 29th on an odd year.

/beer for all the facebook friends who forgot the important part

Dump C++ and in Rust you should trust, Five Eyes agencies urge

-tim
Facepalm

Re: Bull

That isn't showing that is is well maintained, it is showing that is full of critical flaws. Well designed code never needs that much continual hacking.

Atlassian cranks up the threat meter to max for Confluence authorization flaw

-tim
Facepalm

but, but, but it is all fine!

But they are so good!!!!

We have the option of using our in house or their cloud stuff. They don't know security.

Hell, I caused one of their top unicorn programmers to have a meltdown on a train after some hard questioning.

I lock their stuff back behind way too much such while I'm trying to get the boss (and stockholder of Atlasicrap) to get something else.

China requires any new domestic Wi-Fi kit to support IPv6 and run it by default

-tim

Re: The Cultural Evolution - little leap forward :)

The maximum and minimum "host" part of a ipv6 address using modern v6 stacks is a /64. A /56 lets you create 256 networks from your ISP. Some people find it helpful to think of a /64=class C, /56=class B and the /32 that the ISP was allocated as a class A.

Lost voices, ignored words: Apple's speech recognition needs urgent reform

-tim
FAIL

Apple won't follow their own stnadards

When Apple introduced MacOS 13 Ventura, they added a feature for right click to cut an object out of a picture effectively removing the background of an image. The problem is this takes a while and then the right click menu gets another item added at the bottom. If the screen is set up for people with poor eyesight, the menu will jump up just as a menu item is selected. That feature is often used for "Open image in new window" followed by zooming to be able to see the image properly.

That new "Copy Subject" feature needs to have a way to disable it. It wastes power as it runs the GPUs full speed and some of us never want to use it. Adding the extra menu option after a few seconds goes against apples own design guidelines and the option should be grayed out until it decides if it will work or not. Apples own page on the feature says "it might take a few seconds for Copy Subject to appear." Meanwhile it is burning through battery power for a feature is mostly used for creating copyright violating memes.

Oracle's revised Java licensing terms 2-5x more expensive for most orgs

-tim
Facepalm

Other runtimes?

Will third-party Java runtimes get around this issue? I thought the Oracle license claimed full ownership of Java in all forms and you owed the license even if it wasn't their runtime being used. This ended up in court with Google's Android API but I don't think that settled the issue if the company signed the small print contract with Oracle.

Google toys with internet air-gap for some staff PCs

-tim
Alert

Air-gap?

That term has changed meaning over the last few years. It used to mean there would be absolutely no path to the net at all from an air-gapped system. Now it seems to mean somewhat locked down.

Uncle Sam sounds like it may actually do something about rampant visa H-1B fraud

-tim
Coat

Indentured class workers please?

I've been approached hundreds of times to go work in the US and many times with the recruiter pointing out they will help me get the H-1B visa. Their interest wanes when they find out I don't need a visa to work in the USA.

/Mines the coat with two passports

Microsoft tackles SaaSy URL sprawl, dumping its dotcom in favor of cloud.microsoft

-tim
Facepalm

Top level corp domains were always a bad idea

Already fixed here:

$ host www.cloud.microsoft

Host www.cloud.microsoft not found: 3(NXDOMAIN)

I add top level domains when I have a need because almost all the common ones are full of scammers.

Google Cloud slips over in Europe amid water leak, fire

-tim
Facepalm

So someone else forgot the first rule of data centers

Water will get into your data center. If there isn't a plan to get rid of it, it will do damage and Murphy's laws says the water will find the place to do the most damage.

New models of IBM Model F keyboard Mark II incoming

-tim
Devil

Re: I thought I was safe

In the war of vi vs emacs, one place were emacs win is the cat test.

Open a file in each editor, drop a cat on the keyboard.

Which editor does more damage and how long does it take to fix it and how much is unrecoverable?

Emacs wins the cat test. It also wins the Eliza test.

Apple patches all the iThings, including iOS 15 hole under attack right now

-tim

Re: I'll check.

> As it's 8 years old I think Apple can be forgiven for no longer providing updates

Why? It would take Apple a team of 5 engineers to provide critical security updates for everything they made since their G4 Mac days. Some times those patches would end up turning off features but they could keep the older equipment functional enough to not end up as landfill.

Most countries have laws that say a product must be supported for a number of years based on its cost. Apple products tend to be in the category where those laws require a decade or two of support for critical problems.

If we plan to live on the Moon, it's going to need a time zone

-tim
Coat

Wasn't this solved decades ago?

There have been hacks to the timezone files used by Unix/Linux/OSx to adjust for moon time and solar noon time.

One odd advantage of the leap second is that now some programmers understand that the concept of time in computers isn't quite as easy as it first appears.

It's been 230 years since British pirates robbed the US of the metric system

-tim
Coat

Re: The amount of times...

In 1700 it was much easier for a scientist to calibrate a home made thermometer using ammonium chloride cooling bath and a docile dog. The temperature of boiling water required a barometer at higher altitudes and calibration tables. The human armpit temperature of about 96 allows hand drawn hash marks in repeated halves. Many very early Fahrenheit thermometer are often marked every 3 degrees.

What goes up must come down: Logitech sales tumble amid PC slump

-tim

I have 3 M570 trackballs on my work bench that are disassembled as I tried to find out why they don't work properly anymore. The mechanical switches still work yet they behave oddly. One won't trigger the edge detection on the mac. Another has an odd issue with the right button. My next guess is to reflash the processor to see if that helps.

They dropped the wired versions so now they all need batteries and a wireless dongle. It isn't like a cable on a trackball is a problem.

Linus Torvalds's faulty memory (RAM, not wetware) slows kernel development

-tim
Facepalm

How about an error message?

Perhaps it is time that the boot process produce a warning for systems that don't support ECC.

I've noticed that old systems that properly report ECC errors tend to do so around the time of unusual solar activity.

Systemd supremo Lennart Poettering leaves Red Hat for Microsoft

-tim
Coat

Re: Motive found.

The name field in the sysV init tab is there for dependencies and it has been there at least 3 and a half decades.

UK Home Office signs order to extradite Julian Assange to US

-tim
Facepalm

Re: Appeal

They could appeal based on the US flat out not telling the truth in a UK court. The US has stated the charges and swore those were the only charges. That leaves out the John Doe warrants against the author of the hacking tool "strobe." I know this because I've seen some of the witness statements and I know there will be additional charges once he is in the US.

Record players make comeback with Ikea, others pitching tricked-out turntables

-tim
Coat

Re: That vinyl sound

While the DDD should be technically more correct, I'll take the AAD or ADD version most of the time. In my CD collection, the AAD is left of the ADD which is left of the DDD which is left of the "remastered" versions. The ones that get the most play are the ones on the left.

Perl Steering Council lays out a backwards compatible future for Perl 7

-tim
Coat

The real Perl problem: lack of new developers

Our problem with Perl is lack of new programmers. Our business runs a bit of Perl and it is the most profitable per line of code by a huge margin but new coders haven't even looked at Perl.

As far as backward compatibility goes, recent version of Perl 5 have broken more things that any other version change I can remember and I have scripts that started out with version 3.

FreeBSD 13.1 is out for everything from PowerPC to x86-64

-tim
Boffin

Re: Question

openssl 3 is removing some of the older broken encryption by default. That means talking to ancient un-updated equipment won't work out of the box if ever. We keep a version of ssh 6.6 compiled with open ssl 1.0.1 called ssh1 for those rare cases but web things are getting harder. We have used haproxy 1.8 configured to talk to old ssl backends also linked to older openssl which lets us use modern browsers with old hardware and old hardware with new web sites. We use the odd mixes for devices that can't phone home for firmware updates because they can't do modern ssl/tls but we have to configure per host and play dns and cert games to get that to work.

openssl skipped version 2 because of the protocol 1 vs protocol 2 version issue.

Cisco warns of premature DIMM failures

-tim
Facepalm

Whos DIMMs?

Does Cisco even make DIMMs as they seem like a part that should be outsourced. If that is the case, who make them and what else are they in?

Reliable systems with large memory need to have ECC. There is no excuse not to have it in. While rare, on our systems that properly record ECC corrections, it is interesting they happen on different systems at about the same time.

Oracle offers migration path for Solaris 10 apps

-tim
Coat

11.4 on what hardware?

11.4 won't run on anything we owned so it was off to FreeBSD for us. 11.3 had finally fixed the security issues I didn't like from 10 and ZFS was a game changer. Oddly enough there were still patches to Solaris 9 hiding on the solaris 10 container stuff the last time I checked a bit over a year ago. That still runs on SPARCstation 20 from 1994. That means you could have a nearly 30 year old computer that meets security compliance regulations if you could keep your applications patched.

We deracked a V100 last week. The thing was older some of our staff. It was removed because one of its original disks was going bad and we were pulling out a bunch of far newer systems. We still have one X1 in our internal R&D DNS cluster and will remain there until it fails which might be a while since it has flash IDE disk emulator.

I've got a tadpole Sparckbook 2 from 1993 that still works except for some of the keys are a bit of a problem.

Day 7 of the great Atlassian outage: IT giant still struggling to restore access

-tim
Facepalm

Options?

It is amazing how much of Atlassian's stuff can be replaced in a single weekend by two coders with a private usenet server, git, some perl template toolkit web pages, markup to html scripts, and a html friendly newsreader.

Apple's Mac Studio exposed: A spare storage slot and built-in RAM

-tim
Facepalm

Why do people keep thinking the memory is soldered?

Because it is. It is soldered to the same substrate that the CPU is attached to and a few people have upgraded them, it just needs more specialized equipment than any low end repair shop happens to have as well as donor ram chips which can't be sourced new.

The real reason the M1 chip's memory is so fast is they use about 877 pins to transfer more data in parallel compared to the 288 pins of a DDR5 DIMM. That allows the chips to transfer the address and more data in parallel without wasting cycles.

Zero trust? Not yet a must for most IT departments

-tim
Facepalm

What exactly does Zero Trust mean?

The term is already being perverted in the industry. Places want to do Single Sign On and Zero Trust to be fully buzzword compliant.

Another meaningless term now is "Air Gapped." Apparently acceptable use somehow now means firewalled with all inbound connections disabled to the specific host rather than the "No network at all" like it used to mean. I've seen the term used to describe a host on a typical office LAN where other hosts have inbound traffic allowed.

Apple emits emergency fix for exploited-in-the-wild WebKit vulnerability

-tim
Facepalm

Only some are patched

More than 5% of the macs that hit my web sites are versions that are old enough that they will never be patched and they cluster around the last supported versions for hardware that appears to be fully functional except for their stock browser is full of holes. A team of 5 people in apple could keep these older machines running securely. Apple hardware seems to keep getting handed down to others when new machines are bought. We still see PPC based macs. Most countries have laws that require major appliances to be supported for at least a decade and it is time those laws were enforced with the vastly more expensive computers particularly with the total lack of hardship it would cause Apple.

Lost your mouse cursor? Microsoft's PowerToys 0.55 has you covered – with a massive crosshair

-tim

Re: I put it down just a second ago, where'd it get off to?!

I have two extra buttons on my trackball and I would love to have them move the cursor to a specific place. Then I wouldn't care where the cursor had been.

Now if Logitech would just allow space for a USB cable out their next model, I won't have to keep buying batteries since my trackball seems to stay where it should be.

Linux distros haunted by Polkit-geist for 12+ years: Bug grants root access to any user

-tim

Re: FreeBSD appears to be affected

pkexec isn't installed on most FreeBSD systems. It doesn't appear to be in the base system install and likely in polkit package.

Never mind the Panic button – there's a key to Compose yourself

-tim
Coat

Enhanced layout

The enhanced layout was proposed by Scandinavian governments to reduce the premium they paid for localized keyboards. Or at least that was the story I was told about why the VT100 and VT220 had different keyboard layouts.

Log4j doesn't just blow a hole in your servers, it's reopening that can of worms: Is Big Biz exploiting open source?

-tim
Facepalm

Re: what's hard

The Apache foundation was helping the odd good project and then it adopted a Tomcat. It has now became a crazy cat lady. It needs to learn to say no more.

Nobody cares about DAB radio – so let's force it onto smart speakers, suggests UK govt review

-tim
Facepalm

Survey says BS

Can we get some real numbers of how many digital radios are actually sold to consumers who know what they are buying? Stop counting the ones that come with the TV that no one ever uses. Stop counting the new cars and resold cars because those numbers are about as useful as the number of consumers who bought car jacks last year. Find out how many consumers went out to buy a digital radio to listen to digital radio. Then tell me how many are bought. Better data would include how many knew the new radio they bought was digital and wasn't mistaken for an AM/FM one.

If your apps or gadgets break down on Sunday, this may be why: Gpsd bug to roll back clocks to 2002

-tim

Re: GNSS is not just GPS

Navstar is the US DOD's brand of GPS.

Canon makes 'all-in-one' printers that refuse to scan when out of ink, lawsuit claims

-tim
Facepalm

There had to have been a logical reason, right?

I know of an HP multi-function that is warning about a "scanner error" but the scanner isn't the flat bed scanner on the top of the device, it is the laser scanner that paints the image on the drum when it should print that isn't spinning fast enough that causes the error. At least that device has reasonable errors vs the guess the light dot pattern problems of my older HP printer.

Air gaps have been 'shattered’, says new Indian policy on power sector security

-tim
Coat

Re: Simples!

You can also cut 3 of the 4 pairs of an ethernet cable for the same effect. You will have to tell the driver that it is in a odd state with no sync but that is usually an parameter to ifconfig or its replacement. You can extend the technique to make Y cables that listen to one host and talk to two or more devices the same way as twisted pair ethernet is still technically a shared bus with typically just two ends.

Clearview CEO doubles down, claims biz has now scraped over ten billion social media selfies for surveillance

-tim
Facepalm

Copyright violation?

They don't have the right to store any photo I post online. What is the current copyright fine per violation?

Take a look, and you'll see... Windows XP? Bit of Dairy Milk, Fruit and Bork at Cadbury World

-tim
Coat

News Flash?

What are the odds that the show and tell app that should be running was written in flash? Moving on might be a whole lot more challenging than it would appear.

As far as unsupported, doesn't MS still have that pay for support thing going if you are willing to pay big? If I remember right, the cost per workstation today for that support would still be smaller than some Oracle seat licenses.

Imagine a fiber optic cable that can sense it's about to be dug up and send a warning

-tim
Coat

Re: Yes, you can influence events 10km away

I call the backhoe ISO layer 0.

-tim
Thumb Up

Up?

The area just above where the map shows "S60" is the data centre at 530 Collins St. The cluster of dots shows were the fibre goes up the building.

GitHub merges 'useless garbage' says Linus Torvalds as new NTFS support added to Linux kernel 5.15

-tim

Re: Thanks to All

As far as the confusing and obtuse parts of git, I wonder if that is related to how git has some verbs where the subjects don't quite follow normal UK/USA speech patterns. It is like a Finn or a Swede who asks "I'm a bit low on cash, can you borrow me $20?" It is hard to parse because the direction of the word "borrow" seems backwards to most people. I've heard that enough times I should figure out the proper way to ask for my money back.

After reportedly dragging its feet, BlackBerry admits, yes, QNX in cars, equipment suffers from BadAlloc bug

-tim
Facepalm

This bug is everywhere else too

QNX appear to use the same calloc as many GNU projects and the same bug has been in MS products since they learned to love C. calloc has always been odd when called with out small sizes that are nice powers of two since the function might just try to guess how things are aligned. A calloc(10,5) might assume that 10 items need to be 8 byte aligned (like large floating point numbers on a number of older architectures) and allocate 80 bytes compared to the 50 that many programmers would expect. It is another C function that was useful in its day and now shouldn't be used. Does calloc(3689348815, 5000000000) return a null on your system (assuming you can malloc 1.3g)?

China sets goal of running single-stack IPv6 network by 2030, orders upgrade blitz

-tim
Facepalm

At least they won't have to worry about international payment security

The payment security standard PCI-DSS still seems remarkable quiet on the IPv6 front to the point where 5 of the top 5 PCI external security scanners can't even scan an IPv6 server at all. The rules say to scan all protocols that are enabled and ping ::1 works on almost all modern hardware so IPv6 needs to be scanned.

Akamai Edge DNS goes down, takes a chunk of the internet with it

-tim
Facepalm

How?

DNS was one of the 1st systems to cope with large scale failure on the Internet. How do you break DNS of this size? If all else, run two different systems.

Exsparko-destructus! What happens when wand waving meets extremely poor wiring

-tim
Facepalm

There can't be anything wrong if it isn't even hooked up

I worked for a place with a Sun E10K and it of course came with redundant power supplies. The problem is no one ever plugged in one side. The one that was hooked up had a nice short curved lead near the corner of the server that went to a rather large plug. Someone managed to get their foot in that loop while walking too close to the very expensive computer and the power went out.

Refurb your enthusiasm: Apple is selling an 8-year-old desktop for over £5k

-tim
Facepalm

Still in support?

So they can support some older hardware yet leave millions of old devices unsupported or landfilled.

Here's how we got persistent shell access on a Boeing 747 – Pen Test Partners

-tim
Facepalm

Re: File

How young is this company? Should this be filed under "Security companies that don't have a decent tool box"? It isn't that hard to grab the source from the 20 year old versions of the scanning tools and recompile it on modern systems.

Cloudflare stops offering to block LGBTQ webpages

-tim
Unhappy

Where do these filters originate?

I've use a website that can't be linked to on facebook because of something about "community standards" yet there has never been anything offensive on the domain and it has been around for more than 25 years. I'm sure facebook is using some third party service but I can't find out who it is or how to have them re-review their data.

It took 'over 80 different developers' to review and fix 'mess' made by students who sneaked bad code into Linux

-tim
Facepalm

Student loan refunds?

The US Dept of Ed has a program where a student can ask for a cancellation for student loans from Universities that don't deliver what they claimed. As this incident has made degrees issued by that department nearly useless, could all their current and many of their past student now ask for their student loans to be canceled?

Google will make you use two-step verification to login

-tim
Facepalm

Re: Another Attempt By Large Corporations To Erode Privacy

I tend to use 29 Feb with an odd year for any site that is willing to take it.

Nasdaq's 32-bit code can't handle Berkshire Hathaway's monster share price

-tim
Coat

Re: This has happened with them before

Back in the day of fractional prices the old 16 bit systems would have a scale for each stock so that BRK.B would be traded in 1/2 while IBM would have been traded in 1/8 or 1/16ths.

BRK.B did hit the 32767 1/2 wall for a while.

Page: