* Posts by streaky

1745 publicly visible posts • joined 5 Jul 2010

Vaizey: Legal right to internet access, sure. But I'm NOT gonna die on the 10Mbps hill

streaky

It may be that you have substantive grounds for hating BT and everything it stands for but it would strengthen your case if you explained exactly what those grounds are.

I absolutely don't I was prefacing being on their side on this particular issue. You could also try reading my previous comments :=)

streaky

I feel like I gotta preface this by saying I hate BT and everything they stand for and the damage they do to the UK economy and citizens by simply existing, but:

If they're billing you 8k to put a line in there's a fairly decent chance it's going to cost them 800k to install it because you decided to park up in the middle of literally nowhere. Most people consider these things before they buy a house so you're probably SOL. If I'm right and you really need a line you should probably be happy it's only 8k.

Admin fishes dirty office chat from mistyped-email bin and then ...?

streaky

The obvious solution is to just bounce invalid recipients, like everybody else

This right here, is how email works. User gets bounce, user realises their mistake and everybody is happy.

In this completely made up story the admin thought outside the box without reading any RFCs (as admins are prone to do) thought he was being clever and in the end not only snooped on other people's private lives (I mean using corp email for this stuff is begging for trouble but it's still essentially private) and also broke the entire global email system in the process.

This stuff doesn't have to be difficult but people really so enjoy trying to make it so.

Also if your boss has a problem with your email system working correctly go find yourself a new job and do it now because your company is probably going to go down in lawsuit and you're probably going to end up named as at best a witness and it's going to cost you a lot of money in legal fees.

Cyber-security pro? Forget GCHQ, BT wants to hire 900 of you

streaky

Re: Question is what they will get...

Why would literally anybody want to work for these idiots.

BT couldn't build a telco network if the government paid them (oh, wait) - couldn't internet their way out of a paper bag one might say (no really why doesn't every house in the country have FTTH for the money the taxpayer has thrown at them).

GCHQ - the clowns more interested in looking at your cat pictures than finding terrorists.

Yeah no kidding they are having an issue recruiting. Everybody who knows about this stuff; GCHQ makes their skin crawl. We had this gem like 2 weeks ago which demonstrates exactly what is happening here:

The people who lobbied me hardest for independent authorisation, something that really passes muster internationally, is the intelligence agencies. It’s partly a question of recruitment for them

Problem is they don't do as they say and go do comint properly and that's the real issue here.

Jenkins 'fesses up after inadvertently slurping users' usage stats

streaky

Re: Quite disturbing

Rofl.

Think cron written in Java (can haz memory back) that actually isn't a cron at all that detects issues in code on a per-commit/push basis for developers that is basically designed to habitually embarrass poor developers (which is why we love CI)

Senator Wyden recalls SOPA fight in bid to defeat encryption-weakening efforts

streaky

They can force you to divulge your private key

No they can't. They can try but that isn't the same as actually forcing you. I've discussed this before but the blanket law re crypto keys in the UK pretty plainly isn't compatible with the charter. Also it's still a choice either way. If we all refuse to hand over keys the law is moot, terrorists won't do it so why should the rest of us; by definition that law is disproportionate. Hell this is exactly why the law isn't used because they don't want to see it tested because they know it will fail in both primary and secondary aim.

Now, where can I get one of these for Parliment?

Depending on your political flavour either Watson or Davis is probably about as close as you get.

streaky

It's not *that* sensible; I like the positive nature of the sentiment - but we don't need permission for strong crypto. No government can stop it, I have the source for OpenSSL on in my possession and they can blow me.

The irrelevance of these US corps will answer the US governments question if they dare try so win-win-win.

Spanish launch heroic bid to seize Brit polar vessel

streaky

Re: Our old enemies, the Spanish?

I was thinking we could park some Type 45's off their coast and see if they still think it's funny but your thing works too.

TLS isn't up to the job without better credential protection, says RFC

streaky

As for 2FA, this inevitably means phone authentication

I did say crypto-based, which implies fobs.

streaky

but Melnikov says it “failed widespread deployment and has had only limited success”

Only because the client-side implementations are poor quality for end users to use and I wouldn't expect a protocol change to affect that. Any new protocol is going to have the same issue because it probably won't deliver the UX improvements that are badly needed- and honestly we need those before we need new protocols.

Also not for nothing but we shouldn't be building new crypto-based authentication systems without crypto-based 2FA built into them from the ground-up. Or at least demanding in the protocol that the user stores support them.

Obama puts down his encrypted phone long enough to tell us: Knock it off with the encryption

streaky

Re: hypotheticals?

If it wasn't for encryption the internet wouldn't exist and we wouldn't need publicly available strong crypto. The fact that seemingly everybody in government in at least five eyes countries is too stupid and ignorant to know this only underlines the hilarity.

And still nobody has talked about what they'd do about foreign-based crypto projects that are open source.

Tech biz bosses tell El Reg a Brexit will lead to a UK Techxit

streaky
Boffin

Re: its not the Berlin wall FFS

Yes. This stuff is utterly illogical.

Here's where it gets silly:

Others reckon leaving the common labour market would slow their ability to move rapidly against rivals and to bring on talent in a competitive field.

The reason? The end to freedom of movement that being a member state of the EU has provided.

Why's this silly? Because the EU freedom of movement makes the UK implement harsher controls on immigration from outside the EU. Granted it's a matter of personal opinion if those controls have to be there, but there they are. This means it's more difficult to recruit tech talent from the US, from India, from China, from Japan (the list goes on).

See the problem here? Germany isn't exactly known for being forwards thinking when it comes to the digital economy so what good is being in the EU doing any of this - the answer of course is the UK's tech industry is being actively harmed by it.

And yes not for nothing but being outside the EU doesn't mean people can't be recruited from in the EU, just they'd have to justify their employment in the UK - that shouldn't be difficult; although I personally know a lot of well qualified experienced people who can't get tech jobs because they have to compete on pay with people who are less qualified and less experienced who aren't from the UK who will take nonsense wages..

SAP backs UK remaining in the EU ahead of vote

streaky

Re: Confusing..

Which seems a rather more adult and professional response than for a job-reaping software outfit like SAP to indulge itself telling us that we ought to stay in to make life convenient for the company.

Seems rather more like a cop-out. They either want us to stay in or they don't and if they do they should politely suggest some compelling reasons because no politician has.

streaky

Confusing..

.. wouldn't with couldn't:

would not explain in detail why it believed the UK was better in the EU

If you honestly believe it you're going to make a compelling argument. Has nothing to do with interfering - there's no good reason why the UK should be in the EU for the UK or the EU which is why nobody can voice a reasoned argument to stay in.

If a German global megacorp can't come up with a reason nobody else has a hope.

UN rapporteur: 'Bad example' UK should bin the Snoopers' Charter

streaky

Re: Nice to think the UN will take a stance on this...

The ECJ will be able to get them to stop if they choose to. They're not going to choose to is the problem.

streaky

Re: Bleeding heart liberal...

Next they'll be telling us we can't invade countries without good reason, abduct people and hold them without a trial, or torture people because "it might set a bad example".

Next hopefully they'll be telling us to deal with one issue on it's own merits rather than conflating a shopping list of different issues. No really, please stop that; you guys make it really difficult for me to argue your side.

This is a tendency in Snowden that really grates with me.

streaky

We got a tango guys. Good job his comms are already being monitored.

FBI says NY judge went too far in ruling the FBI went too far in forcing Apple to unlock iPhone

streaky
Mushroom

The problem is it probably requires Apple to abuse their signing keys, so what you have then is court-sanctioned CA abuse on record - there's no situation where it'll end at this one phone or even at Apple; or even in the US.

Next week it's they want to get into somebody's Windows desktop or a cert created by Globalsign that looks remarkably like a gmail cert so they can backdoor somebody's email. Slippery slope doesn't do that justice, indeed it could (or rather should) bring down the entire economic system. That's the FBI and the courts not doing their job.

Ad-blockers are a Mafia-style 'protection racket' – UK's Minister of Fun

streaky

Re: It's perfectly LEGAL to own a tv hooked to a tv aerial with no license.

Guys - the discussion is about UK licenses not German ones or whatever the hell you're all talking about.

The license is for watching TV not owning and having one plugged in. Simple as that. No ifs/buts. Go read the act. Then go UNDERSTAND the WORDING of the act.

Or failing that go read what the TVLA thinks it means. http://www.tvlicensing.co.uk/check-if-you-need-one

streaky

Re: Takes one to know one

But to be fair, they do have a page where you can inform them that you do not require a licence.

http://www.tvlicensing.co.uk/check-if-you-need-one/topics/telling-us-you-dont-need-a-tv-licence

IANYL but I strongly recommend not using this, it only causes them to hound you more. In my experience it's best to ignore them until they show up with a warrant. This is of course if you're not actually watching TV, if you are and you just don't want to pay this advice will cause you more problems.

Microsoft wants to lock everyone into its store via universal Windows apps, says game kingpin

streaky

Re: Deja Vu

open source can include "signed code" features that would allow modified versions to be detectable, but still work if 'unsigned'

What's the point in signing any code if the whole system isn't signed. By definition that does nothing.

Also I dunno why people are obsessed with berating Microsoft for things they haven't done. If you don't like Microsoft that's cool, the issue doesn't affect you so what game are we actually playing here?

That was true then, and it's true now

No it wasn't and no it isn't else I wouldn't have bought the division from steam to uplay, I'd have bought it in the windows store. See how this works?

streaky

Re: Deja Vu

Yep I came to make this exact point, it was in fact claimed by several people at windows 8 launch. What we'd be talking about is in fact the end of Windows as a general purpose computing platform and Microsoft wouldn't dare.

Don't know why people keep making this idiotic claim. Even Apple wouldn't do this for their desktop OS.

Cloud sellers who acted on Heartbleed sink when it comes to DROWN

streaky

Re: Not drowning here

And SSlv3. Long ago..

The starting position is DROWN shouldn't work because nobody uses < TLS 1.0 anyway.. Would inevitably raise questions about people affected and gross negligence.

Institute of Directors: Make broadband speeds 1000x faster than today's puny 2020 target

streaky

Re: London ... poor ranking compared to other capital cities."

Isn't London meant to be one of the few places in the UK that actually has something resembling a competitive telecoms market, what with the old ducts from London Hydraulic Power Co, and suppliers like Colt, etc?

Not for consumers no. We got Hyperoptic but they're only in like apartment complex type deals. Granted that is a lot of London but not really no otherwise - same, and worse, as the rest of the country frankly. If you want to buy it in bulk by the 40gbit then yeah it's cheap though.

Who hit you, HP Inc? 'Windows 10! It's all Windows 10's fault'

streaky
FAIL

Oh hey look..

HP are blaming somebody else for their poor performance again. That's new, no wait..

'I bet Russian hackers weren't expecting their target to suck so epically hard as this'

streaky

I prefer not to even construct any SQL on a client if I can possibly do so. I find it much better to have only stored procedures as the visible interface of a database server, meaning no internal structures of the database are visible to the outside world

I'm usually happier when rdbms don't support stored procedures at all - not for nothing but what you're saying for most software is all sorts of doing it wrong for a list of reasons it'd take way too long to list.

Just to be clear nothing happening here is the fault of PHP. With only minimal competence the average 8 year old should be capable of writing code that's impossible to SQL inject. The end.

Patch ASAP: Tons of Linux apps can be hijacked by evil DNS servers, man-in-the-middle miscreants

streaky

Re: I'll bet...

Lintards hid behind the 'we are better than anyone'. Well, guess what when you have amateurs hacking at code, this is what you get.Reality finally strikes for Linux arrogance that it is free of the risks faced by more popular sw. The BS wagon must finally have overflowed on the FOSS we get to inspect the code therefor it is better nonsense.

Can't tell if srs but assuming you (AC suggests you might be) are you're not nearly as smart as you think you are for an extremely long list of reasons - not least you'll note it's Google who dug this one out. Just throwing that out there.

UK taxpayers should foot £2bn or more to adopt Snoopers' Charter, says Inquiry

streaky

Re: You know, I was thinking about this over the weekend ...

Ya, they're creating haystacks to look for needles in. Classic intel fkup in the making. The haystacks are full of things that look like needles that are actually sewing pins.

streaky

Re: Democracy

We live in a representative democracy so.. 2020? Slight issue - basically all he parties agree on essentially this issue because they're all equally clueless - not sure what the fix to that is.

Good news: this committee seems to essentially agree with the sensible arguments against on definitions/funding etc.

streaky

ICR

Does anyone here know what an 'Internet Connection Record' might be?

Give me unfettered access to any of the committee's connections and I'll happily produce what one might look like? :)

I have clue enough to know they're both deeply invasive and utterly useless to law enforcement/intelligence at the same time?

streaky

The public is going to pay for it either way - that being said it's going to cost much more than 2Bn quid (a laughable figure). Either they pay for it from taxes or the ISPs (etc) will pass on the costs.

And no kidding it's silly.

Net neutrality-lovin' Sweden mulls law to censor the internet

streaky

Re: Mummy's censoring me!

Gambling, end the regulation of it, is very much a sovereign matter for EU member states.

But we're not talking about regulation as banning or taxation, we're talking about regulation as a state monopoly - which is very much an EU matter.

If a French company wants in it could easily become an issue.

streaky

Re: Mummy's censoring me!

Gambling is pretty black and white: either a gambling outfit is recognised under that state monopoly, or it isn't and is therefore illegal to Swedish citizens. So it's well within the rights of the swedish government to try and limit the accessibility to such sites for their own citizens.

Assuming Sweden isn't an EU member state after all?

NASA, Dept of Defense, Commerce etc probed over use of backdoored Juniper kit

streaky

Re: Ferals spying on ferals

Most likely candidate seems to be GCHQ at the behest of the NSA but given the NSA own Cisco it is fair to assume it's the NSA.

The thing about back-dooring things and not telling anybody is people buy the gear, if the US govt has been pwned because of it they've only added to the hilarity.

RSA asks for plaintext Twitter passwords on conference reg page

streaky
FAIL

You got your password in my Oauth

You sure this isn't a signup for Black Hat or the CCCC or something? :p

No really though do people still trust RSA with literally anything?

Let's get GDS to build a public blockchain, UK.gov's top boffin says

streaky

Re: What problem does a blockchain solve in government?

What problem does a blockchain solve in government?

It solves the problem of IT budget justification when you're a shareholder in or on the board of some IT megacorp with nothing much to do.

That's the least cynical way I can put it.

Bunch of clowns who don't know what they're talking about paying a lot of taxpayer funds to build things they don't understand. What could possibly go wrong?

Nothing in the document makes any sense which is a fairly good clue they don't understand what they're talking about. They really did out-Dilbert Dilbert.

Tell us what's wrong with the DMCA, says US Copyright office

streaky

That's not really an issue with the DMCA itself, powerful country with many large internet companies having physical operations there it'll always be true no matter what the law actually says. The US is going to have copyright law and it'll always leak no matter how it's written.

Who will buy our darn DRAM? Micron smacked in wallet again

streaky

Re: Simply amazing...

These sectors tend to be driven wherever analysts say they'll go. It only takes one thing. It's happened with tablets - they said this and they did this and they said that and they did that.

There's stuff coming to drive consumer PC sales - the problem is corporate sales have sort of lost the need for more power because PCs do whatever most office workers need. Always room for server sales though - if anything server sales will replace corporate PC sales to a certain extent.

China wants encryption cracked on demand because ... er, terrorism

streaky

Dumb..

The war on personal and business security and privacy is a great big pile of it - but can we stop conflating crypto issues with Iraq and/or Libya and pretending they're somehow related to each other?

Saying "I'm a pacifist" isn't how we solve any of this.

CIOs, what does your nightmare before Christmas look like?

streaky

Re: Brick Lane

I take it back apparently Easynet aka Interoute have a DC on Brick Lane - I always thought it was just offices but apparently I was mistaken, guess it's not Interxion but those guys after all - my comment about Chatham House rules still applies though :)

streaky

Brick Lane

This got ugly when a big ISP’s Brick Lane centre

There aint no DCs on Brick Lane, just one extremely close and it services the Finance industry and others.

Chatham House rules well out the window on this one :)

Cisco probes self for Juniper-style backdoors, silently mouths: 'We're doing this for yooou'

streaky

Pentests

hiring penetration testers

How is it possible Cisco don't have a permanent red team anyway? If I ran a tech business the size of Cisco with their budget it'd be day one job: put together a red team that operates completely independently of the rest of the org that reports outside the normal chain of command, sees the source but can't modify it.

streaky
Black Helicopters

Well that's cynical..

UK says wider National Insurance number use no longer a no-no

streaky

Re: The US..

the tax office claimed that he'd spent at least five years in Wales claiming benefits based on his NI records

Takes a fair bit of ID to claim benefits, I'd imagine there's more to this story - not that they'd tell the person due to the "privacy" of the person who was actually claiming.

The DWP rules on claimants are fairly clear about this sort of thing though.

streaky

Re: The US..

The NiNo can be used in ID fraud here too and should be protected

Government isn't going to accept you are you based on supplying them with your NINo. If somebody wants to pay my income tax/NI for me they're quite welcome to.

All this stuff is circular and precisely why it shouldn't be otherwise used.

streaky

The US..

.. is a case study in what not to do with such identifiers. People over there seem to protect it with their lives, because it's used to identify them and used in identity fraud against them. That situation is unhealthy and it should be resisted - there's no genuine reason for non-governmental providers of services to use or reference the NINo.

Suspect there'll be pretty big backlash against wider use of it in the UK.

Security industry too busy improving security to do security right

streaky

Re: Too Hard?

Though with contactless you can have your cards cancelled and the crooks can still buy stuff because some POS terminals don't actually check in with the bank before authorising transactions. Cards don't keep your money safer, they just make it easier to track.

But the liability shifts back so who cares. It's a cheaper system to operate even with those losses.

streaky

Re: Too Hard?

They typically run on razor-thin margins which is why they're notorious for cheaping out and delaying things out of necessity, yet without them the only retailers left would be the juggernauts. So what'll it be? Slow-to-act but personal attention or the cold, emotionless juggernauts?

I'm not sure that there's a good answer to this question, but I know that taking the hammer to people's security with known broken protocols isn't the solution.

But to be honest it appears that PCI SSC's problem is consumer browser related and that being the case there's no excuse here.

Help! What does 'personal conduct unrelated to operations or financials' mean?

streaky

Re: er ..... what poll ?

This one *is* related to operations..