Posts by PyLETS

Re: As so many others have said

"Personally I'm dreading the inevitable surge in Pwned boxes which were previously unreachable behind NAT shields and will become directly reachable."

More likely to happen for gung ho hobbyists tunneling through their own IP4 only router than ISP provided IP6 or dual stack routers or firmware upgrades. ISPs need to be careful to install default IP6 firewalls which require the user to configure a port forward for an internal server on IP6 also.

Re: Organisational infighting ?

"So you can argue that ISPs are profiting from piracy because it encourages customers to take a fatter pipe which costs more ..."

Hence music adds value to the Net and deserves a sales commission in exchange for helping sell more bandwidth. But only in exchange for legitimised use, not for the situation where Net users are threatened with monitoring, privacy invasions and disconnection with music getting a cut regardless. If the music biz don't want a cut on those terms we'll probably have to fight it to the ECJ based on ECHR section 8 (right to privacy of communications), but giving them a cut for capacity they help sell could solve their problem more quickly and easily. Given there are bigger human rights fish to fry than the Mandelson bill in relation to privacy and open communication rights in general, it's better for those who give a damn about such rights to avoid wasting effort on an inherently more easily solveable problem.

Re: 20 meg malware "threat" in the field for 2 years, undetected.

"Does nobody actually understand system security anymore?"

Those who understand security execute only trusted executables and use software distribution and installation systems involving cryptographic chains of trust identifying all the engineers who have signed all executables installed as checked and verified. On larger general purpose systems we have to take calculated risks, of the kind: "has the team engineering this closed source component of my otherwise opensource system used as a device driver or media player been nobbled, or is there a zero day in this or some other component known to someone who wants to attack this system but not the engineer who signed it ?". On smaller security-purposed systems we have to ask the same questions but have a better chance of answering them. We keep these differently purposed systems sandboxed from each other.

I don't think anyone who genuinely understands systems security has been highly reliant on popular software used for scanning and detection of blacklisted executables for many years. If blacklisted or not yet blacklisted executables can be installed onto your system and executed, you either don't yet properly understand, or don't yet really care about security.

@KingZongo Re: Here's what I never understood

'getting outbound http or dns requires you to go through particular servers, and the bofhs watch those like hawks looking for deviations from the norm. "Hmm, 200 queries for 432rewfds.weirdo.com today. Sounds fishy."

What am I missing?'

You're overestimating the budget such places spend on BOFHs. Watching network packets is as boring as watching CCTV cameras, and both activities tend to have sleep inducing effects upon those so tasked.

Those who want to spend good money on securing highly sensitive computing environments are more likely to employ techniques such as Ranum's ultimate firewall than an army of BOFH's inspecting network packets.

Re: Why is the Register so pro-IP?

In the words of Mandy Rice Davies when giving evidence, Well, they would, wouldn't they ?. As to whether the Reg is driven first by techie or media interests, figuring that one out appears not to constitute rocket science.

Re: WTF?

Ten years ago no politician was willing to stand up to media barons who treated the law with impunity and got whatever they wanted by threatening them with the kind of harassment and negative spin only the media could organise. With newspaper sales plummeting politicians no longer need the blessing of these crooks to communicate with the public. You can imagine the IPO going along with the consensus amongst the politicians that the likes of Robert Maxwell, Conrad Black and Rupert Murdoch got whatever they wanted 10 years ago.

Levenson and the successful Internet campaign against SOPA and PIPA has changed everything. These bastards are getting their comeuppance, and not a moment too soon.

Re: So

"Then you get arrested, data downloaded, job done."

Not if you use decent password protected encryption on your phone. I suspect mobe data entry isn't good enough for very strong passwords yet, though having a strong key on QR code ricepaper which you eat when approached by plod might work better. Assuming the tech gets developed to do this as well on phones as you can on laptops, plod then makes a RIPA request for a copy of your password or key and you go to jail if you can't provide it or convince a court you've forgotten it.

That's evil, due to the RIPA passed by nulab in 9/11 control freak mode obliging the defendant to help the prosecution construct their case under threat of pain of imprisonment. Which is like the use of torture for prosecution evidence collection, and ignoring innocent until proven guilty, and denial of what used to be your right to remain silent.

Re: The problem is...

'They see each possible "copy" of a song as a "lost sale".'

The simple refutation of the argument that any copy is a lost sale concerns the difference between what an artist gets for one person listening/recording one song over the radio, or the same song as part of a CD. The artist has rights in respect of both plays (also primarily over the businesses involved), but the prices are not the same. The share they get concerning a radio play will end up as a tiny fraction of the due share which relevant law decides the financing of a radio station ought to include for rights holders fees.

Not all sales are equally valuable to the artist, nor should they be. You'll get people on the same train journey or flight paying wildly different ticket prices, and if it were not so, both the revenue to operators and utility to travellers would decrease.

Re: Australia STILL does not have DNSSEC !

Having a signed TLD is obviously a starting point. Next you need domain registrars which support DNSSEC at little or no extra cost, if many server admins are going to go through the pain of learning about it, adopting it and then maintaining it. And that's before any clients can use it.

The fact server operators have to adopt DNSSEC before clients can use it, and most server operators probably won't until clients can use it creates a catch 22. Sometimes these are overcome, when the old infrastructure gets overstretched and starts to fail. The fact you can't get IPV4 address allocations in Asia/APNIC other than very small ones for very large networks and this is causing service deterioration is now driving IPV6 uptake 15 years after the standards were stabilised. Europe/RIPE will go into similar IPV4 address depletion mode in a few months at current allocation rates.

So I suspect insecure DNS will have to get a fair bit worse than it currently is before many people adopt DNSSEC, though some early adopters might need DNSSEC before then for particular applications, e.g. banks distributing embedded payment client software with its own DNSSEC client implementation.

Re: @jake Absolute, the expression "grinding hard labour" does not even begin to cover it.

"With the world's population as it is we should be using our arable land in the most efficient way possible. You say yourself option E is more efficient than option D. So why aren't you advocating it?"

Because we don't need it and can't sustain it.

The world population is probably less than 10% of what it would have to become for us to need to use system E to feed everyone using a vegetarian diet, and it will almost certainly max out at less than 25% of that. Much of Africa is still subsistence farming, with outputs per hectare close to what was being produced in Europe 200 years ago: no use of field boundaries, no electricity, they've only just started using basic machinery, with barely no water management and no use of groundwater. But enough Africans are getting basic schooling and have mobile phones now and there's just no reason for many of them to stay where they are, given efforts being made in literacy and education.

It might transform your thinking for you to spend 6 minutes learning from the experience of William Kamkwamba from Malawi

So I expect agricultural output of Africa (measured as vegetable calories) to more than quadruple when the population doubles there over the next 30 years as they industrialise. Population growth everywhere else is close to topping out, as people are getting educated and rich enough in Asia, Eastern Europe and South and Central America now to have smaller families as in North America and Europe. I expect Africa to follow suit 20 - 30 years behind Asia and South America, where few now go hungry compared to 30 years ago.

If you don't believe me visit Brazil sometime and compare what you experience with reports from 30 years ago. One of my best mates has just come back from visiting a training project there where his son is working.

Re: With the BSA on your team...

"Anyone who uses software they haven't paid for should face hefty consequences," said Julian Swan of BSA EMEA compliance marketing."

He seems to imagine his organisation owns all free software too and has a right to charge for it.

Talk about deluded.

@M Gale

Scientific enquiry in the modern sense was more likely to arise from monotheistic belief in a universe governed by God through laws of nature, than from polytheistic or atheistic belief in an essentially chaotic and capricious universe. The history of Islamic and western science seems to support this thesis. There just doesn't seem to be that much point trying to discover laws of nature unless you start out by believing nature to be governed by laws. By the time of the enlightenment, the existence of laws of nature had started to appear irrefutable, and scientists then started believing many different and incompatible things apart from agreeing on the existence of natural laws.

Re: @h4rm0ny cult of celebrity

Why should everyone on the same train or flight as me have to pay the same price for a ticket ? Does it really hurt if some people take a bus and some people cycle to get between the same (A,B) pair ? Even on the same train or bus, single price ticketing doesn't work, it would so greatly diminish operator revenues and service utility that many transport services would cease to be viable. There have always been and always will be some people paying more for the same music than others and some paying nothing. If you hear a song on the radio or played in a public place do you have to pay for it directly ? No, but the chances are that someone else pays for it to be played. That's how our cultural and economic world works and we may as well get used to it.

When copyright law first came into being it was expressed as a deal in order to benefit the future public domain. But your blinkered and menial argument that everyone must be expected to pay the same price to experience particular art, (that every horse must be put in harness and have its sights restricted to pull the same share of the load), recognises no moral concept of later public domain benefit - which might give the voting public reason to want to allow this particular monopoly to be legally established in the first place. Is the wonderful excitement of those fans who will pay top price to see the live performances, the first public showings, the most limited autographed merchandise to prevent those less enthusiastic from experiencing something a little less, or must the enthusiasm of the fan club be artificially dampened so all pay the same price ? Again this would square neither with reality nor anyone's interests.

It's true as you say that the weak and ineffective DRM on DVDs won't suppress their preservation. But being able to see something legally which is in the digital limbo equivalent to being "out of print" can become another matter. More highly developed and much harder to break DRM systems coming along in various formats are much more likely to have this undesirable effect. I'm not opposed to the right of developers to develop and sell these systems, but it is a terrible idea to suppress discussion of how the constraints imposed by such systems can be overcome. It would be outrageous if the only copies of some documentary series which survive in future are low resolution flickering cam recordings taken at risk of extradition and jail by enthusiasts exploiting the analogue hole. If too many of these heroes of widening cultural access are locked up for long, who will be willing to take the risk of preserving locked down content in future ?

Clearing the rights to documentaries legally to be reshown can become extremely difficult and expensive as the Eyes on the Prize history demonstrates:

"Therefore, in the spirit of the Southern Freedom Movement, we who once defied the laws and customs that denied people of color their human rights and dignity, we whose faces are seen in "Eyes on the Prize," we who helped produce it, tonight defy the media giants who have buried our story in their vaults by publicly sharing episodes of this forbidden knowledge with all who wish to see it."

The problem with long copyrights here is that makers of historical documentaries tend to have to purchase time-limited rights for reuse of content owned by hundreds or thousands of rights holders for budgetary reasons. Programme makers have to focus on short term viability for a project to succeed prior to their likely financial bankruptcy. Perhaps one in 20 such documentaries might later attract concerted enough fundraising campaigns needed to clear rights for future public showings as occurred for the above iconic series, but the rest, which can't attract the same intensity of common purpose, will only be available illegally through file sharing for perhaps a century or more before these works suppressed by the massive transaction costs involved in rights clearance can legally be reshown.

It's true that copyright law has been around for a couple of hundred years. It wasn't contentious while its effects limited the actions only of a few owners and operators of industrial scale copying machinery. That is still a very recent development compared to the understanding of right and wrong which derives from a deep and honest study of the Bible. But the digitisation of mainstream culture is a very recent and different phenomenon, and it's becoming increasingly clear that the many hamfisted and control-freakish attempts we've seen by copyright beneficiaries to extend old concepts of copyright into this new domain do not meet our wider cultural needs. Some property relations are ancient and natural, others are constructs of law. If I were to take away a man's coat this is morally of the first sort. If I sing a song I heard from someone else you haven't convinced me the second sort fits the same moral category. So where to draw this line ? - If our wider cultural needs are not met by what is offered in return by the carpetbaggers who would extend the first category into the second, then we must reject their phony claims to moral authority and start making our own minds up.

Browser versus OS security

I think Firefox on Linux is likely to suffer the same vulnerabilities as Firefox on Windows if configured the same. Some malware attacks which rely on zero day sandbox failures and the native execution environment being Windows compatible won't get through probably because the attackers are less likely to try to install Linux executables. I remember once seeing what to me was obviously a fake virus scan running in Javascript on my browser telling me my C: drive was infected, which was a bit silly cause I was using Linux at the time which doesn't have a C: drive. Someone less knowledgeable on Linux could still have been taken in and reached for the credit card - as that one was clearly designed to infect wetware and not software - Firefox and Javascript were just doing what they were designed to do in this case. The same set of vulnerabilities on Linux as on Windows applies to most CSRF and XSS based attacks, simply because the attacker doesn't need to go outside the browser Javascript sandbox for these to work. In these cases the vulnerability is likely to relate to the design of a website, but the victim can still be a web client.

Re: Action against GeoIP

Use IPV6. The minimum allocation is a /64 where you get 2**64 addresses. You can then sell the 2**64 - 256 or so you don't need, so long as you can route the traffic to the ones you sell. There will be so many people doing this that big media won't be able to keep track of who is doing it any more and it will be cheap as chips.

Not just The curse of the rootkit

Also how they tried to screw George Hotz over, for helping their customers find new and innovative ways of using their products.

Sony's problem is they are a schizophrenic company, with the media/content side of the biz determined to make customer copying and innovation difficult, having dominated the consumer electronics side of the biz which needs to make these things easier.

Best for the shareholders for these 2 sides to agree an amicable divorce and go their separate ways. They are on 2 sides of a wider culture war much too big for Sony to solve.

@Miek

"I'm not sure why people keep going on about SSL, it is completely readable when you have intercepted the entire communication from it's initiation."

If you do know how to break current SSL implementations, then please publish your reproducible attack method in full. Your publications and conference keynotes would then be worth a considerable amount of dosh. I'm also not including manipulating the CA system to get a false signed cert which we all know is doable but expensive to the CA that gets caught doing this, see Diginotar.

Re: Ignoring VPNs & proxies .......

Easy enough today to hire use of a virtual server which you can configure as your own VPN endpoint in your preferred location. Your ISP, in terms of your visibility to those you contact, becomes the ISP which hosts your server. You will still need a contract with an ISP which delivers bits to and from your home address, but all they need see is an encrypted tunnel.

Re: Moving Beyond Copyright

Most electronics exist to copy information from one place to another, or from one format to another. The Net does the same with packets. Computer architecture is a hierarchy of copying data between large slow storage to small fast registers before data can be processed and is then copied back down again into large slow storage.

None of these facts seem compatible with the 18th century concepts behind copyright law which presume that printing presses are few, expensive and easily regulated, and this certainly doesn't seem to suit the vested interests now hiding behind this law-created monopoly.

Charging for content without annoying their customers

They don't seem to have too much trouble getting money from radio broadcasters, and public and commercial spaces where music is played, by going after the business beneficiary of the music not the listeners. Radio tends to be advertising or donation or license fee driven. Make transmission of music legal over the net to ISPs which pay a commission. Not exactly rocket science.

Re: any other accelerator built by humanity

Like the one in which they designed the experiment which went wrong and resulted in the big bang ?

Re: sure

Similar things happen if you grow trees. Wind energy gets locally disturbed and absorbed generating heat through friction, solar energy gets stored as wood suitable for transport elsewhere. This activity can improve or reduce growing conditions, depending upon whether your tree planting is deciduous or coniferous, how densely you grow trees, whether local flora is highly light dependent, or could use some shading and wind sheltering. In practice if you had any rational objection to wind farms for these localised reasons you'd have to be opposed to anyone growing trees for similarly localised reasons.

Re: Pretty strange Ubuntu hasn't been more successful

Linux on the desktop being successful depends upon your definition of success. If your definition requires most desktop PCs to use it, then it isn't. On my definition, as a software educator and developer I can get more work done using Linux, then it is. Since when should everyone use the same tools ?

@Stuart Castle: Sources of Murdoch's power

In addition to the sources you stated, I don't remember Murdoch admitting to interfering with any newspaper's editorial policy until yesterday: http://www.itv.com/news/2012-04-25/murdochs-testimony-to-the-leveson-inquiry/ when he "Admitted editorial interference in The Sun, but not other newspapers".

He still denies interfering with editorial policy at The Times. Well he would wouldn't he, but he still hires and fires the editors. And I guess more voters still read the Sun anyway.

The fact remains that old school politicians have never liked starting arguments with those who buy ink by the barrelload. It wouldn't help them win votes. Maybe its the fact that fewer papers are sold each year that has resulted in Murdoch giving evidence for his organisation's criminality now, which is more than Maxwell ever did for stealing his employees pensions.

@JDX - Good law doesn't bring the law into disrepute

"So if enough people want to do something, it should simply be legalised? "

Um yes. It will be anyway once enough people vote to legalise it. The purpose of the criminal justice system in a democracy isn't to suit the interests or prejudices of a minority at the cost of criminalising the majority. Whenever that happens absolute idiocy results.

And it's not as if this is the first time such idiocy has been tried and failed, e.g. as with prohibition of alcohol in the US. For this reason it was eventually made legal to tape radio and TV programmes in the UK, and to have a radio without a license in more enlightened times than these. There's no law as bad as laws which everyone treats as too contemptible to care less about.

faked based on whose definition ?

People who create audiovisual content fake things all the time and it's called acting.

The murder scene in Macbeth isn't faking the concept of murder if murders happen. If you live on a farm which has its drinking water supply poisoned with carcinogens as well as methane, you don't really want your customers to know that, so you'll have actors recreate the scene in order to tell your true story.