* Posts by Adam 1

2545 publicly visible posts • joined 7 May 2012

98.1 million CLEARTEXT passwords pasted as Rambler.ru rumbled

Adam 1

Re: Perhaps?

@lee

Not necessarily. The passwords may have been encrypted but their private key may have also been stolen. That's one of the many reasons that you want salted hashes, not encryption for password storage

Adam 1

It is their version of Yahoo! 171 users sounds about right then.

Sysadmins: Poor capacity planning is not our fault

Adam 1

Re: But....

> Oh and to Java devs everywhere, writing everything including the kitchen sink to Log4J output files in not the answer to reliable systems

Log4xyz is a good thing™. Certainly beats the hell out of something went wrong somewhere and we have no logs or some half arsed attempt to write to a text file using code lifted from stack overflow which isn't threadsafe, isn't buffered and works by loading the whole file into memory, appending a line then rewriting the file. Oh and by a file, I mean hundreds of files in various folders with no cleanup mechanism.

Other than sensible defaults, it's usually not a developer's role to configure log4xyz (internal or custom software where you have full understanding of the deployment environment may be the obvious exception). That is why you can change the verbosity of the messages in a config file. It is why you can choose your own appender. If you use a rolling file appender then you can specify things like maximum size, number of files to keep and so on. Then it is just a discussion with business about how much storage they want to pay for vs the point where files get deleted. That's their decision, not yours, not devs. Your job is to make sure you explain the consequences of whatever set of numbers get thrown at you.

The other side of the coin is ensuring that the I/O can handle the volume you throw at it. If you have your loglevel set to debug on a multi threaded stack, it may not be adequate to dump log files to some slow HDD.

Wait, you made me defend Java you sneaky bastard. Is that the new Rick roll?

Telstra wins AU$39 million for data retention costs as grants revealed

Adam 1

makes no sense

If the government really want ISPs to do this, they should do one of two things.

1. Cover the entire cost out of general revenue; or

2. Permit ISPs to charge a specific data retention fee to their customers every month.

The *last* thing you want is for ISPs to try to monetise that datastore in some way to recover costs.

Australia's mobile black spot program was a partisan money hole

Adam 1

the $220 million question

Why wasn't there suitable eligibility criteria for the program?

Good job, Oz feds: Conroy wants you investigated for privilege and contempt

Adam 1

"For most practical purposes, Parliament House is regarded as the only place of its kind and one in which the two Houses through their Presiding Officers have exclusive jurisdiction. Thus in Parliament House the police are subject to the authority of the Speaker and President and their powers are limited by the powers and privileges of the respective Houses. Such limitations are not based on any presumed sanctity attached to the building as such, but on the principle that the Parliament should be able to conduct its business without interference or pressure from any outside source"

- Advice of Attorney-General‘s Department, concerning powers of police within the precincts of Parliament House, 1967. And see Parliamentary Precincts Act 1988.

Whatever one thinks of the man with the red underpants on peoples' heads fettish, the AFP would be well advised to tread very carefully. These rules are deliberately designed to constrain the power of the police to interfere with the operation of the house.

FBI: Look out – hackers are breaking into US election board systems

Adam 1

Re: How silly

So they got the ability to run arbitrary SQL but decided to only run Select statements. Yeah, the other one plays jingle bells.

Adam 1

Re: XKCD from the past

So true. Norton antivirus would be so much worse.

Fifty bills for new Oz parliament, nothing much for tech

Adam 1

Re: The horses mouth?

Do you mean this Alastair MacGibbon?

Don't worry though. We can Shirley keep your census data safe.

Chinese CA hands guy base certificates for GitHub, Florida uni

Adam 1

Done. Thanks

Adam 1

Removal instructions for Wosign CA please. Android + Windows

Asserting ownership of a given CN is the one and only job of a CA. If they can't do that properly, their public keys are of no use to me.

'Fake CEO' Chinese chap cuffed in $54m fraud probe

Adam 1

>fter someone impersonating the CEO in an email had authorized the transfer of funds. The CEO and CFO have since been fired.

So they fired the fake CEO? Or was it the fake investigation team that reported back to the fake board that caused the fake HR to sign the no doubt golden parachute cheque*? OK Neo, the blue pill....

*Just because you can't spell authorised doesn't mean I have to misspell cheque.

Tech fails miserably in Forbes' most innovative companies

Adam 1

So why is Amazon on the list? Have they ever made a profit?

MIT brainiacs triple the speed, double the range of Wi-Fi

Adam 1

Re: "consumers won't have to buy new hardware"

Yes. As long as you can mount your laptop on the moggie, this should work fine. Unfortunately, you still need a Roomba on which you can mount the moggie, so it is really turtles all the way down.

Microsoft's HoloLens secret sauce: A 28nm customized 24-core DSP engine built by TSMC

Adam 1

Re: Microsoft as a hardware company

Mice...

And probably best not to be talking about webcams at the minute.

Honor 8: Huawei targets millennials with high-spec cheapie. 3 words – Food pic mode

Adam 1

Re: Wow

Looking at a Nexus 5 as I type this. 1080p isn't that terrible.

Chocolate Factory exudes Nougat as Android 7 begins rollout

Adam 1

> Sadly, the Nexus 5 and Nexus 7 fondleslabs won't be invited to the Nougat party.

Boo!

Australia Post says use blockchain for voting. Expert: you're kidding

Adam 1

Re: Australia Post's search for relevance ...

> (and what's wrong with the SMTP/POP/IMAP Internet mail service, I'd like to know)

Plenty, but nothing that I believe auspost has the answers to.

On a side note, lots of e-commerce relies on physical package handling to some degree. Why they can't leverage their natural monopoly to turn a pretty penny there shows a real lack of imagination.

Google killing app format used only by The 1%

Adam 1

Re: well that's annoying

Don't mind draw.io. it does have an XML format so it can be versioned but it's more definitions of points etc. This one had a simple syntax that worked nicely with diff tools and was much quicker to create a simple diagram in it than draw.io.

Adam 1

well that's annoying

Don't use them much but there is a handy little tool for drawing sequence diagrams and the like which relies on it that I'll miss.

Microsoft can't tell North from South on Bing Maps

Adam 1

Re: Victorian Numberplates

The other ones have the humourous tag line "the place to be". Clearly a sentiment that wasn't shared by the drivers of the said vehicles who were elsewhere.

Password strength meters promote piss-poor paswords

Adam 1

Re: saggfwuepp53hlq%4k12h

Well your auth cookie is sent in clear text every time you login here because apparently TLS is too much effort or something.

Adam 1

Re: Passwords need to be rethought

If you think password length is related to the required storage space, you're storing it wrong.

Scared of mobile banking

Adam 1

> Three out of four of these refuseniks (74 per cent) cited security as the major reason.

Well they are fundamentally correct on that. 2FA is useless if the SMS code for funds transfer is going to the same device.

Baltimore cops accused of violating FCC rules with Stingrays

Adam 1

naïve me

And here I was imagining these devices basically did a MitM attack, forwarding the traffic to a legitimate tower so as not to inconvenience anyone beyond the privacy implications.

VeraCrypt security audit: Four PGP-encoded emails VANISH

Adam 1

Re: One time pad

> it's illegal (in the UK) to send encrypted communications over the airwaves

Is it legal to broadcast the results of a long running game of heads or tails? Enquiring minds and all that.

Farewell Patch Tuesday fragmentation: from October, MS will roll just one monthly patch

Adam 1

It's lucky that Microsoft never release patches that you don't want installed I guess.

Bees bring down US stealth fighter

Adam 1

Re: "eight pounds, or in modern numbers, 3.6 kilos."

> what's that in proper units

About 20 KiloBees

Adam 1

Absolutely. Bee related puns are encouraged. You win one internet. Unfortunately, you immediately lost it after failing to use an apostrophe to indicate a contraction. Such behaviour must not go unpunished or society may tear itself apart at the seams.

Adam 1

> she landed on the F-22 to rest

She was hanging around for the F-35 JSF but exhaustion set in due to another overrun.

US extradition of Silk Road suspect OK'd by Irish judge

Adam 1

wouldn't it have been easier...

to get Microsoft Ireland to hire the guy? Then they could just get a warrant from a US court.

Meet DDoSCoin, the cryptocurrency that pays when you p0wn

Adam 1

Leaving aside the more, er, questionable elements of this proposal, wouldn't the effort to validate that block chain exceed the ddos itself?

IBM makes meek apology for Oz #CensusFail, offers no fail detail

Adam 1

Re: Warning: Aussie census goon squad coming soon!

"International visitors

If you are visiting Australia on Census night, you are required to participate. Your accommodation provider will give you a form or details of how to complete the Census online."

- http://www.abs.gov.au/websitedbs/censushome.nsf/home/getonlinefaqcensus?opendocument&navpos=110

#Censusfail Australia: Not an attack, data safe, no heads to roll

Adam 1

Re: International...

True but not his IP address. Heck, you could identify me by my postcode combined with my employer's name.

Australia's online Census collapses, international hackers blamed

Adam 1

Re: Geoblock non aussie IP addresses?

They did. No doubt a good first step but it isn't that hard to circumvent. You're really just playing whack a mole.

"Earlier attempts to frustrate the website led the ABS to block all international traffic at about midday on Tuesday until midnight. But that geo-blocking mechanism ultimately failed, government cyber security adviser Alastair MacGibbon said."

http://www.smh.com.au/federal-politics/political-news/malcolm-turnbull-defends-handling-of-census-as-privacy-commissioner-investigates-20160810-gqp45u.html

Adam 1

the other one plays jungle bells ...

I have not seen any independent evidence that they were ddos'd. By now I would have expected anonymous to come out chanting something something legion something or other. All the media reports that I have seen this morning are sourced from abs alone who after a trail of fail have a lot of self interest to hide. Keep drilling. We haven't heard the last on this.

Scale is hard; really hard. A few small assumption errors can give order of magnitude load increase. A small config file error can cause load balancers to do the wrong thing even if you have provisioned the hardware on standby (just ask aws). A small query plan error can cause additional terabytes of ram to be allocated during sign in (just ask Microsoft).

Oh, and given IBM's track record in handling government IT services, it's not that you wouldn't trust them to organise the proverbial in a brewery, you wouldn't even trust them with the RSVPs to the said event.

Australian national census fails in the IBM cloud

Adam 1

Re: IBM, i shoulda known.

If El Reg couldn't see this coming then I would be changing news outlets. Blind Freddy could see that provisioning for a million people per hour isn't enough when most families will get home from work, eat dinner, kids in bed then log in. The saddest part is that because they make names compulsory, the results will be less than honest, negatively impacting public policy decisions for the next 5 years.

Classic Shell hackers: We infected FossHub so ransomware couldn't (and yeah, also for fun)

Adam 1

Rickroll homepage; black hat respect and kudos. This; you are a tool*

*My sincerest apologies to the tool community for bundling these guys with you.

Render crashing PCs back to their component silicon: They deserve it

Adam 1

Re: You forgot printers

> What is printer ink?

Unicorn tears.

The developer died 14 years ago, here's a print out of his source code

Adam 1

Re: "Lightening"

>> "Lightning is weird, but calling it lightening is more weird."

> It is also not very bright.

Actually I would say that lightening is quite a bright way to spell it.

Adam 1

Re: Portrayal of computer tech guys in films/tv.

> Have you tried turning it off and on again

Possibly the best researched piece of tech portrail we have seen in years. Pretty much every techo has at some point heard that line from a telephone *ahem* support attendant only moments after telling them how you have just reimaged the drive.

How the HTTPS-snooping, email addy and SSN-raiding HEIST JavaScript code works

Adam 1

I imagine this can be mitigated if the website specifies a CSP. That would even allow you to report on malvertising campaigns attacking your site as supported browsers report the violations.

If your not a website developer, you're stuffed because ad blockers and noscript doesn't exist.

Adam 1

Awesome name: check

Logo: no. Wait, how can I take a HTTPS big seriously if it doesn't have a logo!

Londoner jailed after refusing to unlock his mobile phones

Adam 1

Re: That last para-sentence

The linked article mentions a hearing date in the past week or so. Would be interesting to have an update to that case.

Adam 1

Re: How long for theft?

Truecrypt used to have a plausible deniability feature whereby a secondary pass code would unlock a second volume. The actual volume would not be detectable from within this volume.

Seems like something similar for android/iPhone is needed.

Adam 1

Shirley you are not suggesting an element of click bait....

First Wi-Fi box ever is chosen as Australia's best contribution to global history

Adam 1

Re: Bravo!

If the rest of the world knew the sorts of 8 legged things living in our roof cavities or under the house then they would understand why we don't want to run cables.

The Australian Bureau of Statistics has made a hash of the census

Adam 1

Re: hash no good

Half an hour? Does that include unboxing the computer and plugging it in?

Relatively modest PCs can hash at "many billions per second" rates. Specifically designed hardware for bitcoin mining is measured in "many tens of billions per second".

Adam 1

Re: Hashing won't work. Anonymizing data is impossible.

As an example of this, combining date of birth with gender and suburb gets you an average 90% match to one person.

Adam 1

Re: I can't wait.

Maybe you can enter your surname as

'); DROP TABLE residentdetails;--