Posts by Adam 1 2545 publicly visible posts • joined 7 May 2012
Just a heads up that if our government actually troubles itself to sit for more than a week in the next 6 months, they are trying to pass laws that will force Australian vendors to break encryption in their products if they are directed to by the government of the day through their law enforcement arms. Pretty much the same thing everyone is hung up about Huawei on. So be careful when sourcing Aussie kit.
> even though they need an external trim function written by someone else
Whilst I take your broader point, trim is exactly the sort of function that makes sense as a framework provided function. If you think it's trivial, then I'd chance that you really haven't understood its problem domain and what it counts as a character and what doesn't (and expectations in right to left languages) once you step outside the safe world of ANSI. And to implement it efficiently requires a good understanding of how your framework and runtime implement strings.
Web of Trust, you mean that plugin that was caught with its fingers in the cookie jar a few years back? Maybe not.
Also, I wouldn't be so quick to assume that the new maintainer had a clue that this malware had been introduced. It is of course possible that s/he was in cahoots with the other account, but with the way that NPM works, half the web can break because some random Dev throws their toys out of the cot. Leaving asides the question as to whether his actions were justified, it showed that thousands (and that isa generously small number) of projects find themselves with unrealised dependencies.
This is both the greatest strength and Achilles heel of npm.
* Hey guys, remember when cameras only had a dozen sensors? A dozen sensors!? Luxury! We used to dream of a dozen sensors ... (Four Yorkshire Men memes will still be funny)
* These 4 MegaSensor claims are really misleading. If it was really 4MS, it would have 4,194,304 sensors, not 4,000,000. We're being ripped off here by nearly 200,000 sensors.
Shirley it would be
Select distinct c.*
From Company victim
Inner join Company oldvictim
On victim.CategoryId=oldvictim.Category and victim.Id<>oldvictim.Id
Inner join CandidateHistory ch
On ch.CompanyId=oldvictim.Id
Inner join Candidate c
On c.id=ch.CandidateId
Where victim.Name='FooCorp'
And (c.LastPlacementDate>DateAdd(Month, -6, GETDATE()) or c.LastPlacementDate is null)
Re: percussive maintenance
A large number of years ago, our former office space was turned into an unworkable wall of noise due to an alarm in the neighbouring suite. It was triggered by who knows what, blasted for 15 minutes, then turned off .... for maybe 5 before repeating the process.
After the fourth or fifth cycle of this, and with no tenant in sight for the adjacent suite, a former colleague pushed his chair away from the desk with resolve, stood up, grabbed a screwdriver of the workbench and disappeared into the service corridor. He must have found the tenant because the alarm went quiet a minute or two later. And the tenant must have got that issue fixed because I don't recall it happening again after that. I can imagine no other method by which the peace we experienced after that time could have occurred.
> In a rare public speech, ASD boss Mike Burgess said “a potential threat anywhere in the network is a threat to the whole network”. It's “paramount” that Australia gets critical infrastructure security right, he said.
Entirely agree. We should make sure that anywhere that we source key infrastructure hasn't legislated that their companies build in backdoors into the security layers of their products.
I'm going to disagree with you on that. There is nothing fundamentally wrong with agile development. It does not permit untested work. TDD (which if you're doing agile correctly is kinda mandatory) means that you should have your tests written before you start copy pasting from stackoverflowwriting code. If you are doing things properly, you are getting input from QA before you design the tests in the first place. It was never about removing QA from the process. Everything about it is to remove the distance between the subject matter expert and the code monkey so that misunderstandings can be discovered and rectified much sooner.
Of course, you are probably thinking about that other definition of agile favoured by PHBs the world over, where any form of analysis is disregarded because agile, any form of planning ahead can be forgotten because agile, and any form of QA can be ignored because we once showed the devs how to install nunit. That is of course bollocks.
Quality is derived from culture. You need a culture that is ashamed of breaking things, ashamed when their test case design fails to detect a breaking change, is proud about coverage (real, not by fooling the tools), hates when something slips through to QA and really hates when a customer suffers a bug.
Companies that only value story point velocity, that don't invest in reducing technical debt inevitably find themselves producing code which is a quick hack around some work around ona half designed proof of concept which resists even basic enhancements, which then hurts the velocity, so no time for paying back that technical debt and the QA cycle needs to be cut to make deadline. Sigh, I guess some people cannot learn.
> in 20 years there could be largely autonomous drones. But replacing the grunts on the ground with machines will require some currently unimagined breakthrough in energy storage (or micro-generation)
20 years and breakthrough energy generation required, hey. Hmmmm. I guess it's lucky that fusion power is only 20 years away*.
*As it has been for the past 50 years or so.
> I imagine people who pull this kind of stunt when the Kremliin doesn't want them to, are running considerable risks that have nothing to do with the courts.
Quite. Especially when the folks that you've outed have just been caught attempting to kill a former spy with a chemical weapon visiting cathedrals with historically interesting spires.
I respectfully submit that any attempt to use such a "feature" in Australia will find things a tad awkward under the Australian Consumer Guarantees.
Let me quote from page 1.
"Products must also:
......
* come with full title and ownership
* not carry any hidden debts or extra charges
* come with undisturbed possession, so no one has a right to take the goods away or prevent you from using them"
Also, you don't need to deal with Apple to make a claim under this guarantee. It is your choice as to whether you talk to the retailer or the manufacturer or the importer.
"Retarded" down voter here. What you presented was a false dichotomy. Not believing in government fairy-math doesn't make me support the farcebooks and slurps of the world.
The legislation they are trying to ram through makes noises about companies not being permitted to weaken encryption but simultaneously holds them to have capabilities to decrypt them. This is a mathematical impossibility. Not that one cannot choose elliptic curves that generate random numbers in a predictable way to the designers, or that the encryption key cannot be put in some escrow or thata message could not be intercepted at a point where it isn't yet encrypted. That will work but it will significantly increase other security vulnerabilities.
If the government actually spent more than 8 seconds per submission they received in considering the feedback, they might actually learn something. Yes. Literally 8 seconds.
I'll credit the shadow minister with making the right noise about those risks, but she should remember that it was her side's underpants head that first tried to bring in the mandatory metadata retention laws we are now saddled with. Colour me a tad skeptical that they remember their opposition logic when they are surrounded by the groupthink that pervades their advisers in government. I do wish our media would at least try to elicit a commitment from the opposition to reverse these laws if they win the election in a few months.
But you may want to reflect on why you think that calling someone retarded is an insult.
> Seriously, I've never seen so much fuss made about a provision that - by current international standards - is still incredibly mild (by which I mean, you're subject to way more intrusive searches if you fly into, say, the USA or Australia, where they will simply seize your device - indefinitely - if you refuse to unlock it on demand). What the hey do some of you people keep on your phones, anyway?
I guess if you have nothing to say, there is nothing to hide. Listen, if it's not too much trouble, please send us a nightly report of whomever you associated with that day, your exact location by the minute, a copy of any photo you took (remember to tick the box so we get the location with it please).
Do you honestly believe that nation states are the only ones who MitM? The hardware to MitM an open WiFi access point is in the order of $100-$200, complete with YouTube instructions. Injecting coinhive.js into any HTTP delivered page is beyond simple. Runs on batteries and is small enough to be discretely hidden in your bag, some even in your pocket (depends on the range you want as to how big the antenna is). In terms of complexity, this is "interview question for a junior info sec position" complexity level. As in, not even a theoretical test but rather here is a device, do it,
And coinhive is at the lighter end of a criminal payload.
But even taking your example of browsing some online brochure which you deem to be perfectly adequate over http. When you click the buy it link, I'm sure that you would agree that it should jump to Https. The site may even put the redirect in for you, so that's nice. Unfortunately, as the page was delivered in an insecure fashion, the MitM can intercept that page and replace the form submit target. Awkward.
> It would later surface that Pho had been taking his highly classified work home with him for roughly five years prior to the incident, and had amassed what US prosecutors called "massive troves" of classified information.
---
But don't worry about those "our spooks need to crack at will but somehow, magically, isn't going to reduce security of encryption laws". There is just no way for those skeleton keys to find their way into an adversary's hands, and even if they did, it's not like they would have them for halfa decade with no-one noticing.
Ok, we've just run this through our Enigma.io system. It says
{"messages":[
{"text":"Can we have another go at repealing 18C?"},
{"text":"QUOTA'S BAD!!1!! Hurumph"},
{"text":"Right, so our new energy plan is to ban wind and just burn non-Adani coal, then subsidise it so it's no more expensive than solar. Sounds good to me. Can someone just run it past Alan?"},{"text":"Got half a billion here to spend on the reef. Anyone know a small charity stacked with petrochemical board members we can grant it to?"},
{"text":"Hey man, know it's a Sunday, but need to call in a favour about my au pair."},
{"text":"Don't worry mate, you've got my full support."}
]}
Crazy talk there, glad we could help. Some folk are really messed up. I can't imagine how I'd sleep if someone sent me the last one.
Dear el Reg,
Please name names after the vote. No-one can possibly argue that a week is sufficient to consider the far reaching implications of this potential law. So some of our (supposed) representatives are being negligent in their duties if they wave it through. This is a hard area of law. But that means a large effort is needed to be on top of the many consequences. My ballot paper sometime between now and May wants to take it into account.
English "they" doesn't communicate whether you mean singular or plural whereas s/he implies singular*
Singular:
I was speaking with a former colleague. "They" couldn't deal with that stupid manglement for another day.
Plural:
Those school kids on the train were so noisy. Why can't "they" stare at their mobile screens quietly like other normal people.
Notice how my second sentence doesn't on its own explain whether I mean one or many? So you've fixed one problem and introduced a new one.
In many cases, you don't need the additional gendered information, either because it has already been communicated and is therefore redundant or because whilst not communicated, it bears no relevance to your point.
*Doubtless someone will find some sentence which breaks my point.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
