* Posts by Cynic_999

2855 publicly visible posts • joined 15 Aug 2013

Radioactive hybrid terror pigs have made themselves a home in Fukushima's exclusion zone

Cynic_999

Re: “Re-wilding”

Any aspect of our lives that is not under the control of our government is obviously highly dangerous and best avoided at all costs.

International law enforcement op nukes Russian-language DoubleVPN service allegedly favoured by cybercriminals

Cynic_999

The modern technique is to identify what the target is doing, then make a new law so that it becomes illegal.

Cynic_999

Re: So... which VPN providers are actually legit and really don't log anything?

It would be stupid to run a VPN without any logging at all. How else could you identify the sources of the inevitable DOS and other malicious attacks? It would be almost as stupid as admitting that you log users.

Cynic_999

Re: I have nothing to hide

There is absolutely nothing wrong with having "something to hide". And just about every adult, no matter how law-abiding, has almost certainly done many things in their life that they would not want everyone else to know about. Next time someone claims to have nothing to hide, just ask them to tell you intimate details of their sex life, including fantasies and any embarrasing incidents they suffered in their teens so you can post it on a public web site.

If having something to hide is regarded as undesirable or suspicious, bear in mind that governments want to hide far more things than most citizens.

Leaked print spooler exploit lets Windows users remotely execute code as system on your domain controller

Cynic_999

Re: What the ever-loving frak ?

Many companies operate a distributed printing system whereby users queue their prints onto the central server, which are then released on demand.

Apple warns kit may interfere with implanted medical devices at close proximity

Cynic_999

Warnings are not always the safest option

If one device has a specific warning and another device does not, then people could be forgiven for assuming that the second device is not a risk. The best place to put the warning is on the device that may be affected rather than on a random selection of devices that may have an effect.

This is the unintended consequence of trying to provide a risk-free environment - people will assume that anything that does not carry a warning about a particular use scenario must be safe to use in that scenario. In other words it reduces the probability that people will make their own risk assessments.

Hmmmmm, how to cool that overheating CPU, if only there was a solution...

Cynic_999

Re: Anybody who knows anything about plumbing ...

"

Your mains water supply is a source. Your CH system isn't, it simply holds water that the source supplied. You're not coupling two sources together.

"

Once you store water, the water in that storage becomes a new "source". If I fill a barrel with water from the mains, then add a kg of potassium cyanide to that barrel, you are surely not saying that it is then OK to put that barrel on the top of a tall tower and plumb it into the mains water supply?

Cynic_999

"

... calling in local fire response services to point their pumps at substation transformers ...

"

Doesn't sound safe. One slightly misdirected stream hitting a connection on the HV side of the transformer could result in permanent damage to the hose operator.

Cynic_999

Re: Anybody who knows anything about plumbing ...

"

... knows you don't plumb two water sources together. Ever.

"

Erm - AFAIAA most CH boilers in the UK have a means of temporarily coupling the CH circuit directly to the mains water supply in order to fill or top-up the CH system. In my recently installed boiler it is achieved by opening two ball-valves using a screwdriver. In my case I do so once or twice during Winter when the CH pressure falls below 0.8 bar (probably due to small leakages in the CH circuit). This is explicitly detailed in the instruction manual for the boiler - it is not an unapproved arrangent put in by a cowboy plumber.

The CH circuit has chemicals in it to prevent scaling and freezing, so we would definitely not want it to leak back into the mains water supply. AFAICS the only thing that prevents this from happening when both ball valves are open is the assumption that the mains water pressure will always be higher than the CH circuit pressure. While there might be a non-return valve somewhere inside the boiler to prevent flow from CH to mains (I don't know), a non-return valve (if it exists) would not negate the fact that the two water sources are plumbed together.

So I am not sure that your observation is correct.

Serco bags £322m contract extension for Test and Trace, is still struggling to share data with local authorities

Cynic_999

We need test & trace

We desperately need a system that can trace where all the money is going and test whether it is getting anything worthwhile in return.

I was fired for telling ICO of Serco track and trace data breach, claims sacked worker

Cynic_999

Re: Whistleblower protection

Regardless of the reason that Jackpotcomics fired her, it is they who need to be sued for wrongful dismissal, not their customer, Serco. Consider the case where the customers of a pub tell the landlord that they refuse to be served by a black person and will boycott the pub if that worker is present. As a result, the landlord fires the black employee. Should that employee sue the pub or its customers?

Cynic_999

OTOH

She does appear to have been intent of gathering dirt on the company with which to harm them rather than simply exposing a rather minor case of DPR breach. (Using real data in a training session is not a particularly serious case of misusing private data after all). Exposing that breach did not need her to make secret recordings of private conversations between other employees.

I do not believe that it is unreasonable in principle to fire an employee who is quite obviously trying to find ways to cause harm to the company that employs them.

Cynic_999

Re: "Messi had been employed by Jackpotcomics Ltd"

It certainly sounds like the perfect name for most of the companies hired to do work for the government.

Russia spoofed AIS data to fake British warship's course days before Crimea guns showdown

Cynic_999

Good to know ...

Reading the article, it seems that the author is very clear about how easy it is to spoof an AIS signal. But he seems to be assuming that spoofing a webcam image is completely impossible ...

Cynic_999

Re: Provocation

You think the UK military is in any better shape?

Cynic_999

Re: To sadly turn this political

And the Spanish navy sail through Gibralter's territorial waters and we don't interfere ... Oh. Wait ...

Cynic_999

Re: Diplomacy

Russia has never claimed that it fired shells *at* the warship. Russia claimed it fired *warning shots*.

John McAfee dead: Antivirus tycoon killed himself in prison after court OK'd extradition, says lawyer

Cynic_999

Re: Why was he in a Spanish prison?

"

As a rule, Taxes pay for those things we ALL use.

"

That's the theory, and is the argument used to justify taxation. But if so, the government is providing the worst value for money than almost anything else. Tot up the tax you pay and you'll probably be surprised at how great a proportion of your income goes to the government. The last time I did so it amounted to nearly 90% of my income - and I can assure you that the government supplies a lot less than 90% of my total needs.

Income tax (introduced as a temporary emergency measure to pay for the Napoleonic war). National insurance. Vehicle duty. Council tax. VAT. Huge tax on fuel, alcohol and tobacco. Then there are the more hidden taxes - everything you buy has included in its price the cost of business taxes, council tax on the retail and factory premises, fuel tax on the vehicles that distributed the goods, import tax. And then there's stamp duty, airport tax, inheritance tax and capital gains tax that affect some of us from time to time.

And the tax does not pay for all government services by any means. There are fees for licences, passports, parking on some public roads, court services and many other things supplied by the government. Some toll roads still exist, as do "congestion" and "pollution" charges.

Add to that the fact that many of the things we need from government are things that the government has caused us to need in the first place. Arguably, had the government not invaded countries that did not present a threat to the UK, we would not be at risk from terrorist attacks and so not have to pay such a lot on defence and policing. Had the government not made so many items and substances illegal, we would not need so many police officers "protecting" us from the consequences of criminalising popular activities - the consequences of prohibition being far worse than the activities themselves.

If the government really needs all that money to supply the population with essential things, how come it managed to supply all that was needed 200 years ago by taking only a fraction of people's total income as it does today?

Pub landlords on notice as 'Internet of Beer' firm not only pulls pints, but can also clean the lines

Cynic_999

Re: No surprise there...

"

Seriously, at what point does a bunch of instructions - or an algorithm in modern parlance - become artificial intelligence?

"

I'd say that is when it can create its own complex algorithms to achieve a desired result, based upon logical conclusions drawn from previous outcomes and patterns identified in its input data.

Hubble Space Telescope sails serenely on in safe mode after efforts to switch to backup memory modules fail

Cynic_999

Re: Wishful thinking...

I suspect that spy satellites are designed to look at objects on Earth rather than deep space. While there is some overlap, the specifications differ quite a bit between the two functions.

Toyota reveals its work on an honest-to-goodness cloak of invisibility

Cynic_999

Re: Interesting

"

The hardest part is actually measuring the drivers viewpoint to render the correct part of the image on the inside of the pillar

"

No need. The driver can adjust the camera to suit his position in the same way as the rear-view mirror is adjusted. Give the camera a wide enough field of view to cover the normal range of head movement.

Cynic_999

Re: Interesting

Why holographic? I don't see that it requires a 3D view for this application, nor anything with high definition. A camera and LCD displays would be perfectly adequate in allowing the driver to see objects hidden behind the pillars. The camera being moveable by the driver to provide the correct field of view from the driver's position, the same way as rear-view mirrors are adjusted.

No need to give the illusion of looking through the pillars any more than the rear-view mirror gives an illusion of having eyes in the back of your head. Just somewhere to easily look that gives a view of objects usually obscured by the pillars.

Cynic_999

Re: I remember a SciFi book about this.

Single molecule light receptors & emitters would not work. To be able to interact with light, the device must be bigger than the wavelength of light. It's why you need an electron microscope to see things smaller than a certain size. Things smaller than the wavelength of the light (or other EM radiation) being used just don't reflect (or obstruct) that light, so no amount of magnification will allow you to see it.

It's also why UV light is used to image ICs with small geometries. Visible light has a wavelength greater than the size of the features on the IC.

But you don't need a pixel size anything like as small as a molecule. So long as the field of view has at least as many pixels as the number of rods and cones in your retina, the granularity will not be detectable.

Want to keep working in shorts and flipflops way after this is all over? It could be time to rethink your career moves

Cynic_999

Re: 'You could argue that "anything you can Google and understand" is part of your skill set...'

Having the information instantly available is very useful and can make it unnecessary to do a lot of rote learning, but far more important is to know what information you need to have and how to use it. Having something available does not mean that you know how to use it correctly. A baby will starve to death even if it has plenty of canned food and an electric tin-opener within easy reach. I could not design a viable nuclear power station without many years of study and practical experience even if all the information I need is available via Google. Google will not make you a grand master at chess or even a good poker player, though it might help.

Cynic_999

Yup, embedded software (firmware) does seem to be something that very few people are learning. Most educational courses concentrate on high-level programming. I speak as an embedded software/hardware engineer who typically writes assembler programs for systems where the CPU speed is measured in tens of MHz, and memory in kB, and yet must have functionality that is a tad more complex than a typical microwave oven or washing machine. We are a dying breed. Why use a custom PIC design when a complete Raspberry Pi is not a lot more expensive and can be programmed with a C application running on Linux?

One of the first common office networked computer systems I worked on was Wang. It used an 8 bit 8080 or Z80 running (IIRC) at 4MHz and 64K of RAM for both program & data. Perfectly adequate for 90% of the office tasks carried out these days on GHz PC's and GB of RAM. Productivity was probably a bit higher due to not having the distraction of Facebook & Youtube etc. (And El Reg come to that).

Cynic_999

Re: Much cheaper.

"

Oh and BTW - what has WFH really got to do with it?

"

It is not feasible for anyone to do a daily commute between Croatia and England, so unless the person is WFH they would have to emigrate to the UK. Which means they would have the same cost of living as anyone else in the UK and would not be perfectly content on a salary that is low by UK standards. Thus no advantage in employing a foreign worker. Plus all the hassle of getting a residence visa, relocating family, living in a different culture etc. means that only a low percentage of foreign candidates would apply for the job anyway.

If all the UK employees are WFH, then it makes no difference to the company where those homes are geographically situated, so it makes sense to recruit from areas that have a low cost of living (and thus a lower salary demand).

Cynic_999

Much cheaper.

My company can employ three IT guys WFH in Croatia for the price of one IT guy WFH in England. And they are over the Moon with their salary, so it's win-win. Apart from the English IT guys who lost out - but that's three happy guys for every one unhappy guy, so it's still a win. A huge proportion of foreigners under the age of 30 can speak reasonable English these days, so language is not the problem it once was.

Tech contractor loses IR35 tribunal appeal: 'Right' to substitute didn't mean he could, say judges

Cynic_999

Re: Yet another push for us to all go work at Tesco

There is nothing immoral about not paying tax that you are not legally obliged to pay, even if you have arranged matters specifically in order to avoid that tax. If anything, it is the government that is immoral in demanding taxes that it promised not to impose. I'm thinking in particular of income tax, which was introduced by the UK government as a temporary emergency measure in 1799, and it was promised that income tax would be discontinued after it had paid for the Napoleonic war.

Taxation is completely arbitary. The government will demand as much as it believes it can get away with. If you pay tax that you could legally have avoided paying, you are not doing anything noble, you are just being stupid.

Cold food is VAT free but you must pay tax on hot food. Would you demand to pay tax on a cold pasty on the grounds that you intend to heat it in the microwave as soon as you get home? Surely if you don't pay tax you will be exploiting a "loophole" in the tax law, which "obviously" intends you to pay VAT if you eat the food hot? Are non-smokers as bad as Amazon in the way that they blatently avoid paying huge amounts of tobacco tax?

Excuse me, what just happened? Resilience is tough when your failure is due to a 'sequence of events that was almost impossible to foresee'

Cynic_999

Re: NTP

"

You still need to sync the atomic clocks together in the first place, and to keep them agreeing afterwards (depending on the level of time accuracy you need)!

"

Well yes, it does depend on the level of accuracy you need, but there will be very few cases where a static atomic clock on Earth will need to be adjusted during its lifetime. Even if you require the clock to be accurate to within 1uS (one millionth of a second), an atomic clock would only need adjusting every 100 years. The variation in propagation delay from time source to the point where the time is used is a lot more than 1uS in any networked computer system I can think of, other than systems where precise time is part of the input data it is working on (e.g the embedded CPU in a GPS receiver).

We've been shown time and again that strong encryption puts crims behind bars, so why do politicos hate it?

Cynic_999

Re: The irony of it

A camera pointed at even a completely static scene such as a wall will have enough noise in the low-order bit (LSb) to make any steganographic data in that bit undetectable. But a camera showing a very low-light scene will have much much more noise - which allows a few more low-order bits to be used without the possibility of detection, making the data overhead a lot less. Basically, the noisier the source material, the greater the amount of steganographic data can be encoded into it without becoming detectable. A 16 bit audio file of a weak high-bandwidth shortwave radio station could have its low-order 8 bits replaced without any detectable change to the audio content - thus making the total data only twice the size of the hidden message.

The only thing to be aware of is that the original source must not either go into overload (e.g. clipped audio waveforms or saturated white video frames) or have periods of completely null data (e.g. completely silent intervals in an audio stream or completely black video frames). In both cases the data becomes a string of 0x00 or 0xFF and changes to the low order bits will stick out like the proverbial dog's wotsits. Of course, a steganography program could automatically skip data words consisting of all 0's or all 1's.

Cynic_999

Re: Old encryption is returning?

Look up "steganography" It is not returning, it has never disappeared.

Your example is not very good, because a message containing a word salad that makes no sense would be immediately suspected of having a hidden message.

The modern digital method is to encode conventionally encrypted data into the low bits of (say) audio or video data. The audio or video file still plays perfectly OK, with the low-bit changes just altering the slight random noise that is present in almost all audio or video files. IOW the low-order bits of most (decoded) audio or video data is *already* essentially random, so changing one random bit-pattern to a different seemingly random pattern is not detectable (without access to either the original unchanged audio or video or the decryption key for the encoded encrypted data). You cannot see or hear any difference in the audio/video of the carrier data, so nothing to flag it as containing steganographic data.

The downside is that it requires many times the data size of the hidden encrypted data - but as both storage and bandwidth become bigger and cheaper, this is becoming less of a disadvantage.

Cynic_999

Re: Obvious solution

"

- Sure, you think, just post the key (or it's fingerprint) - except the mail gets intercepted.

"

The whole point of PK encryption is that it *doesn't matter* if the public key gets intercepted. In fact the normal method is to post your public key to a public forum that everyone can see, which prevents your key being substituted by someone else's public key. You can then check the public forum to ensure that your key has not been replaced by an impersonator.

Of course, no form of encryption guards against being duped by someone who is pretending *from the outset* to be a good guy but is in fact a criminal, or vice-versa.

The AN0M fake secure chat app may have been too clever for its own good

Cynic_999

Re: One Time Pads.

"

The problem behind that problem, of course, is that if someone is impersonating you, they can just turn the tables on you and say your attempts to cry impersonator are themselves that of an impersonator.

"

Depends how you know the person you are wishing to communicate with. If there is doubt about whether the key really was sent by the right person, your first message to that person could be to ask them to send something or answer a question that only the right person would be capable of doing. They then supply what you asked for, signed with the public key in question.

Cynic_999

Re: One Time Pads.

"

If someone can man in the middle all the conversations, he can substitute his own sets of keys during the initial exchange and man in the middle all the subsequent conversations. To really be sure, you would need to exchange keys in person with someone you can trust present who can vouch for the identity of each party.

"

The usual way to overcome that is to publish your public key on a public forum or a public repository. If someone manages to hack into that forum/repository and change the key, you will know as soon as you log onto that forum and see that the key you published has changed. Similarly, if someone were to publish a bogus key to the public platform in your name, you would see that fraudulent post. You can then shout long and loud in clear emails and messages that someone is trying to impersonate you.

In addition you can send your public key to the other party via several different routes. Public forums, email, social media etc. The other party can verify that they are all the same. The probability that an imposter will be able to intercept and change every copy you sent is as close to zero as makes no difference.

Do you come from a land Down Under? Where diesel's low and techies blunder

Cynic_999

Re: Alternative steps

Yes, you are permitted to use red diesel for generators. Whether a company goes to the trouble of doing so in order to save a few £ on something that will only be used occasionally is a different matter.

Personally, I filled our genny tank from diesel ferried in cans ferried from the nearest petrol garage, though I could have instead bought it from a more rural garage 20 miles away that sells red diesel - but that would have taken all day.

Cynic_999

Re: Alternative steps

It most certainly has occured to the legislator - in fact it is the main reason for the legislation. Same reason that speed enforcement cameras in the UK must be conspicuous and have advance warning signs.

Inventor of the graphite anode – key Li-ion battery tech – says he can now charge an electric car in 10 minutes

Cynic_999

Re: This is impressive

"

I would soo like to get my hands on a charger like that !

"

And where would you find an electrical outlet to plug it into? Bearing in mind that charging an EV battery in 10 minutes will need about 2MW of energy. If supplied from a standard 3-phase supply it would take over 2500 amps on each phase. There is no connector that can handle that current (and if there were you'd need a fork-lift to lift the cable anyway), so it will have to be fed from a special high-voltage supply, which brings its own safety and other problems.

Cynic_999

Re: There still remains......

I have no doubt that a 2.4MW charger is perfectly feasible. But supplying many such chargers with 2.4MW of electrical energy each is not feasible - not from the national grid anyway. Very few of our distribution transformers are big enough to cope with that sort of loading, even for a few minutes.

No, I said long ago that the only practical way to go is to have fast battery *swapping* rather than fast battery charging. Automatically measure the remaining charge in the battery being swapped out and the actual capacity of the charged battery, with the customer paying for the difference.

Then physically ship the discharged batteries from the filling stations to & from various specialist bulk battery charging locations that are close to a source of cheap power (e.g. hydro or nuclear) for charging during off-peak times. Charging time per battery then becomes unimportant, and no upscaling of the national grid is required. Keeping the power stations on full load 24/7 makes them more efficient.

An anti-drone system that sneezes targets to death? Would that be a DARPA project? You betcha

Cynic_999

Re: Loitering/multiple targets?

"

... our American cousins do try not to create collateral damage, whilst less scrupulous nations don't give a rat's ass whether they pollute the West Country with nerve agent or Central London with Polonium.

"

Erm ... Agent Orange?

Cynic_999

Re: Loitering/multiple targets?

It would be very difficult for anyone to care less about collateral damage than American soldiers (or drones) on foreign soil.

UK's Government Digital Service extends contracts with Post Office and Digidentity for wobbly Verify ID system

Cynic_999

Re: Another UK Government IT Procurement

One problem is that the requirements tend to change significantly throughout the development of the product, as more and more people add their own requirements in order to stamp their personal "kilroy was here" tag onto the system, and also try to use the system for purposes that it was never originally intended to be used.

BT sues supplier for £72m over exchange gear that allegedly caused wave of ADSL outages

Cynic_999

I cannot conceive that anyone who would even be capable of designing a viable IDC contact block, no matter how incompetant, would have specified untreated steel for anything they knew would be exposed to the open air. Thus I am pretty sure that this was a mistake that occured between the design phase and the manufacturing phase.

FBI paid renegade developer $180k for backdoored AN0M chat app that brought down drug underworld

Cynic_999

Re: War on drugs

If you look at the facts, you must surely come to the conclusion that the prohibition of drugs causes more harm to society than the drugs themselves cause.

Most people can see that the prohibition of alcohol in the USA did far more harm than good. Why folk cannot see that exactly the same is true of other recreational drugs is a mystery to me.

Just for a start, legalising drugs would de-fund much of organised crime, which would then reduce the amount of other illegal activity those crime syndicates carry out.

Cynic_999

Re: undeveloped Trusting trust

Not necessarily. The original can be intercepted & developed, and then a photo taken and the new undeveloped film substituted.

Cynic_999

Re: It's all about timing

The sting would be exposed as soon as the court cases start. The prosecution have to provide not only the evidence of the criminal acts, but in many countries the basis on which they conducted the arrests. Where the basis for scores of arrests came from a single source, that source would inevitably have to be revealed.

Cynic_999

Re: Just think and consider for a moment ...

"

Zero, it's not something you could buy, as the article says; it was supplied by criminals exclusively to other criminals.

"

Realistically, how likely is that to be true?

The only products that are sold exclusively to criminals are things that could *only* conceivably be used to commit a crime. And I would hope you agree that an encrypted messaging application is not one.

Cynic_999

Assume you happen to know who developed the code - maybe you worked in the same company and heard about it via the office grapevine, or a fellow computer geek told you what they were working on when it was still in the conceptual stages. Then assume that someone offers you £100 million for that person's name.

Cynic_999

"

If he stays away from that world, those people, and stays clean, he stands a much better chance. He presumably will be offered a new ID. It's not like these people are bound together by honesty - their lives are full of double crosses, betrayal, and physical attacks. They'll move on to other grudges.

"

The drug gangs have a *lot* of money. At least one person, and probably several people will know who the developer is even if they have a new identity - friends, family, police employees etc. Will they all resist the temptation of lottery-win amounts of cash in return for a name & address? Or, arguably worse, give the name of a completely innocent person.

To believe that all the criminals caught in such a high-profile operation will just shrug their shoulders and forgive and forget within a couple of months is, I fear, being a tad naive. Some of these people will not hestiate to kill someone just for not showing them enough "respect".

Cynic_999

Not sure why the downvotes. There must be a lot of people very angry at the person who created the bogus app, and who will be offering a lot of money for their identity.

So if that person was sensible, they would indeed be very frightened by now.

Cynic_999

Re: Trusting trust

And

3) The OTP must never be stolen or intercepted by the enemy.

Something that is not generally under the control of the people using it.

Which is why PK encryption is much better than OTP.