* Posts by stephanh

472 publicly visible posts • joined 25 Sep 2014

Page:

You're indestructible, always believe in 'cause you are Go! Microsoft reinvents netbook with US$399 ‘Surface Go’

stephanh

somehow $399 becomes €499

At least according to winfuture.de .

http://winfuture.mobi/news/104047

And then you still need to buy the keyboard, so you end up spending €600 for a laptop with a pathetic CPU and 64GB eMCC. Not my idea of a bargain.

Sysadmin cracked military PC’s security by reading the manual

stephanh

strings

Old trick of using Unix "strings" on MS Word .doc files. Often showed deleted content!

I have also used Vim to edit "locked" sections in Word documents

Universe slipped Milky Way a sausage galaxy to grow a big belly bulge

stephanh

Re: Two thousand million or so years ago...

I think that was based on the now-outdated idea that planet formation was caused by two stars passing close by.

The same concept is also present in Stapledon's "Star Maker".

US Declaration of Independence labeled hate speech by Facebook bots

stephanh

Colonists also engaged in scalping. Bounties were paid for indian scalps.

Basically human history is drenched in blood, and nobody can claim the moral high ground.

stephanh

irregular verbs

I am a victim of colossal theft of land.

You have a property conflict with government.

He is a savage Indian.

stephanh

Re: Book burning Nazis

"Try The Sermon on the Mount next. It will be *correctly identified* as communist propaganda by nearly any ML system trained to identify one."

FTFY

Although Luke's version (Sermon of the Plain) is even more left-wing. ("Blessed are the poor.")

Google releases lite PC-snooper, 'cos full mobile management is hard

stephanh

I am sceptical

Fundamentally, this scheme needs to assume that the local Chrome install and the extension are untampered-with. But I don't see how it can guarantee that.

Let's say I am a black hat. I'll observe the extension under a debugger, track which system calls are made to do the checks it does. Then patch the binary to just always return a good answer. Presto, compromised extension, which I will bundle with my malware to replace the existing extension.

Apple is Mac-ing on enterprise: Plans strategic B2B alliance with HPE

stephanh

Re: Actually...

"...it is easier to get an Mac to boot Linux than it is to get a PC to do the same."

Not in my experience. Especially if you don't just want to boot, but also use all the $$$ hardware in your shiny machine. And assuming you took some care in selecting the PC.

Google Chrome update to label HTTP-only sites insecure within WEEKS

stephanh

Re: It's not "browsing" anymore..

This means that things like router configuration webpages will be marked as "insecure".

It would be more reasonable to exclude 10.x.x.x and 192.168.x.x from this, but apparently Google decided otherwise.

The cybercriminal's cash cow and the marketer's machine: Inside the mad sad bad web ad world

stephanh

Re: Java off, and on

You turned Java "off" on your iPhone?

You probably should have turned Flash off too, then. And Silverlight.

Registry to ban Cyrillic .eu addresses even if you've paid for them

stephanh

Re: Here's a thought...

"Would it not be simply better to devise a translation table to trap and refuse to register names in Cyrillic that "look like" anything in Latin?"

The Unicode consortium maintains tables of characters which are "confusable", and an algorithm to check if two strings are confusable.

https://unicode.org/cldr/utility/confusables.jsp

Arguably, the way URLs work could be changed to declare that two URLs which are "confusable" are actually the same. This could be done by normalizing to a single representation under the hood (Unicode calls this the "skeleton").

Current proposed solutions are all about somehow fixing this in the client by some heuristics which should make the browser complain in certain cases. Frankly I don't think that scales.

Git365. Git for Teams. Quatermass and the Git Pit. GitHub simply won't do now Microsoft has it

stephanh

kudos for "SourceSafe eXtreme"

Just the right combination of superficial plausibility and stark terror.

A pretty and helpful user interface? Nahhh. Is that really you, Samsung?

stephanh

algorithm

"This is a forum where an appreciation of the meaning of 'algorithm' ought to be a given!"

Normally the word "algorithm" is used to imply some at least mildly nontrivial computation is going on.

Ignoring N pixels is not what I would call an algorithm.

Microsoft Edge bug odyssey shows why we can't have nice things

stephanh

why edge?

I seriously wonder why Microsoft still bothers with Edge. It doesn't bring in any revenue and has negligible marketshare.

They could just as well strike a deal with Mozilla to have a MS-branded Firefox in Windows (defaulting to Bring), and save some $$$.

(I presume a similar deal with Google would be a bridge too far.)

Microsoft loves Linux so much its R Open install script rm'd /bin/sh

stephanh

Re: This is known as:

Just like all issues with Unix file permissions can be solved with

chmod 777

, all issues with X11 display permissions can be solved with

xhost +

stephanh

Re: Typical installer written in a large company

At a guess, tens of scripts were written with #!/bin/sh and bash-isms, then the whole thing blew up on a distro where sh != bash.

This was the easy fix. Of course, if they only had have some tool which could automatically search& replace across a large number of files...

No fandango for you: EU boots UK off Galileo satellite project

stephanh

Re: In perspective, Galileo isn't important

"The EU later joined Galileo and changed the participation requirements so only EU members can have access to high precision positioning. Why did lawyers representing the original participants accept this?"

May I suggest the UK fire a nuke at the nefarious country which was responsible for this change? It would only require a very short-range rocket.

Devuan ships second stable cut of its systemd-free Linux

stephanh

Re: systemd-free?

Yes, it's possible to get Debian to work without systemd. That is not the point. The point is that if you do that, and some package breaks, is that considered a bug in the package? For Debian, the answer is currently "no" and for Devuan it is "yes".

The point of "init freedom" is that Devuan has *multiple* supported init's, and packages are supposed to work with all of them, and if they don't, that is considered a bug and not a WONTFIX,.

stephanh

Re: systemd-free?

This has been discussed so many times, it's a FAQ.

https://devuan.org/os/issues

"Since libsystemd0 is totally innocuous if systemd is not installed and running, existing dependencies on libsystemd0 are not consider a major issue in Devuan Jessie.Hence, please avoid filing a bug report for every package that depends on libsystemd0: we already know the full list, and any such bug report will be closed without further processing. However, we would really appreciate your help in repackaging existing software to remove this silly and useless dependency."

Loose .zips sink chips: How poisoned archives can hack your computer

stephanh

Re: And in other news ...

"I hear chroot still works, though."

Probably easier today to use a Docker container.

The glorious uncertainty: Backup world is having a GDPR moment

stephanh

Re: Ivory tower IT

"meet the real world of personal data scattered in Excel spreadsheets, Word documents, pdfs and for all I know coded into C# objects."

If that is how a company handles personal data, they will soon meet the real world of massive GDPR fines.

That why the more forward-looking organizations have spent the last two years changing from the "real world" you sketched to a world in which GDPR compliance is actually possible.

Internet engineers tear into United Nations' plan to move us all to IPv6

stephanh

A modest proposal: IPv7½

Needs only one (decimal) digit for an IP address, statically allocated as follows.

1 - The Register

2 - Facebook

3 - Netflix

4 - Google

5 - Microsoft (just block this one to stop Win10 from slurping)

6 - AliExpress

For intranets:

7 - You printer (replacing 192.168.X.X)

8 - Your boss (replacing 10.X.X.X)

For you:

9 - yourself (for return packages. Carrier-grade NAT is used in case somebody else wants to use the Internet at the same time)

0 - localhost

Nice small routing tables.

Android daddy Andy Rubin's Essential axes handset, is 'actively shopping itself' – report

stephanh

Re: If it were anyone other than Google who bought Android, Inc...

"Android has been pretty terrible until recently???"

I'd say it was pretty terrible until version 4. Speaking as ex- Froyo user.

Julian Assange said to have racked up $5m security bill for Ecuador

stephanh

Re: Upvoting own posts

Don't bother upvoting your own posts.

Use these chaps instead: http://clickmonkeys.com/

"As long as you remain a customer of Click Monkeys!!™ we'll never tell!!" So what could possibly go wrong?

Navy names new attack sub HMS Agincourt

stephanh

This story shall the good man teach his son

"Of course, that's the French commemorating a battle, quietly forgetting the fact that they went on to lose the war,..."

Mmm, "Agincourt",.. OK, history class, who won the Hundred Years' War?

App devs bewildered by last-minute Google GDPR klaxon

stephanh

app developers beware

IANAL, but it seems Google haven't done their homework and/or are (ab)using app developers to test the waters on GDPR rulings.

If "Non-personalised ads" sends out no personal information, then that is sufficient, there should be no need to have an "Ad free" option.

If, on the other hand, "Non-personalised ads" still sends out personal information (such as a unique device number) and "Ad free" comes at a cost, then that is a clear GDPR violation.

Moreover, if "Non-personalised ads" does not communicate very clearly to the user that still some personal information is being sent, that is yet another GDPR violation.

When the sh*t hits the fan, app developers are probably legally responsible even though they used the Google-provided API, you may want to read Google's disclaimers most carefully.

Systemd-free Devuan Linux looses version 2.0 release candidate

stephanh

Re: I don't understand...

...and then you tested all packages and fixed the ones which are now broken?

Every major OS maker misread Intel's docs. Now their kernels can be hijacked or crashed

stephanh

Re: "From which it follows that the docs were unclear. "

"Linux code copied from Windows ?

Non-GPL copied from Linux code ?"

Both copied from BSD? Windows has used code from BSD for networking, not so far-fetched to think that they also look there for "inspiration" on other topics.

stephanh

Re: Re-Education

Especially since this whole "pop ss" hack is a throwback to the 16-bit segmented DOS days.

The expectation being that the next thing you do is adjust the sp register and thereby restore the entire segmented ss:sp stack pointer to some previous location. If an interrupt handler would run inbetween it would smash some arbitrary memory at new-ss:old-sp.

So no sane application program has been using this for >20 years but of course the complexity-induced insecurity remains with us.

Windows app makers told to think different – you're Microsoft 365 developers, now

stephanh

Re: "Our mission is to make Windows the best dev box for you"

"Can you do that on any other type of Linux install? Didn't think so."

I do this (invoking Windows programs) all the time from msys2 bash. Virtualbox also has guest extensions to allow a guest to invoke pograms on the host. (Disabled by default, of course.)

Mike Lynch's British court showdown v HPE pushed back to 2019

stephanh

Re: Caveat Emptor

Lynch first tried to sell Autonomy to a little old lady, but she smelled a rat. So he had to find somebody a bit more gullible.

Industry whispers: Qualcomm mulls Arm server processor exit

stephanh

Re: RISC-V is the future

I am sympathetic to RISC-V but I suspect that Qualcomm is only involved to keep ARM licensing down.

Windows Notepad fixed after 33 years: Now it finally handles Unix, Mac OS line endings

stephanh

what about the BOM?

I would say that a much more annoying issue with Notepad is that it insists on marking a UTF-8 file with a BOM ("byte-order marker"). Many text-processing tools choke on this BOM. In contrast, most Unix tools handle CRLF transparently.

Wish that Microsoft had done what Apple does and just included Vim in the base system.

That Brexit in action: UK signs pact to let Euro court judge its patents

stephanh

Re: The right thing to do.

In Dutch we have the joke word hottentottententententoonstellingsterrein: exhibition terrain for "Hottentot" (Khoikhoi people) tents.

Never mind that Khoikhoi don't live in tents.

stephanh

Re: The right thing to do.

That would be "Federal constitutional court" in English, a phrase which incidentally is completely made out of Latin loan words.

Oracle demands dev tear down iOS app that has 'JavaScript' in its name

stephanh

But merely mentioning a trademarked name is in itself not a problem. The problem is in *naming* some product after the trademark.

Somebody at Oracle's law firm did a grep over an easily-available list of software products, thereby satisfying some minimal level of "policing" effort so as not to lose the trademark.

Go away, kid, you bother me: Apple, Google, Microsoft, Mozilla kick W3C nerds to the curb

stephanh

In particular Netflix has apparently strongly lobbied for EME (Encrypted Media Extensions).

stephanh

O, the browser vendors *are* along for the ride. They have all implemented the Encrypted Media Extensions, the DRM mechanism standardized by the W3C. Hand-wringing of individual WHATWG members notwithstanding.

Note that EME is formally not part of HTML proper (it's an "extension"), so out of scope for the WHATWG.

stephanh

filioque

https://www.w3.org/wiki/HTML/W3C-WHATWG-Differences

I'd say extremely minor stuff. The real differences are procedural (Living Standard vs numbered releases) and political (DRM).

stephanh

Extremely questionable if W3C is "more altruistic" than WHATWG. And Facebook is a W3C member, not that that means very much.

stephanh

From a practical point of view, if you are writing web pages, the only relevant standard is WHATWG. Browsers implement WHATWG, not whatever the W3C dreams up.

As mentioned in the article, neither standards body is exactly a representative of the "little guy". WHATWG is dominated by $BIGCORPS and so is W3C. The difference is that the $BIGCORPS in WHATWG are the ones who actually control the browsers, the $BIGCORPS in W3C just wish they did.

At least the fact that the actual browser makers co-operate in WHATWG means that it becomes possible to write cross-browser webpages.

Intel outside: Apple 'prepping' non-Chipzilla Macs by 2020 (stop us if you're having deja vu)

stephanh

Re: No need for virtual machines....

Apple has already a different solution in place for that: universal binaries, which may contain machine code for different architectures.

LLVM bitcode isn't architecture-independent anyway; I cannot take LLVM bitcode compiled for x86 and use it on ARM.

Super Cali goes ballistic, Starbucks is on notice: Expensive milky coffee is something quite cancerous

stephanh

the judge who cried wolf?

"I read somewhere that those cancer warnings on coffee are bogus. So cigarettes are probably fine too."

Happy as Larry: Why Oracle won the Google Java Android case

stephanh

Uhm, does this make WSL not in fact in violation of the GPL?

Perhaps for the generic Unix APIs, Microsoft may be covered by contracts from their Xenix days, but there are tons of Linux-specific APIs such as clone() and futex() and inotify and epoll which almost any Linux program will be using.

stephanh

some lawsuits Larry can expect

* Being sued by Microfocus (current owners of original Unix source code) for using the Unix API in Solaris and Oracle Linux.

* Being sued by IBM for using the SQL syntax.

* Being sued by UC Berkeley for copying the RISC II ISA in SPARC.

Unless somebody can explain to me how these things would then somehow not be copyrightable?

Samba settings SNAFU lets any user change admin passwords

stephanh

"If Microsoft were to roll out decent ssh client and server integration for its products that would be a big win for its customers,"

Windows 10 now contains a build-in ssh server. I learned this because it got in a fight with my openssh install for port 22.

"although the devil would, as always, be in the details."

Ah yes.

Air gapping PCs won't stop data sharing thanks to sneaky speakers

stephanh

Re: Theory and in practice?

I propose the kilometer per second per megaparsec which, as we learned the other day, is used to express the Hubble non-constant. It's about 30 zeptoherz.

Mozilla sends more snooping Web APIs to smartphone Siberia

stephanh

Re: KISS principle, we hardly knew you

@tfb

"But in fact what it should really be possible to do is to send a bunch of stuff to the browser which says 'if ambient light is in range x do y; if it is in z do q ...'"

You can do exactly that already using the light-level media query in CSS, it lets you say: use this style if light level is low, use this style if light level is high. No need for Javascript.

Unfortunately it can still be used to glean information, e.g. by having a 1x1 pixel image which is shown in dark conditions and another one which is shown in light conditions, and then tracking on the server which is requested.

Slack cuts ties to IRC and XMPP, cos they don't speak Emoji

stephanh

Re: Emojis... where's the one for *vomit* ?

"The post contains some characters we can’t support."

Suggest changing it to

"The post contains some characters we can’t condone."

\U0001F60B

A smartphone recession is coming and animated poo emojis can't stop it

stephanh

Re: Manufacturers are spending more

"Except for "kilo", which gets lowercase "k" just to confuse people."

And hecto (h) and deca (da) are also lowercase.

Page: