* Posts by JohnFen

5648 publicly visible posts • joined 20 Feb 2015

Did you hear the one about Cisco routers using strcpy insecurely for login authentication? Makes you go AAAAA-AAAAAAArrg *segfault*

JohnFen

Re: Yes, but

"Even the brightest engineers occasionally make mistakes"

Absolutely true. That's why we have a need for code reviews and comprehensive testing.

"The solution to this problem is fairly well understood, you design the language to make these sorts of bugs impossible."

That's not really a solution, big picture. It's just playing whack-a-mole. You can design languages to make certain sorts of mistakes impossible (often at a fairly high cost), but you can't design language to make all forms of serious mistakes impossible. So, although using "safer" languages can help, they are not comprehensive solutions. The real solution is to engage in proper engineering practices (one of which is to use the right tool for the job).

JohnFen

Re: Time gentlemen

I think that you're a bit too dismissive about the importance of speed, but that likely depends on the sort of applications you're developing.

"it's fast but you have to be super careful"

I agree. But you have to be super careful in all the code you write anyway. Or you should be. Using a more protected function may be safer, but if you think that means you don't have to be as vigilant or cautious in your coding, then I think you're making a big mistake.

JohnFen

Re: Time gentlemen

"it would also mean that old insecure legacy code wouldn't link without much needed maintenance."

Just because code is old, or just because it uses strcpy(), doesn't mean that it's insecure or in need of maintenance.

JohnFen

Yes, but

"PTP's Null suggested latterday C authors might want to switch to strlcpy instead, "a nonstandard function which takes a third length argument, and always null terminates""

That can work unless, like me, you're working on code that must be able to compile on a wide variety of operating systems and platforms. In those cases, nonstandard functions must be avoided, or you need to implement them yourself rather than using library functions (which is rather expensive in such circumstances).

The better solution is to hire competent programmers and rigorously enforce code reviews to catch this kind of nonsense.

Pay row latest: We aren't biased against Big Tech, says Uncle Sam as it rolls eyes at Oracle

JohnFen

Re: People with the same job title dont do the same work

In my experience in the tech industry, all job titles are essentially made-up BS.

JohnFen

Even if they were

Even if they were targeting Big Tech, that'd be OK. Big Tech's failures are such that a bit of targeting is justifiable.

Foldables herald the beginning of the end of the smartphone fetish

JohnFen

Re: fetishisable glass slab

"In my experience, this happens a lot less than I'd like."

In my experience, this is quite common.

"By the time I've run the battery enough that it should be replaced, the manufacturer has dropped all the updates"

Ahh, I understand. I don't care even a little about manufacturer updates, so that's a nonfactor for me.

JohnFen

Re: cynic

"What people don't do is get a decent case or even a screen protector"

I know that I don't. I hate both of those things. However, I've had my current phone for about 6 years and the screen remains fully intact and unscratched.

JohnFen

Re: cynic

As a counterexample, a few years back I used to see cracked screens regularly. Now they're infrequent. Among my friends, only one has broken or cracked their screen.

JohnFen

Re: Can we please

DAB is of zero interest to me, but there's no reason we can't have both!

JohnFen

Re: Yeah I can see it

"I'm not only going to wait for v1.1, but possibly v2.0"

The old rule-of-thumb might apply here: never rely on anything until it reaches at least version 3.

U wot, m8? OMG SMS is back from dead

JohnFen

Re: Con Man's Delight

"Don't you guys get charged for receiving calls?"

Only if I answer them, and I can tell who's calling without doing that.

"The "charged for receiving sms" thing is for specific services you can subscribe too, and is a way of paying for the service"

Fascinating. Sounds backwards to me. Where I live, you can pay for services through SMS charges as well, but you have to send the text to do that, not receive.

JohnFen

Re: Con Man's Delight

" No - all changed with the UKs implementation of the EU money laundering regulations."

Oh, that sucks horribly!

JohnFen

Re: Con Man's Delight

"cheques have to be paid into a bank account"

You don't have check-cashing businesses?

JohnFen

Re: I use SMS...

"There are usually usage charges for SMS unless you're on an already-too-expensive plan that makes them unlimited."

Not so much, in the US, anyway. I use a cheap national prepaid plan and don't get usage charges for SMS.

JohnFen

"Google should throw money at Apple to cooperate with RCS."

No!! RCS is a Bad Thing.

JohnFen

Re: iMessage

"I think you have to enable the ability for senders to know if you've read a message."

If this is true, then that's OK. I'll even give Apple kudos for (correctly) making it opt-in rather than opt-out!

JohnFen

Re: "https://signal.org/blog/private-contact-discovery/"

"Yes, they write:

"Social software needs a social graph""

Holy shit. That rules Signal out for me right there.

JohnFen

Re: You Can Phone Me Or SMS me; Period

"they don't send the list to the servers; they hash the numbers and send the hashes to the server."

That's not as bad as it could be, but it's still not good.

JohnFen

Re: Or you can just phone me.

"any more than the old un*x talk."

I really miss the old unix talk. It was very useful to me!

JohnFen

So the EU's position is not only that insecurity should be mandated, but also that people without cell phones should not be able to complete online transactions above a certain amount?

Secret mic in Nest gear wasn't supposed to be a secret, says Google, we just forgot to tell anyone

JohnFen

Re: i believe it was a mistake..

True, but Alphabet isn't an alarm company. They're an ad company.

JohnFen

Re: i believe it was a mistake..

Your alarm company is probably much more trustworthy than Google.

JohnFen

Re: i believe it was a mistake..

I think that Google has used up any "benefit of the doubt" they may have been due years ago. At this point, it seems that if you assume nefarious intent from them by default, you're more likely to be right than wrong.

JohnFen

Re: Don't be........

Huh? I don't see where anyone was even slightly mean to you in that thread, let alone "lynching" you.

JohnFen

Re: Don't be........

That's not relevant to what I was mentioning, though. Google was wardriving, collecting all of the WiFi data that it could see. The emails and other personal information they collected was because people were using unsecured WiFi. In other words, Google collected data in transit, not data at rest.

Those people should not have been using unencrypted Wifi, of course -- in doing so, you're literally broadcasting all of your data over the radio where anybody can receive it in the clear without effort. At the same time, Google should not have been paying any attention to payload data if all they wanted was a map of SSIDs.

JohnFen

Re: Don't be........

I made no comment on whether collecting the SSID and such was justifiable or not, only that it is collecting personal data.

That said, it's also true that Google collected a lot more than that -- they also collected all unsecured payload data, which included emails, etc.

JohnFen

Exactly. That malice/incompetence line gets trotted out all the time to defend the indefensible, but it's a bit of a straw man. The reality is that it simply doesn't matter if an action is the result of malice or incompetence. The action happens anyway, and that the problem.

JohnFen

Re: No, google is not a government.

*shrug* I think that depends on your point of view.

Fancy a .dev domain? They were $12,500 a pop from Google. Now, $1,000. Soon, $17.50. And you may want one

JohnFen

Re: so confusing

"I assume if people use .dev and host their own internal DNS they could override the behavior ?"

Yes, you absolutely can, but it's really easy to mess it up and even easier to forget that you did it years from now.

JohnFen

Not remotely compelling

"And to be fair to Google, it has actually come up with a compelling reason: in-built security."

I don't find that compelling at all. And, although I'm a developer, I don't see any professional or status-related reason why I'd want a .dev, either. The whole thing seems like a waste of money to me.

You're on a Huawei to Hell, US Sec State Pompeo warns allies: Buy Beijing's boxes, no more intelligence for you

JohnFen

Re: If everything's encrypted, what's the problem?

This.

Even in my own little home network, all traffic (except for the open WiFi I run, but it's on an isolated subnet) is encrypted, even when it's not leaving my LAN. I don't do this because I don't trust my router, I do it as a layer in my multilayered security: it's yet another roadblock should an attacker gain access to my network.

JohnFen

Re: Economic warfare

"So the fact that we don't know of any means there aren't any?"

This exact same thing is true of equipment from every other nation as well. Why is there no outcry about them? Since the US is refusing to actually show why China deserves to be singled out, the only reasonable thing to think is that there isn't a justifiable reason.

JohnFen

That seems like a dangerous stance

Since the US heavily relies on the cooperation of other nation's spy agencies, and it's probably fair to expect that any nation the US cuts off would also stop sharing intelligence with the US, this sounds like it would hurt the US more than anybody else.

'We don't want a camera in everyone's living room' says bloke selling cameras in living rooms. Zuckerberg, you moron

JohnFen

Re: Why do people think this guy is so smart?

Do they? I haven't seen anything about him that hints that he's dumber than normal, but I equally haven't seen anything about him that indicates that he's smarter than normal.

JohnFen

Pull the other one

""Are we going to let people pay to have different controls on data use than other people? And my answer to that is a hard no," the Zuck chucked, adding: "If I could buy my way out of ads and data collection it wouldn't be fair to those who can't.""

And that's another great example of why using anything produced by Facebook or Facebook-adjacent companies and people is a "hard no" for me. Zuck and company are awful human beings.

I don't believe for a minute that Zuckerberg gives two shits about what's "fair". He, and Facebook, only care about maximizing profit at all costs, regardless of how much damage they do -- let alone fairness.

Chrome ad, content blockers beg Google: Don't execute our code! Wait, no, do execute our code – just don't kill us!

JohnFen

"Watch out. At some point, they may just preload all the javascript for you and shove the whole page at you."

That wouldn't affect me, as I disallow Javascript regardless of whether it's third-party or not. I think it's foolish to trust websites to run code in my browser. If that means the site won't work, so be it. No loss to me.

JohnFen

Re: Browser developers hate users

As the saying goes, the opposite of love isn't hate, it's indifference.

JohnFen

Re: Why bother?

"I've stuck with Firefox for many years, but it's not without it's problems"

True. I've been using Firefox since the very beginning. Unlike your experience, though, mine is that post-Quantum, Firefox has become a browser that I prefer to avoid (for many of the same reasons as I prefer to avoid Chrome). I switched to Waterfox instead.

Samsung pulls sheets off costly phone-cum-fondleslab Galaxy Fold – and a hefty 5G monster

JohnFen

Re: Amazing phone, shame about the price

"It seems pretty much $1k and up is the new starting point for cool phones"

I suppose that depends on what you consider "cool". From my point of view, the high-end phones are worse than midrange phones, as they have jettisoned several incredibly useful features and replaced them with less useful ones.

JohnFen

Re: It's a fold up 2K tablet

"That and the spec and the ability to put a more than 7" tablet with better specs than most tablets and some low end laptops makes it not so insane."

It still seems pretty insane to me.

JohnFen

Re: re: The cheaper model has the fingerprint reader mounted on the side of the phone

The real question is -- what does Samsung consider to be a reasonable lifespan? Cell phone manufacturers seem to be of the opinion that a phone should be discarded after a couple of years.

JohnFen

Re: re: The cheaper model has the fingerprint reader mounted on the side of the phone

"Which will obviously be the wrong side for a good percentage of the population."

Could be. But it's irrelevant to another good percentage of the population who won't be using the fingerprint scanner anyway.

JohnFen

Nope

That's an insane price for little return.

There's no 'My' in Office, Microsoft insists with new productivity hub

JohnFen

Re: Why only now?

"Libre Office, as far as I know, has had a central panel for accessing the individual applications for ages."

And I've never found that useful, either.

JohnFen

I'm sure they would

"Microsoft has updated the My Office app and would like to remind users that there's a free, online version of the suite."

I'm sure they would! Although I seriously, seriously doubt that the online version is "free". You're just not paying in money.

WWW = Woeful, er, winternet wendering? CERN browser rebuilt after 30 years barely recognizes modern web

JohnFen

Re: Works fine...

"if we are to take the idea that digital documents are to replace paper ones, what are the non-CSS candidates to minutely specify display formatting?"

I'm confused. I've never seen CSS used for document formatting outside of the web pages. Literally every digital replacement for paper documents I see are PDFs.

"@JohnFen - CSS wasn't mean to replace <table> in its actual, correct, semantic use. But it was developed partially in response to the needs evidenced by pages using <table> extensively to position content that was not semantically cell-like in nature."

Yes, I know. I was referring to the use for formatting, not the use for actually displaying tables.

JohnFen

Re: Works fine...

"it should be no more irksome than pre-CSS HTML "

That depends on exactly what you're doing. I think that CSS has pretty much utterly failed at being able to replace using the table tag for doing grid formatting, for example. Functionality was lost, and that lost functionality made websites worse.

There are advantages to CSS, of course, but on the whole, I'm not convinced that the adopting of CSS was a good thing. At best, it was neutral, simply trading one set of problems for another.

Just do IoT? We'd walk a mile in someone else's Nike smart sneakers, but they seem to be 'bricked'

JohnFen

Re: Self lacing?

"But that's also why once city bicycles were different form sport bicycles"

They still are! I bought a new city bike last summer (although they were called "commuter bikes"), and they were displayed in a distinctly different section from the sport bikes.

JohnFen

Re: Self lacing?

I've been commuting to/from work on a bike for years now, and this is not a problem I've encountered even once. I'm not saying that nobody else has that problem but, again, there's already been a good solution for those people for a very long time now.