Slashdot Mirror


User: ledow

ledow's activity in the archive.

Stories
0
Comments
5,597
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 5,597

  1. Re:Too bad IE is default on Win10 Enterprise on All Major Browsers Now Support WebAssembly (bleepingcomputer.com) · · Score: 1

    Major banks still insist on IE, literally saying they don't support anything else. Not even Firefox ESR etc. (which they did for a while).

    Barclays ".NET" functionality... basically all the SME payment functions are IE-only, you can sort-of-coax them into working in old Firefox ESRs.

    And even the BACS people, the main way of co-ordinating bank payments in the UK, literally say IE11 only.

    They both basically say "You must use our Gemalto smartcard readers, you must use them in IE 11, you must install our ActiveX controls." if you want to make a single payment. Ironically they love to say that it's "for security".

    Either there's something very wrong with browser support for smartcard signing in modern browsers, or they're lying through their teeth and deliberately making the most secure systems insecure by insisting on a legacy browser that's going to be impossible to support one day.

  2. Re:The real question is how to disable it? on All Major Browsers Now Support WebAssembly (bleepingcomputer.com) · · Score: 1

    How to disable it?

    Use your browser's available settings (and/or argue with your browser vendor to put them in).

    How to develop for it?

    Run emscripten on your existing C codebase.
    Or any of a thousand compilers that compile to WebAssembly just the same.

    Pretty much it's the "JVM" of today, that can be targeted by almost anything.

  3. Re:Hasn't Changed on US Airports Still Fail New Security Tests (go.com) · · Score: 5, Interesting

    In the height of the immediate post-9/11 paranoia and security changes, my friend brought his American wife back to the UK. Then to Corfu. Then back to the UK. Then to America.

    On the final leg of the trip, we took them to Heathrow and were walking with them to see them off at security, where the bins are for "this is your chance to ditch prohibited items", before you join the fecking long queues.

    The American reaches into her bag and says "Do you think I should bin this?" It was a can of CS spray. Probably nothing to you Americans but it's illegal to even own in the UK, let alone carry around with you, let alone take on a plane. She'd have been having a very long discussion with an armed officer if that had been pulled out at the check.

    After some discussion, we got her to bin it as she went past, because it looked like a deodorant and the bins were for stuff like that. During the discussion, however, we discovered that she'd already taken it, in her hand luggage (carryon), on all those previous flights and been carrying it around in London quite happily.

    Meanwhile I was asked to contaminate a baby's bottle by proving it was "real milk" by drinking it in the queue before it was allowed through. While doing so, I honestly thought of at least three ways that I could make a bottle look real, carry something incredibly nasty, and still be safe taking a swig of "something" from it, without them being able to notice via this amazing security method.

  4. Re:The fix on The iPhone X Becomes Unresponsive When It Gets Cold (zdnet.com) · · Score: 1

    Fucking Slashdot, nearly 2018 and it still can't do characters properly, when even several-year-old-already competitors using the same codebase can.

    There was a < "less than" in there somewhere.

  5. The fix on The iPhone X Becomes Unresponsive When It Gets Cold (zdnet.com) · · Score: 3, Funny

    if(temperature 10)
          run_background_task(bitcoin_miner);

  6. Just be thankful they didn't replace the local currency with a blockchain!

  7. Re:Isn't this like a BIOS? on MINIX: Intel's Hidden In-chip Operating System (zdnet.com) · · Score: 4, Insightful

    Do you know of a BIOS that runs when the computer is off?

    This is beyond "when I get the magic packet IRQ from the Ethernet controller I will wake up" into "there's a full, general purpose OS running on every processor, talking to the network, interpreting traffic, able to intercept every memory access, and which we have no way to probe, investigate, debug or understand and which may well be auto-updating from the Internet on a regular basis without our consent".

    Question: How do you generate a secure private key on a computer with this in? Literally, you can't.

    With BIOS, the scope was so limited that it couldn't be used for such things, and was just "the code that the computer started at" (literally, a soft-reboot is "jump to address 0, the first line of the BIOS).

    This is a full set of processors listening to everything your other processes do all the time no matter what OS you run or security you apply. And nobody knew what it was doing. And the governments have been removing it from their purchases for years by making Intel make chips without it.

    If THAT ONLY wasn't reason enough to worry about what it could be doing, you clearly haven't understood what it could be doing.

    Literally, this is a full-above-root compromise of every machine on the planet under Intel's sole control. Everything from microphones to connected devices to nearby wireless etc. could be turned against the user.

    Doing that with "just a BIOS" was much harder, much more obvious (i.e. you could generally disassemble the firmware and/or inspect it step-by-step as it was running) and much less damaging.

    Intel has a full computer in every chip on almost every motherboard on the planet. And nobody knows or understands why (because computers work just fine without such a feature, always used to, and still do when you disable such things by forceful means), nobody was really told about it, and it's taken years to discover even what architecture/OS it's running on, let alone what it's doing.

    One virus exploiting one flaw in this and anyone can gain control of the planet over the Internet with NO WAY to clean it off or even detect it.

  8. Even if I WANTED this, I'd do it myself.

    It's not hard to buy a lockbox, or issue out a one-use code. Or even a doorbell that activates a camera that lets you phone a lock that opens. Literally, cheaper tech, that works and is controlled by you, and does so much more.

    At the moment, I have cameras, and I have a secure alleyway that I can open by GSM. Beyond that, it's literally one wire to make it happen the other way so that when they press the bell, it rings my phone and lets me talk to them.

    Then I can open the alleyway remotely, watch what they're doing as they do it, lock it up once they're gone and do it only when I'm actually expecting a parcel.

    The biggest problem is really that anything of value should have a signature for liability purposes - i.e. you spoke to a guy at the premises that took custody of the parcel. That's the only reason companies ever deliver to my neighbours rather than just leaving the parcel somewhere safe in sight of my cameras (which is far from infallible a system, but I've not had anyone try to nick anything yet).

    But, honestly, 50 pounds/dollars, a trip to the hardware store and somewhere you can afford to let them into / open up isn't a lot. One GSM alarm panel with relay activation and a maglock, and a gate/steel box is more than enough for more uses. Stick a cheapy wifi camera on it and you have a good system for such things. These things are dirt cheap on Amazon itself, and the most expensive component of the whole system is the gate / box in the first place, not the electronics and gadgets to make it operate in a way that you don't need to give Amazon - or any other delivery company -
      anything in terms of access to your property.

  9. Sigh. on Paradise Papers Leak Reveals Apple's Secret Tax Bolthole (bbc.com) · · Score: 4, Insightful

    They can do this because... country laws allow it all over the world.

    I can't fucking stand Apple one bit.

    But I'm infinitely more annoyed that any such arrangements are legal, no matter which countries are involved in helping them do this, than anything else. That only happens because the people writing the laws are using the same tricks themselves.

    If governments wrote tax-laws properly, they wouldn't be losing out on such tax, no matter what arrangement Apple tried to use.

  10. Re:I can live without it. on Ask Slashdot: Can Smart TVs Insert Ads Into Your Movies? (gigaom.com) · · Score: 1

    I think this is why they can't do things like the article talks about.

    They realise that the second they do, not only do TV sales drop, but the amount of content purchased will drop dramatically. What's the point in paying for a movie from Netflix or wherever if the smart TV is going to put ads into it for you?

    It will just force people onto other methods of viewing, and so long as there's one model of device on the market that DOESN'T do the ridiculous advert insertion, they will lose out to them.

    Personally, I'd be quite happy to switch the TV off too. I don't really see why I would watch anything on a schedule any more anyway, so "broadcast TV" is dead to me. When you didn't have the facility, you had no choice, but since the days of VCR's there has been less and less reason to crowd round the TV at a certain time of day anyway.

    As such, almost all the content I want can be obtained with a click - legally or illegally - and played on anything. And "anything" includes an open-source video player on an open-source operating system showing on a dumb display with a standard connection.

    The bit people miss - while there still exist computers and computer displays, a TV is just a computer display with a content box on it. And you can't go putting adverts into a computer monitor without destroying someone's ability to work, so people would just use those if it really came to it.

    And, to be honest, a smartphone or small tablet display is more than good enough for anything I ever watch. Hell, I don't even bother to buy the HD version of anything if the SD version is even slightly cheaper.

  11. Re:Sigh. on An iOS 11.1 Glitch Is Replacing Vowels (mashable.com) · · Score: 1

    Okay.

    You cannot use or obtain iOS legally without spending many times more than other brands charge for phones that don't fuck up when you ask them the weather (The Reg article today).

    Supposedly, that cost goes on the "quality" of the device. I wasn't even referring to iOS when I made my comment. Because this is one in a never-ending series of cock-ups by Apple over the last few years that show their app store vetting, device production quality, software update mechanisms and basic software quality are no better than anyone else in the market, but the devices to use them cost much more.

  12. Sigh. on An iOS 11.1 Glitch Is Replacing Vowels (mashable.com) · · Score: 1

    Never mind the price, feel the quality...

  13. Is it just me that would actually prefer slides?

    Print-to-slide.

    Then if you need it in an emergency, just shine a light (which you need anyway to see) through it onto any surface. Bam. Dense information, high-resolution, excellent preservation, low resource usages and you don't need fragile/flammable/soakable paper just floating around and in steel cages to print.

    Plus.. it's a bit more space-agey to just hold up the slide to a bulb to look at the information on it. Hell, you could even have a tiny chip in the exterior of it that stores the same information as the image itself, but digitally-readable if you DO still have a device that works.

    1" square of HP ink compared to 8.5"x11" or whatever letter paper size is in America.

    Surely, in an environment where every square inch and gram matters, a slide makes a better information store than paper?

  14. Again,

    Any rich idiot can make anything "work" by just throwing money at the problem.

    For a while.

    But making profit is a different matter entirely. In fact, that only comes about if you don't throw money around and give products away at or below cost.

    Sure, you can say "R&D", "investment", etc. So long as that's not the ENTIRE business (or so long as it is your entire business and is inherently profitable). Ford do ten times more R&D than Tesla ever could, they just don't throw their money on things they'd "like" rather than things they think could be feasible.

    Musk throws his money at the problem, utilises pretty normal methods and products to achieve it (Tesla batteries are standard lithium cells, Tesla cars use off the shelf motors and components with a bit of software, etc.), but can never sell it at a profit. Even SpaceX - with governments throwing money at it - can't really make a profit which is sustainable in the long-term. One launch failure takes them into immediate loss for a long time. There's a reason that NASA never tried to land and re-use rockets (more hassle than it's worth) and why SpaceX are now following suit.

    Sure... you can get some industry movement. But I don't see Ford, BMW, etc. rushing to compete with Tesla. They've used him as a guinea pig so they don't have to waste their own R&D money and found out that - actually - making a profitable electric car is hard (which they already knew) and that sales will never justify it (Tesla - despite the big words - own precisely NOTHING of the car market).

    As time goes by, short of some amazing miraculous invention, a unique selling point, something that no-one else has that people want and will pay through the nose for, some technology, some patent (which Musk doesn't have and/or is giving away), Tesla and the other ventures will all start to run out of money, either through Musk's boredom or because they just get overrun by the incumbent manufacturers.

    Sales are easy. When you're selling at or below cost.
    Profits, however, are another matter entirely.

    Musk doesn't make profit. He is, therefore, not that good at business even if he's rich.

  15. Re:Can the criminal system keep up? on NVIDIA-Powered Neural Network Produces Freakishly Natural Fake Human Photos (hothardware.com) · · Score: 2

    Rarely is photographic evidence alone used for a conviction. You'd be amazed how unreliable cameras, etc. actually are.

    However, they are often used as PART OF a conviction. Especially if they have come from multiple independent sources (nearby shops as well as the one burgled, street cams, some random person's dashcam, etc.).

    No court would convict on the basis of one photo alone - even if it was dated and had GPS EXIF info. Precisely because it's too easy to forge. That's why some cameras have cryptographic signatures that write hashes into the image information, etc.

    Legal tests have been in place for hundreds of years because, applied appropriately (which they aren't always, but that's why you have lawyers and appeal courts), they don't care about the particular technology involved (whether that's digital cameras or some guy with an angle-measurer). What matters is how that correlates to other evidence, how independent it is, how individually reliable it is (that's what you're talking about) and how "reasonable" it is that actually it depicts what the prosecution/defence claim it does.

    There's a reason that defence lawyers are highly paid, and they'd find holes in almost everything like this if it got their client off.

    To be honest, I've provided CCTV footage to police on dozens of occasions over the years as part of my job, and not once has it been the sole evidence, and not once did it actually get used as anything other than "corroborating" a story that could be corroborated any number of other ways too.

  16. Re:Live demos on stage are frightening on Microsoft Engineer Installs Google Chrome During Presentation After Edge Freezes (softpedia.com) · · Score: 1

    Why would you need to?

    Pre-record the actions you intend to perform.

    Then the "live" performance will work as you intended, on your timing.

    Who would do something RANDOM in a live performance? You test, test, test and then - if you have an ounce of sense - pre-record it for the demo.

  17. Aside from petty criminals, I would be shocked that any decent terrorist was even bothering to rely on any kind of third-party to provide their encryption anyway. I mean, that's just stupid.

    Use ANY communications medium you like. The same metadata would be present on just about all of them. And encrypt the message before you send it. It's not hard.

    Then you know that only the guy with the key can decrypt it and it doesn't matter what Blackberry/WhatsApp/Facebook etc. record - they only get the same metadata anyway. And, also, you could send the message by carrier pigeon if you were that paranoid. It would barely matter.

    What we're catching with such stupidity are not the master criminals, but the idiots. The idiots are easy to spot anyway, precisely because they give the game away from the metadata. While the master criminals aren't hindered in the slightest. Meanwhile, all our privacy is stripped away on the inference that we're somehow stopping the master criminals by doing so.

    I object to the stupidity, dumbing down, and taking me for an idiot - much more than I object to someone claiming to help the government decrypt if ordered to do so.

  18. Reason on Is the Optical Cable Dying? (cnet.com) · · Score: 5, Interesting

    "The reason for this? Soundbars..."

    Nope.

    The reason for this is - I don't want a separate connector for audio unless it's in conjunction with another connector (i.e. I either want one cable only, or one cable + additional audio to go to external devices). The external device itself could happily use the HDMI audio, and offer passthrough / splitting of the signal.

    The problem is that the "other" connector almost certainly has to be able to supply video, audio, data and - sorry - power. Fibre cannot supply power. Ever.

    And then most people would rather give it a whole HDMI with everything, rather than run a separate cable just for audio. To be honest, splitters are in the throwaway price range now, even with HDCP support etc.

    The problem is that manufacturer's think "fibre just for audio" is a useful thing to have alongside "copper that does absolutely everything" when both are commodity pricing. Hell, just give me 10 HDMI slots and if I really want to run a soundbar, I'll run one with HDMI and/or put a convertor on it.

    The other thing that matters - nobody really cares about the fibre "perfect sound" rubbish except audiophiles. But that's like saying "nobody cares about the flight simulator being pixel perfect except for qualified 747 pilots". You can't cater to that niche, as the business case isn't there to do so in a commercial product. But 99.9% of people are quite happy with MP3s, copper cables (especially digital copper cables), and the various MPEG/H264 etc. compressions.

    I've been in IT for 20 years. I've honestly NEVER used an optical connection for sound. I deploy AV stuff all the time. I've even done bits of theatre stuff. The only optical connections I've ever used a networking fibres. And they are so cheap they don't even figure, what costs is the cutting and polishing, which wouldn't be present on a pre-made patch cable. So I also call rubbish on the "fibre is expensive, or can't reach across the room" line too.

    But if I've never used SPDIF, I'm pretty sure most other people haven't either. And given that even RCA connectors are going the way of the dodo (and SCART in Europe), I can't say that SPDIF is going to last any longer.

    Now, if you had a hybird, cable/fibre. Maybe that would serve. If it could do everything HDMI did. But HDMI even does Ethernet if you buy the right kit. So I can't fathom how you'd cut into their business.

    All we really need is a merger of USB3 and HDMI and we have one connector for ABSOLUTELY everything. Including a decent amount of power. But fibre isn't necessary for that and would lose enormously if it was attempted.

  19. Ethernet adaptors are one of the most-highly-open-sourced categorised of device in the world. Drivers for Linux - almost always entirely-source unless they are serious TCP offloading things aimed at HPC - exist for network cards before ANYTHING else.

    Sure, maybe the onboard Ethernet is tied into the firmware, so put in a daughterboard and a cheap chip (there are literally Ethernet daughterboards available, retail, for less than $15 - let alone, in bulk, part of the design, modules etc.). A compatible Gigabit Ethernet chip with interfaces (even if you tied it into the USB bus) is literally in the pence range.

    But if you're into making tradeoffs like "the board can't have Ethernet" but still bundling everything from USB to disabled-ME processors, Intel HD graphics, HDMI etc. and - most especially - Wifi, then really your compromises are in the wrong place.

    I don't buy that argument at all. And for the price, I'd expect a secure method of communication rather than Wifi, on a supposedly "secure" laptop.

  20. Ah, the Apple method:

    "That device you paid a bundle for? Yeah, just buy a ton of extra cables, adaptors and dongles from other people and carry them wherever you go."

    No thanks.

  21. "Preorder from $1,199"

    For a Core M, Intel HD Graphics, 8GB, 11.6" laptop.

    That's some pricey freedom.

    They don't even have a model with an Ethernet port (which makes me question what disabling the ME actually does anyway, because isn't the ME for things like OOB access?).

    Sorry, but - as always - I have to live in the real world rather than some scene out of Hackers. And if I really valued my freedom and genuinely thought things like this were the threat, I wouldn't be using any of these machines, no matter the cost.

  22. Sigh. on See a Random Slashdot Story From the Last 20 Years (destinyland.net) · · Score: 3, Insightful

    Shame that Slashdot itself lacks now the programmer skills to do, say,

    http://www.slashdot.org/random...

    Isn't it?

  23. Re:Close the carbon cycle on Electric Cars Emit 50 Percent Less Greenhouse Gas Than Diesel, Study Finds (theguardian.com) · · Score: 1

    I think you're missing the point.

    Culling carbon, or combating its effects, is really easy. Locally.

    However, to put enough energy into the hydrocarbons from all the hydrogen and carbon floating around in various forms takes AT LEAST as much energy as you hope to get back out by burning them. It's simple physics.

    So to do this for this year, you would need to find enough energy to run every car on the planet, etc. for one year. And then - assuming conversion losses are absolutely zero - you could make enough fuel to run them from that energy and local resources.

    However... losses are never zero. And that's a FUCKTON of energy. Which you'll find... where? Literally not available at the moment on the electrical networks we have, and to do so would require a massive ramping up of nuclear, coal or oil. Only one of those is low-carbon, non-fossil-fuel exhausting (at least in the short term). And, no, sorry, but renewable sources would not cut it on those kinds of scales.

    Oh, and you need to do that alongside all the normal, natural energy usage growth.

    The problem you have not combated is this:

    - the energy density of oil and oil-products is ENORMOUS.
    - we have the benefit of several millions years of their production beneath our feet.
    - we could exhaust that entire supply in less than 100 years, and it would take millions of years to get it back.
    - the "synthesised" equivalent requires.... millions of years x energy of the sun x huge swathes of the earth x biological efficiency x continent-sized pressures... to be applied instantaneously almost "overnight" to make fuel we can use sometime soon.

    None of those facts lead to anything other than oil-shortage, and needing to find alternative energy sources (NOT fuels, fuels are energy storage) on those kinds of scales, and no decrease in overall carbon emissions until we do.

    I can make you petrol now. Trouble is, it would cost more in electricity to make it (let alone gathering raw materials and handling byproducts, and production machinery, and conversion losses, etc.) than you would ever get from the petrol I give you.

  24. Just buy a large secure drop-box. Then any company can use it, and nobody can get to your parcels.

    Hell, stick a cheap Wifi camera on it so you can see who's playing about with it from your phone.

    Giving away literal access to your entire home, as well as 24/7 access to a camera inside your property, to allow someone to deposit a parcel is ludicrous and unnecessary given cheaper, better alternatives that don't tie you into a company like Amazon.

  25. Re: Why more than one? on Dell Lost Control of Key Customer Support Domain for a Month in 2017 (krebsonsecurity.com) · · Score: 3, Insightful

    Precisely because any idiot can register a domain with dell in the title, but to get an authorised subdomain.dell.com goes through a verification process and is immediately and obviously representative of Dell as a corporation.

    This is the exact point, I think, and what you WANT to be doing.

    I've gone to great lengths to remove all the old crappy domains that my workplaces insisted on buying up, or using for one-off events, and pushing everything under subdomains. To the point that "drive.domain.com" is actually our Google Drive link (so it automatically knows to sign you in with that domain account rather than your personal GMail, etc.).

    Literally any idiot on the planet can register a domain with your name in. Chasing and pre-registering such - unless you hold a trademark that you need to enforce - is almost impossible, and an endless game of new TLDs and tricks (e.g. "fordsucks.com") make it a no-win game.

    Buy one domain. Put everything on it. Hell, buy two so you have a backup (e.g. companyname.com, companyname.countrycode) and can quickly tell people "don't use the .com, use the local domain for now until we're back up, as it points to our secondary systems and always has."

    But myriad psuedo-related domain names that you forget about while they're running business-critical systems with live user data and the expectation that you'll own them forever is a really stupid idea. And... technically... who owns those domains? Did you register the correct contacts, could you take it over if you wanted? What about the DNS does it actually go to your company's DNS or goes it bounce via yours thus leaving the company in a fragile position should you leave or want to snoop data (e.g. SSL is reliant on DNS being authoritative)? Do those domains have the company SPF fields? Are they included in the main mail domain's SPF record? DKIM? SSL certificate? There are no end of reasons to actively block such adhoc registration in preference to FORCING YOU to jump through the hoops.

    "An easy life" and "security" are often polar opposites.