The Register® — Biting the hand that feeds IT

Feeds

* Posts by Kanhef

462 posts • joined Saturday 3rd November 2007 01:28 GMT

Page:

Kanhef
Holmes

Virtual Service Provider eXchange

They've virtualized service as a service (SaaS) and are providing it as a service.

Kanhef

Another problem is that package providers don't always have a fixed URI that always points to the latest version. Open-source projects have a tendency to become unmaintained without notice, at which point there's no one to update it to use current packages.

Kanhef

Re: Coverity

They used automated static analysis to search for bugs; there's no practical way to go through several hundred million lines of code by hand. I'm sure people have found clever ways to write bugs that can't be found by that approach.

Kanhef
Mushroom

Famous architects

Avoid them like the plague, chlorine trifluoride, and IE 6 combined. Their work is overpriced, gaudy, and made to be 'interesting' or 'novel'. Quality and utility are sacrificed, often to the point that junior draftsmen could do better.

Kanhef
Mushroom

"Chrome catching IE slowly"?

If the current trend continues (which it probably won't), Chrome will pass 50% market share in two years, and IE will be dead and forgotten in five.

Safari usage shows a similar jaggedness, which suggests a 'use PCs at work but Macs at home' demographic. The Firefox line has become relatively smooth, though; anyone have an interpretation of what that means?

Kanhef

Acronyms

Would you mind spelling them out at least once? It makes the article much more comprehensible to people who don't happen to work in the same field. I was rather confused as to why Microsoft has an Estimated Retail Price division, and why they cared about Cardiac Rhythm Management software.

Kanhef

Another solution

When an account is deactivated, remove it from other people's 'friend' lists, and remove everyone from their own 'friend' list. That eliminates this technique entirely, far more effective than some warning that most people will ignore. Even if users are aware of what's happening, it doesn't matter much if they still can't 'unfriend' the account in question.

Of course, this requires Facebook to delete information, so it will never happen.

Kanhef

Re: appalling

This may or may not cause other software vendors to change their coding practices.

But I sure as hell don't have any confidence that Microsoft will change.

Kanhef
FAIL

Even if dates are stored in a discrete year/month/day format, a competent programmer would never have let this happen. Any function that creates or modifies such a date should normalize it into a valid form. (For example, a user should be able to add 60 days to a date and get the correct result.) This is not difficult:

While day is greater than numDaysInMonth: subtract numDaysInMonth from day, increment month.

Proper handling of invalid months is left as an exercise for the reader, should take about 5 minutes. Add another 5 if you want to make if bulletproof and handle negative values as well. First-year CS students can do this; for a company such as Microsoft to screw it up requires sheer incompetence.

Kanhef
Boffin

Re: What Am I Missing?

The article states that Arctic sea ice reached a minimum in 2007; this does not say anything about what has happened since then other than that it has not gotten as low again yet. You've assumed it's been continuously increasing for the last five years, which is not the case. The years with the lowest minimum sea ice extent are, in order: 2007, 2011, 2008, 2010, 2009, 2005, 2006, 2002, 2004, 1995. While 2007 was the absolute minimum, every year since then has still been lower than the previous record (2005).

(Data: http://nsidc.org/data/seaice_index/archives/index.html)

Kanhef
Headmaster

Pedantry

"The moisture lost to the Arctic in the form of melting sea ice has to end up somewhere" - that would be the Arctic Ocean. More exposed ocean water does mean more evaporation and eventually precipitation, but there isn't necessarily any relationship between the quantity of sea ice lost and the increased quantity of precipitation.

Kanhef

"frictionless sharing"

Sure - as long as it's within Facebook. Try to get your data out in any way, and you'll find it feels more like 20-grit sandpaper.

Kanhef
Thumb Up

Nice to see so many people thinking about how this can be used to benefit humanity, not just high boffinry. The trick will be to get the cost of manufacturing it low enough.

Drinking pure water generally isn't a problem; you can get enough of trace minerals through food, unless you're on an unusually restricted diet.

Kanhef

In theory, the server could pre-fetch URLs, scan them for malware, and have the client throw up a warning if something is found. I doubt they're actually doing this (they'd probably say if they were), but the same technology could be used for good purposes.

Kanhef

Not unreasonable

Most of that time is spent copying OS data from one place on the drive to another, which is much faster than reading it from a CD or DVD. There's also a tool to create an image of the drive with apps etc. installed. The refresh/reset will take longer, but that's still faster than re-installing everything by hand.

If they're really clever, OS/security updates will be applied to the clean backup copy as well, so they won't need to be downloaded again after a reset.

Kanhef

According to the linked article, there will be an option for a single-pass random overwrite of the entire drive. Not military-grade cleaning, but good enough for most people. Rather cleverly, it skips data encrypted by BitLocker, since that will be unrecoverable anyway.

Kanhef

Really free?

Or will the phone companies still charge you for sending and receiving text messages?

This post has been deleted by a moderator

Kanhef
Headmaster

Words can have several meanings:

http://en.wikipedia.org/wiki/Wetware_(brain)#Alternative_definitions

Kanhef
Thumb Up

I haven't owned, let alone watched, a TV for years.

Haven't missed it one bit, either.

Kanhef

Agreeing to the T&C containing this clause would arguably count as authorizing such access. Just because you don't read it doesn't mean it doesn't exist.

Kanhef

Yes

If you look at the comments in his source code, you'll note that it cancels the requests before they can be completed if the site hasn't been cached. So it doesn't pollute its results if run repeatedly, and doesn't leave traces of having been run (aside from the script itself being cached, of course).

Kanhef
Go

not really

I've worked with a few beekeepers, and the design of hives is quite simple; any half-decent carpenter can build them. Making the wax comb foundation is a bit trickier, but I'm sure someone could set up an operation with support from a microlending bank. Honey yields might not be great with that many hives close together, but it's essentially free.

Kanhef
Thumb Up

finally

It's about time boffins took this idea seriously. Assuming extraterrestrial life exists, and developed independently (as opposed to the far-fetched 'mysteriously seeded from outer space' theory), there's no reason it needs to be remotely similar to life as we know it. Many years ago, Isaac Asimov hypothesized on the various liquid media life could potentially exist in. Depending on temperature range, these include water, ammonia, hydrocarbons, and silanes (like hydrocarbons, but replacing carbon with silicon). Ammonia-based life might function somewhat like ours, but the others would have a truly alien biology, unlike anything we've ever seen.

Kanhef
Boffin

More tools

Privoxy (www.privoxy.org) is a locally-run, content-modifying web proxy designed to block ads and privacy/tracking issues. More technical to set up and use than most browser plugins (regexes are everywhere!), but offers more control and finesse than, say, NoScript. Among other things, it can block elements by URL pattern, not just host. Exorcises annoyances such as <blink>, onunload events, JS and HTML content cookies, banner ads by size or link, Google/Yahoo/MSN text ads. Can bypass click-tracking redirection URLs. Also removes/edits HTTP headers, including the ETags mentioned by AC 19:52 .

Not mentioned in this article are the Flash-based 'zombie' cookies. They can be at least partially dealt with by not loading every Flash object automatically. Some browsers include this as a feature; Safari users can install the ClickToPlugin extension (hoyois.github.com/safariextensions/clicktoplugin).

Kanhef
Grenade

"strong signal that rose and fell with time"

Sounds like a nova, GRB, or any other transient, natural phenomenon. If it repeated with the same amplitude, at a fixed interval, exactly 17 times, there might be something interesting going on. As it is, it's insignificant.

Kanhef

One solution

Don't serve third-party ads. Having no advertisements at all would be ideal, but many web sites depend on them as their only source of revenue. So turn them into first-party ads by getting the ad content, running it through a malware scanner or three, and host them on the site itself. In addition to blocking poisoned ads, this would get rid of ad network tracking, and allow highly-targeted advertising (e.g., on social networks) without sharing personal information with other companies. Everyone wins.

Kanhef
Thumb Up

Decent response

Some reports suggest that this has been going on for more than just a month, so perhaps they could be criticized for not acting sooner. But it's good to see that they're going beyond the usual 'oops, sorry' response and are offering to compensate victims. That, and having outside experts confirm that the vulnerability has been fixed, should win back a lot of customers.

Kanhef
Boffin

Units

As for electric cars, this would work in theory. However, the power draw is a problem. It would be on the order of 100 kilowatts, which will melt household wiring and probably set it on fire.

Kanhef
Boffin

re: machine processing

Maple, Mathematica, etc. are great - if you give them the problem in a form they can understand. Presented as an image, it's a good bit more challenging. Conventional captcha-solvers can stop once they've identified all the characters. This requires also parsing the correct mathematical meaning, which is sensitive to the spatial layout (e.g., 112 is different from 11^2 (11 squared = 121) and from 11_2 (11 base 2 = 3), and then solve it.

The best captchas I've seen are semantics-based, asking questions such as "what is the domain name of this site?". Answering them correctly requires understanding natural language, which is trivial for humans, but almost impossible for computers. Specialized knowledge also works well; in this case, anyone who needs truly random data has most likely studied calculus, and if necessary can look it up or ask a colleague who remembers it better.

Kanhef
Alert

Something like

this: http://www.electricstuff.co.uk/esd.html

or maybe: http://www.electricstuff.co.uk/surge.html

Kanhef

Ever see HTML written in MS Word?

It's hideous. In addition to all the Microsoft-only stuff, the same complex style tags are used over and over. Turning it into plain HTML reliably reduces file size by 80%. It sounds like they've found a way to automate that sort of process.

'Structured' files are typically binary formats, where data is stored at fixed offsets within the file. Unlike XML, there's no way to shorten those without corrupting the file.

Kanhef

Intact, yes

but now I wonder what would happen if you remove one of the platters and try cooking it.

Kanhef

Upgrades?

Will there be a software upgrade for existing devices, or does it only apply to ones sold after the official releas?

Kanhef
Boffin

actually

If the applied force is not directly in line with the craft's center of mass, there will be a torque, and thus rotation. No friction necessary.

Kanhef

not quite

Once you hit the heliopause, you're in interstellar space; there is no solar wind to 'sail' with.

Kanhef

Improvement

Rather that a fixed image, make the fake address bar and Google search form fields. If anything is entered, redirect the user to that site. Since it behaves normally, people will be even less likely to notice that it's not real.

Kanhef

Enabled by default

which is good, but should it even be an option? I can't immediately think of any situation where you'd need to turn it off, so why not have it permanently enabled? I doubt it will be too long before someone finds an exploit that lets them turn off the sandbox.

Kanhef
Stop

From what I've seen

(pics from better scanners, not the Gizmodo ones), it's really not worth the outrage people are working themselves into. It's still crummy black-and-white, there's not enough detail to really be interesting and the weird traces from clothing make the whole thing rather unattractive. Just two minutes of searching online will find erotica with more definition and far better lighting. It reminds me more of C-3PO than naked people.

Kanhef

and furthermore

Looking at the *rest* of the file, they doesn't look nearly as similar. The Android code is a good bit uglier by not using generics or for:each constructs, return statements on void methods, hardcoded constants.

Kanhef

Seems fairly obvious

The arguments to PolicyNodeImpl() are anonymized (bad code style) and its visibility is changed, the assignment of isImmutable was moved, and braces are added to if statements (good code style), but otherwise the code is identical, so someone clearly copied it. I'm sure there's a version control system somewhere that can identify who did it.

That said, I'd still like to have the original code as well, to see how much "adjusting" Oracle did for their presentation of it.

Kanhef

amend that

Managed to dig up the code in question. While it's still obviously copied, Oracle is indeed being somewhat disingenuous, as they use generics while the Android code does not.

Kanhef
Boffin

Extension of ruling

I wholeheartedly agree with the court's ruling; a sentence restricting computer use for a crime completely unrelated to computers makes no sense. But it doesn't explicitly say if such a sentence would be valid for a computer-related crime. I'd need to read the whole ruling to be more certain, but from the excerpts it sounds like this court would allow the first part of it. The prohibition against using any computer with hackerware on it, knowingly or not, and the vagueness of the terms used, is far too broad and should not be allowed under any circumstances.

Kanhef
Thumb Up

re: ad serving

Having advertisements served locally is a great idea. There have been a number of exploits involving poisoned doubleclict etc. ads. Having access to logged-in users' information would also allow the ads to be well-targeted without any privacy concerns.

Kanhef

Failure to innovate continues

The Zune was Microsoft's attempt to imitate the iPod, and it failed miserably; this will be no different. Users who want the features of an iPad will buy one, not wait the year or so Microsoft will take to produce a clone, and even longer for a similar marketplace of third-party apps to form. Microsoft cannot survive by continuing to imitate the success of its rivals; they must develop something new, something even better than what anyone makes. They have rarely done this over the last decade, and I expect this trend will continue unless there is a dramatic change in leadership.

Ballmer's comment about "user familiarity" is ironic, coming from the company that imposed the horrid 'ribbon' interface.

Kanhef
Go

Notably opt-in

They aren't publishing the names of every player, just the people who post on their forum. Using the forum is entirely optional; if you don't want your name out there, don't post on it (only browsing doesn't require an account). Looks like a game account is necessary to register on the forum, but AFAIK there is no publicly-visible connection between them unless you choose to mention it.

Kanhef
Boffin

PC speed?

Would be nice if they said how long it takes to read the same text on a desktop computer. If that takes only 10-15% longer than the paper version, these handhelds may not be all they're cracked up to be.

Kanhef
Boffin

A moderate approach

Immediate full disclosure can cause problems, as in this case. But companies often need a bit of prodding before they take action. Neither extreme of disclosure is always appropriate. I think the best approach is to initially only notify the software developer, and give them a reasonable amount of time to respond.

If they don't, publicize that the vulnerability exists, but not all the details of how to exploit it. If this still doesn't trigger any action, disclose the full details.

Hopefully, the developer will address the issue promptly. Once a fix has been released, then disclose everything. This will pose a negligible risk to anyone who keeps their systems up-to-date, and still satisfy the principle of openness.

Kanhef

Not so much

The spammers only 'won' by default, because Spamhaus declined to appear in court. They probably didn't want to spend that much time and effort on it; since they're based outside the US, the ruling is just about impossible to enforce, however large the amount.

Kanhef
Happy

Works fine in OmniWeb

Well, except for the VR part. If there's any user-agent sniffing, it's looking for WebKit, not Safari specifically. Apple's own guidelines strongly encourage checking browser capabilities dynamically, not by sniffing.

Page: