Feeds

* Posts by Paul Crawford

1536 posts • joined 15 Mar 2007

It's Google HQ - the British one: Reg man snaps covert shots INSIDE London offices

Paul Crawford
Silver badge
Gimp

Re: "lying face down on with arms and legs dangling"

Now where has my spanking paddle gone?

3
0

Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold

Paul Crawford
Silver badge

Alternatively they looked at the success (or otherwise) of other's attempts (e.g. the French) and decided its not cost-effective.

While availability of legal sources for some things is much improved (e.g. no DRM on audio after Apple's ITunes more or less forced the major player's hands), there are still problems in video actually getting what you want, when you want it, and in a format that won't piss you around in an attempt to play it.

Some will always pirate, some may stop if they are threatened, but the results of, for example, Spotify on music piracy where it is available has been enormous and that is a lesson to be learned. Shame it has not benefited the artists as much :(

9
1

Researcher sat on critical IE bugs for THREE YEARS

Paul Crawford
Silver badge

Re: SourceFire report

Oh, the other thing lacking from the report is the time-to-patch. That is a big factor in how secure you can be with a given product/supplier.

3
0
Paul Crawford
Silver badge

SourceFire report

It is worth reading the SourceFire report as it gives an interesting look at the disclosed vulnerabilities over the years.

Forum trolls will delight in being able to quote it for/against any fanbois of OS as well. It has some correct, possibly controversial, ways of reporting, for example counting the webkit browser engine as "Apple" so the CVE count is way higher than you might have expected. Similarity it treats Linux as one product, but the different versions of Windows as separate (mostly, this is discussed).

However, what the report lacks is the exploit count relating to these. For example, it has the iPhone as much worse than Android by CVE count (210 versus 24), but we all know that Trojans and general shit-ware, etc, for Android are much, MUCH bigger problem in practice.

Oh, and check your buffers please? That is the No.1 vulnerability of the quarter-century!

4
1
Paul Crawford
Silver badge
Black Helicopters

3 years?

Time-line is claimed to be:

VIII. DISCLOSURE TIMELINE

-----------------------------

2011-02-12 - Vulnerability Discovered by VUPEN Security

2014-03-14 - Vulnerability Reported to ZDI and Microsoft During Pwn2Own 2014

2014-06-10 - Vulnerability Fixed by Microsoft

2014-07-16 - Public disclosure

Do we really believe they told no one before Pwn2Own?

5
3

Who should do security clearance checks? Did you say 'chat-bot'? This military slinger hopes so

Paul Crawford
Silver badge

The Inquisitor?

http://www.youtube.com/watch?v=9tGO79BtWUI

0
0

iOS slurpware brouhaha: It's for diagnostics, honest, says Apple

Paul Crawford
Silver badge

Maybe the Russians had a point in dumping iPads, etc, for gov work after all?

3
1

Microsoft confirms secret Surface will never see the light of day

Paul Crawford
Silver badge

Short answer is probably the knew it would loose money. After all they are pushing a similar form-factor in the bigger Nokia-softs and, while decent enough phones in many ways, they are hardly flying off the shelves.

0
0

Facebook haters, look away now: BABY SNAP site's profit is up 138%

Paul Crawford
Silver badge

I guess the recent changes to the user-whoring platform to push adverts in to the news feed is working then, but I find it astonishing there is enough sales liked to FB adverts to justify agencies spending "$6.44 in average revenue per user in the US and Canada".

1
0

HP, Microsoft prove it again: Big Business doesn't create jobs

Paul Crawford
Silver badge

Re: Good article, but...

Same idea as the French insult (more of a derogatory term than outright insult mind you) referring to the British as roast beefs, presumably from out habit of cooking meat until it is usable for shoe soles.

3
0

NO TIME to read Facebook? Delegate the task to your FUTURE SELF

Paul Crawford
Silver badge

Re: AC

I am sure there are folk in my list of friends who would struggle with email, but they can use a phone so that is not a problem.

Also I don't really want to be part of making FB the only way folk communicate, a propitiatory way that is controlled by one company with the primary goal of whoring us from advertiser to advertiser.

3
0
Paul Crawford
Silver badge
Unhappy

Alternatively...

I got fed up of the endless stream of pointless re-posting of crap and generally depressing updates from my "friends" on trivia and decided to ignore it completely for a while. Anyone who really needs to contact me can use email, or better still actually call and talk to me.

If FB is important enough to you, try the F.B.Purity add-on for Chrome & Firefox, it makes the current website a touch more bearable. Sadly it won't deal with idiots polluting your news feed.

2
1

Yahoo! Japan! launches! service! for! the! dead!

Paul Crawford
Silver badge

Seriously folks

While it is tempting to poke fun at Yahoo, etc, the issue of what happens to our digital data once we are gone is something that needs to be properly addressed.

While I might not care (on account of being dead, for example) it might still have some impact on the few living ones who may care about me in some way. When stuff like bank accounts and other aspects of one's estate become virtual and there is no obvious paper print outs lying around my 2nd last resting place, how will those who should benefit from whatever I have to leave find them and access them?

A will is the obvious starting place, but how many would think of listing all on-line accounts in there (and updating them with the regularity they change at which is typically much shorter time-scales than a will) , and how to manage the passwords?

2
0
Paul Crawford
Silver badge

Re: What could go wrong?

Or the seemingly endless stream of XSS flaws that has bothered Yahoo mail in recent years?

1
0

New BOMB detect-o-tech 'could give sniffer dogs competition': TRUE

Paul Crawford
Silver badge

Re: @Crazy Operations Guy

"get a copy of a terrorist handbook and make it the same way that they do"

Thanks, but no. I'd rather keep my limbs if you don't mind...

If you really like stuff that is not nice to handle (for various reasons), just Google for "Things I won't work with" (for Derek Lowe's blog).

2
0

Cave pits, ideal for human bases, FOUND ON MOON

Paul Crawford
Silver badge
Paris Hilton

Re: Venezuelan Beaver Cheese?

I am simultaneously intrigued and horrified by the prospect of tasting Venezuelan Beaver Cheese.

2
0

MARS NEEDS OCEANS to support life - and so do exoplanets

Paul Crawford
Silver badge

Not oxygen?

I think the original commentard was referring to this:

http://en.wikipedia.org/wiki/Great_Oxygenation_Event

Cyanobacteria are postulated to be the cause of the first major organism extinction as they produced plentiful O2 by photosynthesis which is toxic to obligate anaerobes.

So the first life on Earth did not need atmospheric oxygen, but of course it did need it bound with hydrogen in water.

6
0

US judge: YES, cops or feds so can slurp an ENTIRE Gmail account

Paul Crawford
Silver badge

Re: What is the point of a warrant?

There is little you can do about limiting reading to pairs of keys, as with email you have to be able to read it stand-alone from the other person being present. So with encrypted traffic either party can decrypt it, or its no good. You are always one of the two parties even when many others with different keys are present.

A much simpler and easier option is for the police to ask the judge "We believe that ABC and XYZ were involved in criminal actives between START and STOP dates, please can we get those emails?" and the judge to get a 3rd party to filter both ABC and XYZ's emails for the period START-STOP for communications each other.

Job done, police can look for the specific info the believe is needed to clinch prosecution and 3rd parties are not having their privacy invaded.

0
0

Snowden wants YOU – yes, YOU – to build spy-busting tech

Paul Crawford
Silver badge
Big Brother

Re: There's a peculiar phenomenon at work here ...

That is exactly my concern. Today I don't really have anything to fear from what GCHQ know about me, but can you imagine what would happen in a few years of the likes of the BNP/UKIP got in to power and started looking for anyone who was a "threat" to their propaganda and monitoring of Joe Public to find them?

Same here for most El Reg readers - dangerous intellectuals with an interest it technology...

0
0

UN to Five Eyes nations: Your mass surveillance is breaking the law

Paul Crawford
Silver badge

Re: @Roj Blake

You might also want to include the "USA" in how it dealt with the native Indians (not to mention the first appearance of prisoner camps in the civil war), and the Spanish in various south America countries.

Not to mention government-church sanctioned massacres throughout Europe in the late middle ages, oh yes, and that bit of bother caused by the Romans earlier...

A few nutters have nothing on the ability of national organisation to cause suffering.

18
0
Paul Crawford
Silver badge

Re: Dangerous precedent

I think the Nuremberg trials established that simply obeying orders and laws is not an acceptable defence against actions that are clearly morally abhorrent.

By implication, those who speak out and act against said actions should be protected against perverse laws or illegal orders.

It is the whistle-blower's charter on a grand scale: If you have evidence of wrong-doing you should not be punished for revealing it, but that is kind of hard when the evidence is against the government who is also in charge of the trial & punishment.

43
1

Crooks fling banking Trojan at Japanese smut site fans

Paul Crawford
Silver badge
Paris Hilton

Re: References

Dunno, maybe they like that sort of thing?

Had a quick shuffle over to ppv.xxxurabi.com but damn - its all in Japanese! Other than the NSFW images of course...

0
0

Microsoft: You NEED bad passwords and should re-use them a lot

Paul Crawford
Silver badge

Unless your PC is also compromised, then said kiddy-porn or terrorist postings would be traced back to other IP addresses where it was logged in under control of the hackers.

The bottom line is people are shit at security, and some things (like regular password resets[1]) don't help at all. What MS recognise is that not all accounts are equal, and the consequences need to be weighed up against the effort of remembering passwords.

[1] Assume that you are forced to change password one per year, as my work proposes. If your password has been randomly compromised then the mean time to exploit it is 6 months. Just how long does a hacker need to have it to install a trojan and/or create another account for mischief?

So why bother unless there has just been a major breach and they KNOW that everything has to be reset?

49
0

Voteware source code review 'could lead to hacking'

Paul Crawford
Silver badge

@Fluffy Bunny

I would have though that hard coding the login credentials (as in SSH key, etc) to the source code would be a BLOODY STUPID thing to do. He asked for the code, not the cryptography keys. There are numerous open-source projects that don't get magically hacked because they are fully inspected by all.

And if, as you suggest, there are dozens of ways to break this then it is clearly not good enough for an important job such as vote-counting. At the very least it should have been subject to more than one security review by competent outfits and the result published after the flaws have been fixed (and not those with any ties to the supplier).

15
0

Delaware pair nabbed for getting saucy atop Mexican eatery

Paul Crawford
Silver badge

Re: At least...

Oh you just had to slip that one in...

3
0

NIST told to grow a pair and kick NSA to the curb

Paul Crawford
Silver badge

Re: Until key length equals...

Oh yes. And just how do you distribute said one-time pads securely to the world+dog for use?

That is the point of practical cryptography, to make stuff "secure enough" while still being practical to use from a key management and encoding/decoding effort point of view. If you run a web server with limited resources, you don't really relish everyone going to 16k key lengths for access to videos of cats, etc.

Even with 128 bit keys, if implemented properly and used by all, the effort of breaking it would overwhelm the TLAs. That is why they sought to get the private keys by other means. Of course, if targeted by a gov or major criminal organisation so a lot of resources can be target at only your messages then 128 bits is clearly not enough, but you need to put usage in to perspective.

3
1

YES: Scotland declares independence ... from the dot co dot uk empire

Paul Crawford
Silver badge

Re: Not an ISO 3166 code

Same country code most likely, just like USA & Canada do.

4
0
Paul Crawford
Silver badge
Unhappy

Re: re. " ... the chains of digital bondage"

Given the way the MSPs went ever further than the UK's "extreme porn" bill, then yes they will because a portion of them are small-minded petty Calvinists and a lot of rest think too much of the opinions of the Daily Fail and similar.

3
0

Hackers' delight: Hotel cyber-cafe, er, business centers, apparently – US Secret Service

Paul Crawford
Silver badge
FAIL

Eh? Only some?

"some business centre computers may have taken the safeguard of not allowing anyone to log in with Administrator rights"

I leave it as an exercise for El Reg readers to determine one of the key problems here.

1
0

Get an EYEFUL OF CURRY for the sake of your brain

Paul Crawford
Silver badge
Coat

Re: Turmeric's not a root ...

The root of all eyeful?

Mine has the book of bad puns in the pocket...

21
0

Adobe Flash: The most INSECURE program on a UK user's PC

Paul Crawford
Silver badge
Unhappy

Re: Isn't it great...

Still getting the "security" updates for version 11x on Linux using apt-get (Ubuntu) as they never supported anything later. Unless of course it is embedded in Chrome for Linux (with added Google spy-ware).

Adobe is such a crap company...

12
0

Thought PCs were in the toilet? They're STILL eating Apple's lunch

Paul Crawford
Silver badge

Profits?

How do Apple rank in terms of PC-based profits? I'm guessing that is a more useful measure if you are a shareholder.

3
3

Global protest calls for canning SOPA-by-stealth treaty's IP bits

Paul Crawford
Silver badge

Whether it makes a difference or not is largely irrelevant.

The simple fact that such profound policy-making is being negotiated in secret, save for industry pressure organisations, is an affront to democracy world-wide and for that reason alone it deserves to die.

11
0

Virgin Media goes titsup AGAIN. The cause? Yet MORE DNS strife

Paul Crawford
Silver badge
FAIL

DNS and "filtering"?

Any coincidence I got an email from them yesterday telling me I could enable the (largely pointless and broken) content filtering supposedly there to protect the children?

As for other comments, I was OK as I use the older modem-only device and my own router with OpenDNS.

This article might be of interest to the educated reader when wondering why the gov took such an about-turn on the merits (or lack of) filtering after their own consultation rejected it:

https://torrentfreak.com/the-copyright-lobby-absolutely-loves-child-pornography-110709/

11
0

Standby consumes MORE POWER THAN CANADA: IEA

Paul Crawford
Silver badge

Re: Heat

Yes & No.

Of course heat is the end product of all losses, but if you have a ~100W device on full power device that heats the touchable case by ~20C above ambient to dissipate said heat, you will hardly notice if it is down to 5W, 1W or 0.2W when on stand by without a lot of careful measurement as you would be looking at order of 1C or less.

5
0

That AMAZING Windows comeback: Wow – 0.5% growth in 2015

Paul Crawford
Silver badge

Re: @h4rm0ny

"ignoring the cause of these things - which are that XP has a far weaker security model than Vista onwards which is really what causes people and processes to need to be admin by default."

No, the problem is a legacy one that MS allowed, and in some cases encouraged, bad security practice so they ended up with an OS that could not be properly secured because the software for it assumed all sorts of privileges that were removed by Vista and later to make things better.

I have at least one package that I can't run on XP without admin, or on later, because it needs to modify registry keys (now secured) for f-all reason.

Do I change OS and pay ~£1k for the latest version (and also change code using it), or so I run XP in a VM just for that job?

Yes, Windows 7 is a whole lot better OS than XP, but that is not going to make up for the sort of business legacy that is the reason folk use Windows in the first place.

5
0

Report: UK.gov wants to legislate on comms data BEFORE next election

Paul Crawford
Silver badge

What is missing from such a statement is how old most of the useful data is. Do the police request data for 1 week before the reported/alleged criminal incident? 1 month? 3 months?

I think other EU states have a 6 month retention period which I suspect is more than enough for most cases, as a judge can always request an on-going recording of data on any that is an on-going investigation.

3
0

USA to insist on pre-flight mobe power probe

Paul Crawford
Silver badge

Do they still ask if you committed war crimes in 1939-45?

Did anyone ever confess?

2
0

You 'posted' a 'letter' with Outlook... No, NO, that's the MONITOR

Paul Crawford
Silver badge
Unhappy

Re: @AndrueC

Alas - fixing broken email clients is often the reason for the call :(

2
0

Qualcomm fires DMCA shotgun at alleged code thieves on GitHub – including itself

Paul Crawford
Silver badge

Re: "Presumed innocent until proved guilty"

Presumed innocent unless proved guilty.

An important distinction.

2
0

Austrian Tor exit relay operator guilty of ferrying child porn

Paul Crawford
Silver badge

Re: Great

Child porn is always a good way of silencing debate in a privacy issue. As is terrorism. Something governments are all to happy to use when promoting yet more invasive spying on our lives.

Please ignore the man behind the curtain.

39
2

Big Java security fixes on the way – but not so fast, Windows XP users

Paul Crawford
Silver badge

Upgrade to Vista?!

Too cruel a punishment for holding on to XP! Really, if upgrading go to 7 and do not pass TIFKAM.

Or, unless you really need it, uninstall Java. Most home users simply don't.

3
0

What do we want? CAT VIDEOS! How do we get them? TOR!

Paul Crawford
Silver badge

Re: "Only terrorists want privacy. Apparently."

And politicians. Often those who were fiddling their expense accounts...

6
0

Distributed Linux OS wizards CoreOS release first commercial product

Paul Crawford
Silver badge
FAIL

Re: What part of distributed did you not understand?

Maybe the bit when I said: "that might be part of the overall system design and fail-over strategy for cloud use"

Either way, you still have to migrate running jobs off a given machine/kernel in order to have it updated when traditional Linux could often be kept going.

0
0
Paul Crawford
Silver badge

Update all at once?

That makes sense for laptops, etc, which get powered up/down irregularly so having two root partitions that toggle once safely updated makes sense.

But for a main OS then every update means a reboot. OK, that might be part of the overall system design and fail-over strategy for cloud use, but you can say goodbye to updating just a broken library, etc, with the rest of the machine (or at least that kernel) and running processes keeping going.

0
0

Remaining Snowden docs will be released to avert 'unspecified US war' – ‪Cryptome‬

Paul Crawford
Silver badge

Re: @Matt Bryant

A number of folk had a good idea of what NSA & GCHQ were up to, but were labelled as tin-foil hat wearing nutters by the press in general. That label turned out to be wrong.

The same goes for the degree of cooperation between USA-based corporations and the NSA. True, they had little choice in most cases but they hardly bleated when being paid for services rendered, and only made a lot of noise now they are loosing business world-wide due to the distaste about the dragnet operations.

I certainly don't approve of the whole-sale release of information that puts informants lives at risk, but equally I can't see another way of persuading the public to notice what is done in their name, and with (some of) their taxes.

24
3
Paul Crawford
Silver badge

Re: Cryptome

The issue is not about releasing classified information for the hell of it.

It is about showing the public when they have been lied to by the leaders, or in a number of cases where the (majority) of leaders have, it appears, been lied to by the agencies that are supposed to be under their control.

Can you suggest a better route to defining what those agencies should be doing? So far our leaders have not been willing or able to, or are in favour of that but not telling us.

The success of democracy depends on an informed public, and if we are not being told honestly the magnitude and general nature of such activities, we are not able to exercise that right.

17
5
Paul Crawford
Silver badge

Reading too much in to it?

The reference to "war" might be nothing to do with real guns & bombs war but something related to silencing those who are doing the (fairly responsible) releasing so far. Recently Cryptome have been a bit paranoid about site access, etc, though maybe with good reason.

Time will tell.

13
2

Windows Server 2003 end of life: Plan your WS2012 migration now

Paul Crawford
Silver badge

Re: AC's

Sh! <quiet voice> It is the same one </quiet voice>

2
0

Attackers fling Stuxnet-style RATs at critical control software in EUROPE

Paul Crawford
Silver badge
FAIL

Lessons of history, etc...

Put stuff on internet, watch it get hacking attempts.

Put critical stuff on internet, use software that was developed historically for stand-alone use, find patching said system is a major PITA because the hardware etc out live the software development cycle time-scale, and watch it get hacked.

Again, and again.

7
0