Fuzzing tools - throw all sorts of sh*t at the program until it breaks then take a look at what the breakage reveals.
2763 posts • joined 15 Mar 2007
Lets face it MS should have spent the last 15+ years fixing the damned thing (and not supporting main stream languages like Arabic and Hebrew is a bug to me, not a "feature request"). What did they do? Piss around with the the ribbon, and generally make most versions shittier than before.
Only recently I found that equations pasted from Windows version of Word to Powerpoint won't work on Mac Powerpoint. And MS fans bitch about LibreOffice not being "compatible", etc?
A pox on them all! May the fleas of a thousand camels infest their groins!
I found I got a better sound out of the drill, but that is just be. not so much "musically challenged" as musically defeated.
IP then domain authentication?
Given the privacy implications of ISPs storing domain names, and some servers front many domains so you usually can't get away with the IP number alone, what about having two layers?
The first is a certificate, etc, for the numeric IP address so you know the URL will be secured, and the second is the same sort of thing for the URL to authenticate that the domain name matches. That way all a snooping ISP can see is the numeric request, such as 220.127.116.11, and nothing more personal such as www.theregister.co.uk
Assuming El Reg gets round to security at some point...
Re: One thing I don't understand is, why?
"That's partly because embedded hardware designers have no clue whatsoever about programming languages."
I don't think so. It seems to be down to (usually) having only one choice of tool, that blessed by the FPGA supplier, and they have little incentive to do any better. I really hope you are right and programmable hardware accelerators become popular enough to have multiple vendors competing to supply the tools, but I double it will come soon.
Re: One thing I don't understand is, why?
As someone else pointed out, for things like software-defined radio where you need lots of small integer-like operations performed essentially in parallel to process the signal as it is shifted in frequency and sample-rate. Those steps can be implemented in dedicated chips, but there are only few of them off the shelf and often not quite what you wanted. So being able to push the "simple but massively parallel" tasks to FPGA and keep the "complex but slow" stuff on the CPU makes sense.
Except that programming tools for FPGAs suck donkey balls big-time. Really, you think that developing for C is a pain, just try VHDL with tools that lack any sort of usable context-sensitive help for the vast number of uber-pedantic problems you will encounter. And weep....
Much as I hate to say...
...the Russians have a point. Almost exactly the same point as the past MS anti-trust investigators found with the bundling of IE and similar on Windows to leverage the near-monopoly that MS had with OEM deals for Windows at a "competitive price" on the hardware.
Of course the US investigation folded before anything useful was done (you know, like breaking MS in to separate OS & apps companies to compete openly, a la MySQL now...) and the EU took ages to pick that up and it was all to little and too late.
Will Russia have enough clout to force Android licensing and app compatibility to be free of Google's slurping? OK Yandex slurping maybe not be much better, but choice is kind of a good thing.
Re: Security helpful...?
"ask yourself whether you'd break down the door of your secure data store to rescue the guy inside in the event of a fire"
Depends, did you set the fire?
Re: Improve PC Specs
Or maybe some laptops with better displays for other than DVD watching, you know like Google pixel, etc?
Re: My next machine will be a desktop.
But more, much more than that, you can have a screen that is better that "HD", or the sub-HD pish the push for most laptops under £500 or so, and more like the resolution a good CRTs could manage around y2k
Re: why the difference in how they're treated?
Oh let me guess - because it involves real property and real money?
Or because your bank is not going to post/share your details pretty much publicly with stalkers, ex's, and friends-of-friends you would not wish to ever meet again?
Re: "Law can't defy science."
The UK tried "evidence based policy" on the risks of drugs in society but found it did not tell them what they wanted (or more accurately, what the tabloid papers were pushing). Dr David Nutt was in charge and knows his stuff (you know, life time of research, etc), but that counted for nothing ultimately:
The original complaint was if you searched for a given person's name, the page it found was for some sort old page showing court action of many years previously. Why can't google deal with this personal privacy by using an algorithm that simply limits the time of a search if it is a personal name, and no other details (e.g. the name of the court, etc)?
That way if you are looking for a specific case, you still find it, but if you are simply trawling (or trolling) for dirt on someone then old sins are quietly forgotten.
Re: No - it's binary
No, its not exactly binary. True, if you make software vulnerable then suddenly everyone's phone and tablet can be accessed, probably remotely, and with very low cost or discoverability. That will open the doors to more abuse of such powers in exactly the same way the NSA, GCHQ, etc, decide that spying on all of us "just in case" was OK.
What if the key could be accessed by physical forensics, e.g. by grinding the top off a chip and using an electron microscope to read it out? Bingo! The law can access the phone if it is important enough but the time and cost, along with the need to basically destroy the phone physically, means it can't be massively abused in the way a permanent backdoor (key escrow) or software bypass (as the FBI are currently requesting) can be.
Re: Independent backups
And if the Linux admin's password or SSH key is leaked?
This problem is not OS-specific, though most victims so far have been Windows users. The solution is, equally, not an OS choice (even if it helps the odds) but having some arrangement that when the admin's key is leaked it is not enough to trash everything.
This means probably multiple keys for different areas of a system, but more importantly (in my humble view) that you have something else, something physical or fundamental to a bit of hardware design, that prevents trashing of all backups along with the primary data.
Having different roles/accounts for backing-up separate "root/admin" is a start. But you have to start with the assumption that someone has got complete control of the victim machines and so can undo any permissions on those machines.
Trey Gowdy is probably right, but for all the wrong reasons.
The problem I see with the FBI's request, and indeed most of the debate, is about the ability to bypass encryption with software. Quick, easy, and something that can probably be used remotely as well (if it can be a forced "upgrade" with Apple's signature) on any phone they can get an IP address for. That opens a floodgate of possible abuse not just by the FBI but every police and intelligence agency world-wide.
But what if they only way was a physical forensics approach? So you have to de-solder the encryption chip, grind off its packaging, and use an electron microscope to read out the key? That is analogous to an autopsy and the removal of bullets for evidence. It is not quick or cheap, and certainly not possible remotely. That would bring some parity in the argument where safes, bank deposit boxes, etc, are being compared to encrypted contents.
Re: Maybe we could combine ?
"Or they could literally be sending probes to every system and take a local
gander red-neck behind the bushes with some lube."
Fixed it for you...
All 3 points come down to one basically: We, as people, have accepted piss-poor security in so many computer applications for years, but now we have put important stuff within an electronic arm's reach of world+dog to have a go if they feel like it.
The current arguments about cryptography for law enforcement, etc, is a stupid distraction flamed by clueless politicians and civil servants and distracts from the above. We have found ways of catching and prosecuting criminals when they talked in person and did not write stuff down for many many years, so while it might be nice to get phone contents, it should not be necessary.
Sadly we need to start making a big deal about businesses and gov departments that expose important stuff (from personnel/medical records, through to infrastructure like power and gas) to the world, and/or collect sensitive stuff they don't really need. Make damn sure that those in charge can face personal prosecution if they fail to manage the process, fail to have a system in place to check and fix things, and fail to get outside support to check its good enough.
Re: : in a path name ?
Actually most *nix systems allow any character in directories or file names except '/' (the directory separator) and the NUL 0x00 used for C end-of-string.
It is the command shell like bash, etc, that treats ':' and '*' and so on as special, and also it is the shell that treats a space as a command delimiter as well, unless you quote or escape-sequence the name. E.g. this wont work
cd my directory
As it treats 'my' and 'directory' as separate inputs, but these do work:
cd "my directory"
cd my\ directory
Since they tell the command shell to treat the space as part of a single string passed to the 'cd' command. Windows has similar problems with command-line use, it is just that few people use it or write scripts for it to complain as much.
Re: win32? in 2016? really???
Stupid enough to want your software to run on W2K - XP - Vista (cough) - Win7 - etc rather than the latest privacy slurping version only?
And not finding your latest API is pulled from below you if MS decides to change again (how is that Silverlight project going)?
MS has a lot of stupid past decisions to support, and practically the only real argument for choosing Windows has been compatibility with the vast range of so-called legacy software, so sad though it may be, this is still important work. Of course, MS could just open-source the legacy path code so we can see for sure and save this reverse engineering trouble and uncertainty...
Re: 10Gb to the home?
You seem to forget this is 14 years from now. 14 years ago 1Gbit was a dream for most, and now all PC motherboards come with GBit ports, and a lot of home routers are Gbit.
Oh yes, sorry forgot about laptops even with £1k price tags with no Ethernet and relying on WiFi that struggles to get 10Mbit on a good day in a built-up area...
Re: Does this signal a change?
Maybe, but most business see taking sane precautions as an unnecessary expense. Until they get well and truly shafted, that is, and then it was "a bad boy did it and ran away!"
No last minute reprieve there then!
They might be able to disarm the warhead in flight, or possibly change the target coordinates even. That would make a big difference to the outcome...
Re: Dumb idea?
So why do they keep telling us that reliable communication systems are essential?
Its almost like they are dependent on vast server farms somewhere, and don't quite want to say so...
computer-aided driving will depend on "upgraded communication systems that provide higher performance levels in terms of latency, throughput and reliability of the network"
Really? So what will said self-driving car do when it ventures on to one of the many rural areas that is lucky to get GPRS on a good day? Or if, say, there is another GPS blip that takes out comms networks?
Self-driving cars need to be able to deal with other vehicles that are not on the network, due to faults or them still being driven by meat bags, so reliance on communications of any sort is a really dumb idea.
Unless you have more *recent* news?
Just like we should believe that WhatsApp is not backdoored by the NSA?
Chose your messaging system based on (a) how public the code / analysis / review is, or more likely (b) on who is most likely to be interested in screwing you over for personal reasons.
You have identified two problems with the example:
1) The comments / "documentation" is misleading, that is not what it is testing!
2) The code is a convoluted way of trying to express what (I believe) is being tested.
Better would be something an is_data_null() test to see if pointer is null or empty or 'blank' string, then to return if alpha fails this "null" test but omega passes it.
"In order to comply with this order, Apple need to build software to work on a particular IMEI and S/N of this phone"
Fixed it for you.
Next week its a new IMEI and S/N, week after a few dozen more... Come Xmas holidays Apple are being told by the courts to avoid excess costs and just do a tool for to gov that handles every confiscated phone in the USA. Meanwhile in Russia and China they are lining up for the same service...
Re: It was Professor Plum in the dining room with the lead pipe.
No! It was Miss Scarlet, in the basement, with a strapon...
Re: the upside
From your link about the Reeperbahn:
"The hottest clubs on the Reeperbahn and Hamburger Berg open, with Irish pubs and Hans-Albers-Platz packed full of live music."
Really, no one goes to German pubs in Germany?
Re: Inferring a bit too far
"Shouldn’t a web page get to the user just as the originator intended?"
Er, did the creator of the page also create the adverts? Or are they a parasitic aspect that is relied upon to pay bills?
That is a BIG difference in the net neutrality stakes - one is allowing the end user to choose what they want without interference, the other is allowing the web hosting to push whatever they want without interference.
Andrew is right in one respect though: it is high time that funding of content was properly considered and not left to the cesspool of advertisings.
There is more to this than simply the goal of 3 to get additional payments (the "fighting net neutrality in the advertising space") as mobile networks are generally congested and if they can cut bandwidth use for *everyone* by around 30% or more due to blocking bloated ads, then it will help end users a lot.
While I have no sympathy for advertisers due to the highly intrusive and resource-hogging sh*t they push, I do have reservations about what this will mean long-term for equal access if only the big hosts can pay to push their sh*t.
Sounds like a BOFH story :)
"If you are logged in as a domain administrator and you get hit by ransomware"
You should seriously be considering a change of job?
Re: Just setup a few Surface Pro 4
Sure that helps. But you should not have to do any of that for a stable and privacy-respecting machine.
Re: @national security purposes
Its far worse that "any bollocks we chose to call national security" because its any bollocks another government, for whom we have no democratic input to, chooses to call national security.
That is a big point - while I have serious doubts about the integrity of my own government, at least I have a vote in the matter. Far from perfect, but something others have fought and died for.
I presume? I guess they wanted something that would know what svchost.exe was up to....
Using XP if fine so long as you don't have it on the Internet. So run old software in a VM of XP if you want, but as you say - not for internet banking, remotely accessible SCADA, etc.
Re: This is wishful thinking
If you read the slashdot article you see why - the limit on brute force is largely in the crypto chip. The key used for the data is massive - 256 bits symmetric AES - and is largely revealed by the crypto chip on success, so its not a 4-6 digit PIN worth of tries. So the options are:
1) Brute-forcing a 256-bit key, possible with NSA resources I guess, but a serious challenge.
2) Somehow compromising the crypto chip. How hard that is depends on its design, maybe it can be done as sloppy mistakes, or maybe it really is properly tamper-proof and then Apple's position is 100% correct - it simply can't do it.
Re: Humans gone
Unless your goat has WiFi its not a problem...
Re: anything so modern as fortran 77?
Converting FORTRAN IV from https://celestrak.com/NORAD/documentation/spacetrk.pdf in to C was not much fun, but sadly it was necessary to have any sane way forward. Start with f2c conversion, spend time sorting out the weird functions it used to make Fortran-like calls (i.e. by reference) instead of C-like (usually by-value) and finally work out how to restructure to code so it looked sane and still worked.
Oh, and a subroutine with multiple ENTRY points also had to be converted, but thankfully it was just a dodgy way of having shared auto-allocated (implicit declaration & typing) variables. Anyone writing Fortran without "implicit none" deserves a serious slapping!
Needed oh so much =>
Re: Really a GIT
Where was the GIT repository, as surely you did not have just one copy?
And the machine's backups?
Re: @x 7
The Circus of Horrors is a good show - can highly recommend it. Not just for the dwarf & Henry, but all do a good and amusing job of entertaining!
Re: I'll bet the fireman didn't get the title "Lord of the Rings"
Did he use a King Dick spanner, that is the question we all want to know:
Re: @Graham Marsden
That, sir, is most definitely NSFW!
Pro tip - set your browser to always open a single tab on your safe home page. Today I had an accidental viewing of your link on opening Firefox, they must think I am a part-time gimp now...
Step 1 done
Big kudos for having detected gravity waves - that is awesome science.
But...no one has yet established they travel at the speed of light. Establishing THAT would be pretty conclusive proof of the theory. Any other speed opens a new can of space-time worms...
"You should see the amount of data being used by these kids,"
Translation - they discovered on-line pr0n
Re: Firefox, meet Opera
Have an up-vote sir!
Firefox need to be *different* from Chrome and better in a way that users appreciate, things like:
1) Not sucking. Seriously, try to keep memory use, etc, under control.
2) Value privacy. This might mean returning 'anonymous' browser info so everyone's installation looks largely the same (maybe just info that might be needed by the web site or useful for stats, such as major browser and OS versions, something like ~3 bits entropy)
3) Value privacy. For the hard of thinking, again, think! Do stuff like small dither to drawing so browser fingerprinting (like canvas draw / hash) is different *every* time they test on the same machine.
4) Respect the user's wishes. So offer the ability for all audio/video and animated images to be "click to play". I do not want web sites to start stuff in adverts, etc, and waste my bandwidth an patience. If its worth it, *I* will chose to play it.
5) Allow legacy plug-ins on demand. Sure they are not secure but there is a shed load of stuff out there that might be wanted. Make it default-off, of course, but still give me the *choice*.
6) Don't dick around with the GUI for no bloody good reason.