Feeds

* Posts by Stuart Longland

996 posts • joined 11 Jan 2008

Page:

'Windows 9' LEAK: Microsoft's playing catchup with Linux

Stuart Longland
Silver badge

They were… Not sure about 10.4, but certainly 10.5.

As for Linux, it's been a feature of the window manager you use. FVWM has had virtual desktops for years, I remember them back in the late 90's.

It's nice to see Microsoft has finally acknowledged the usefulness of a feature that users of other platforms have enjoyed for decades.

14
0

DARPA-backed jetpack prototype built to make soldiers run faster

Stuart Longland
Silver badge

Re: Or...

You could just buy them a nice bicycle and not need fuel.

Not sure that'd work well in combat. This would probably be made as part of the backpack, and so all they have to do is turn it on. They don't have to run to the bike, jump on, and start pedalling.

Plus, the amount of gear they carry, I think the bike would soon start to fall to bits.

This bike goes through a pannier rack every 2000 km or so with a load of approximately 10kg. I had to replace the original wheels (pictured) with newer ones designed for downhill mountain-bike racing as I started popping rear wheel spokes at an alarming rate. Ohh, and I've managed to strip the thread in the bolt-holes for the pannier rack: I've had to make modifications and customised brackets to fit everything.

My take-off times are not stellar: I accelerate like a heavily laden semi-trailer.

Admittedly the military should be able to do better than the made-in-Taiwan stuff that I can get my hands on and a soldier should be a good bit fitter than I am, but I have my doubts about bicycles in this scenario.

2
1

Heavy VPN users are probably pirates, says BBC

Stuart Longland
Silver badge

Re: ... education programs to stop Australians pirating

I guess they like preaching to the choir.

"Ever had a video that wasn't quite right?" Yeah sure, the pirated one that lacked all the crappy promos and anti-piracy nonsense that no one cares about.

0
0
Stuart Longland
Silver badge

I should go to jail because the beeb thinks that's "suspicious"?

I move half a terabyte a month through VPN that is legitimate. It's part of being a journalist. I will sometimes get copies of VMs for analysis, or troves of e-mails...but I should go to jail because the beeb thinks that's "suspicious"?

I am not a lawyer, however I think the onus of proof should be on the BBC to prove beyond all reasonable doubt that you are pirating, not that you could be pirating.

After all, just because I was born with two hands does not mean I'm guilty of strangling someone to death.

24
2

It's a pain in the ASCII, so what can be done to make patching easier?

Stuart Longland
Silver badge

As another post pointed out (with the relevan Raymond Chen explanation), it was a design decision to forbid open files to be replaced in Windows because the risks were bigger than benefits (Windows and it applications usually heavily relies on shared libraries)

Actually, the problem is a concern over ABI changes breaking message passing between threads. This post references this Technet article which explains the problem quite clearly.

The problem is exacerbated by the fact that DLLs in Windows do not carry any version information in the file name (for historical reasons: DOS only supported 8-character file names), so a library is likely to get called something like "foo.dll" and an update would simply replace that file.

On a Unix-like system, it'd be called "libfoo.so.2", where the .2 is the ABI version number of libfoo. Thus allowing multiple parallel instances of the library. The application requests whichever version it was linked against, and so it's possible to have different applications linked against different versions.

Handling message passing ABIs is the developer's problem and in my observation, isn't a "problem" that occurs all that often.

1
0
Stuart Longland
Silver badge

Re: Windows.

You ALWAYS had an SP3 disk and ran that before connecting to the update server. Same thing for the Office SPs if you were dependent on them.

Ohh, and where do I download the Windows 7 Service Pack 2 installer from?

On Debian-based Linux distributions, if it downloads an update, you'll find it in /var/cache/apt/archives until it's cleaned up by a cron job (assuming the cron job exists). I can back that up before a re-install, then do a dpkg -i *.deb on the contents after install to get back the updates I had.

What's the Microsoft way of doing this without involving additional servers? I note the instructions for WSUS explicitly require some version of Windows Server. That's great for enterprise that uses it but what about home users? Are we expected to shoehorn a server version of Windows onto a laptop just so we can save time deploying fixes to the neighbour's computer when it needs a reload?

I'll admit I'm ignorant about some aspects of Windows as I rarely use it myself, however I'm unaware of any patch bundle released from Microsoft equivalent to the old service packs (that they no longer seem to produce) or is able to generate from the current published lists of service packs. At best you have to download each and every one separately, then you spend a good hour just double-clicking on .exe files to install them.

Bearing in mind of course, I've seen less need to rebuild a Linux box than a Windows one. There's a good reason I can still remember two Windows 95 OEM keys off-by-heart despite not having used the OS in over a decade. Windows has improved over the years of course, but sometimes things get so bent out of shape, the only option is to bulldoze the lot and rebuild.

2
1
Stuart Longland
Silver badge

Re: Linux no-reboot patching can be a mixed blessing.

Yep, more than once I've been bitten having got a machine up, left it running, then it's had to be rebooted and then needs hand-holding once more to get it working properly again.

My workplace's mail server (Zarafa atop Zentyal Small Business Server) is one in my care that comes to mind.

0
0

spɹɐʍʞɔɐB writing is spammers' new mail filter avoidance trick

Stuart Longland
Silver badge

How long did it take the Editor to write that title?

RC=0 stuartl@vk4msl-mb ~ $ hexdump \

-e '8/1 "%02x ""|"" "' \

-e '8/1 "%_p" "\n"' \

/tmp/title.txt

73 70 c9 b9 c9 90 ca 8d| sp......

ca 9e c9 94 c9 90 42 20| ......B

77 72 69 74 69 6e 67 20| writing

69 73 20 73 70 61 6d 6d| is spamm

65 72 73 27 20 6e 65 77| ers' new

20 6d 61 69 6c 20 66 69| mail fi

6c 74 65 72 20 61 76 6f| lter avo

69 64 61 6e 63 65 20 74| idance t

72 69 63 6b 0a | rick.

Very cute.

0
1

Moto 360 wristputer batt boob, elderly internals revealed in teardown

Stuart Longland
Silver badge

Re: Is it just me?

The image there is after they've removed the memory chip from on top of the processor, so presumably more extreme heating (i.e. desoldering) was required for that.

Ahh, forgot TI's love for stacking chips on top of each other. The blast of a hot air gun would be enough to dislodge neighbouring components.

This would explain a lot. I was looking at those components and thinking, How is this thing even operable? BGAs are fussy beasts when it comes to alignment and one chip looked way off as did the discrete components (not sure if they're caps or resistors).

0
0
Stuart Longland
Silver badge

Is it just me?

Or do some of the surface mount components to the right of the CPU look a little skewed?

Slap-dash PCB production much?

0
0

Mozilla certification revocation: 107,000 websites sunk by untrusted torpedo

Stuart Longland
Silver badge

Re: If you still use a 1024-bit RSA key such as PGP, it's time to start using ECC-based keys

I guess they downvoted because I mentioned OpenPGP which isn't TLS.

However, I'm pretty sure the older SSL stacks out there don't support ECC either. Yandex still uses SSLv3 for example. Does switching to an ECC-based certificate lock you out of their search engine?

1
1
Stuart Longland
Silver badge

If you still use a 1024-bit RSA key such as PGP, it's time to start using ECC-based keys

He added this recommendation: "If you still use a 1024-bit RSA key for any other purpose, such as a Secure Shell (SSH) or PGP, it is past time to consider those obsolete and start rolling out stronger keys, of at least 2048 bits, and using ECC-based keys where available"

Mmmm, hmm, and just how many open-source implementations are there for ECC OpenPGP? GnuPG 2.1 is still in development and is not ready for production.

I did experiment with it, I like having a reasonably secure key in a small space, specifically I was looking at it for AX.25. But it's still a fair way off.

2
1

OwnCloud: Fiddly but secure host-from-home sync 'n' share

Stuart Longland
Silver badge
Thumb Up

Re: Like it a lot.

I stumbled on OwnCloud (back in v5) when I went looking for a shared calendar/files solution. I help with my local branch of the Wireless Institute Civil Emergency Network here in Brisbane and we needed a way to keep track of upcoming emergency communications exercises.

When I saw OwnCloud, I immediately jumped to it. I run an instance on a server I control, and we're able to keep relevant forms, meeting minutes and upcoming events all together. Since I host it locally, it's also feasible to make some of it accessible via an AX.25 BBS for packet radio access.

Most have been able to figure it out and it works quite well on modest hardware. It would also work on shared hosting. For charity groups, I'd recommend it.

3
0

IT jargon is absolutely REAMED with sexual double-entendres

Stuart Longland
Silver badge

Re: Weak

I'm sure Alistair would happily refund double the money you paid him… all $0 of it.

0
0
Stuart Longland
Silver badge

Re: Deploying a build

It's not a sexual euphemism, but I always equate "deploying a build" to "having a poo"

That about sums up the quality of some software I've seen too…

1
0
Stuart Longland
Silver badge

Let us not forget about terms like

Floppy, and in some places, stiffy.

I'll just leave this here.

0
0

Finally, a USEFUL smart device: Intel boffins cook up gyro-magneto-'puter bike helmet

Stuart Longland
Silver badge

Nice idea, but…

- That microphone looks waay too far away to be useful if you're riding at any speed (it'll pick up too much wind noise)

- LED headlamp, good, but you can buy one that sticks on with velcro and will easily outperform the one they show there.

- Above-ear speakers: a plus is that they won't stop you hearing what's going on around you, how effective they'll be in traffic or at speed is another matter.

It has not escaped my observation that where I live, helmets that cover the ear (but still provide vent slots) are starting to become more popular, and I myself still prefer my motorcycle helmet even if it is a bit heavier.

I feel safer with something a little more rugged on my head. The option of brims that provide decent shade or visors for shielding against rain is something I've never seen on any bicycle helmet, and the fact it covers the ears means I can hear noises over the top of the wind noise that'd otherwise be whistling in my ear canals. It also makes embedding a headset easier.

My biggest concern though, helmets are effectively a consumable item, replaced every 5-10 years. Over time the memory foam becomes brittle and the helmet less effective. How easily is this electronic goodness transferred from one helmet to the other?

With mine: the visors are just a standard 3-stud attachment. The headset speakers attach with velcro. The headset microphone is simply wedged into one side. The headlight is simply held on by 8 velcro dots. Helmet need replacing? No problem, walk into any motorcycle shop, hand over $50, transfer the bits over, dump old helmet in nearest bin.

This looks like it's one very expensive monolithic lump. I'd personally like to see bicycle helmets become more modular, perhaps with studs/velcro patches to allow these items to be attached/detached by the end user at will. The studs of course for exterior accessories like lights, headsets, visors, cameras, rear vision mirrors, etc, and velcro patches for interior sensors.

Then a project like this, which has some good ideas, becomes feasible, as it's just bolt-on accessories onto an existing helmet that is bought cheaply and easily replaced.

0
0

Rubbish WPS config sees WiFi router keys popped in seconds

Stuart Longland
Silver badge

However if you have 150Meg + internet speeds most routers struggle to keep up (especially once you want more advanced options like traffic shaping), thats why I now use dd-wrt for wireless access points, site to site bridges and cat5 wireless clients and then a low power x64 atom box running pf sense for gateways where ever possible.

Personally, that's a problem I'd love to have. Unfortunately moving isn't an option, and nor is broadband faster than 20Mbps ADSL2+.

0
0

Bright lights, affordable motor: Ford puts LED headlights onto Mondeo

Stuart Longland
Silver badge

Re: Infrared driving?

Good ideas, BUT… I, as a pedestrian, cyclist or motorcyclist, must be able to see YOU.

So you will need at least some lights on, and I'd suggest the headlights presently used on vehicles would be a good option.

"VIDAR" as you call it might be doable in a car, but it's going to be clumbersome to achieve with a motorcycle helmet, and practically impossible for cyclists and pedestrians, who do need to be able to see your car coming when crossing roads.

0
0
Stuart Longland
Silver badge

Re: Meanwhile, laser light appears

Oh gawd, retina-searing xenon lights were bad enough, the last thing we need is a BMW with lasers mounted on the front.

A "beamer" in more ways than one?

6
0

Ice cream headache as black hat hacks sack Dairy Queen

Stuart Longland
Silver badge

Re: Is it just me…

I am seriously thinking of doing any payments in shops with cash ONLY!

Until very recently, I did not have a debit card. I have a prepaid one issued by the local post office which I've now used exactly 3 times, for purchasing items from online stores (two here in Australia, one in the UK). I reload it by taking cash to the post office and presenting the card to be reloaded. The only way I get cash out, is to go visit my bank branch and present my passbook.

The card gets used when no other payment options exist: my preference is to do cash, BPay direct deposit, or use this debit card; in that order.

2
0
Stuart Longland
Silver badge
Facepalm

Is it just me…

or is someone else asking: "Who on earth uses anything other than cash to buy low-cost items like icecreams?"

If someone was going to spend more than $50 at a place, fine, bring out the plastic, but otherwise it's needlessly overcomplicating a process.

Maybe I'm just old fashioned and distrust modern finance systems too much.

7
2

Boffins attempt to prove the UNIVERSE IS JUST A HOLOGRAM

Stuart Longland
Silver badge

Re: Look at the BIOS

I don't suppose the universe is designed for multiple reboots. Let's hope we can avoid BSOD here...

It predates Microsoft, so we should be safe.

2
0
Stuart Longland
Silver badge

Re: Sub-heads

El Reg was over Galileo like a flyvulture on a carcass. And it smells wonderful.

Fixed that for you.

15
0

It's time for PGP to die, says ... no, not the NSA – a US crypto prof

Stuart Longland
Silver badge

Re: Business cards??

Because the keys are too big to put on even 2D barcodes (even I suspect the color barcodes once touted by Microsoft).

In the interests of science, I tried it anyway.

You can do it with 2 QR codes. I used ZFEC to encode it into 4 QR codes, so you can scan any two and get my public key.

ZFEC is available at https://tahoe-lafs.org/trac/zfec/

The monstrosity looks like this: http://www.longlandclan.yi.org/~stuartl/pubkey.png

How it was generated:

$ gpg -o /tmp/pubkey.gpg --export 4DFA191410BDE3B7

$ zfec -m 4 -k 2 pubkey.gpg

$ for f in pubkey.gpg.?_?.fec; do qrencode -o $f.png -8 < $f; pngtopnm < $f.png > $f.pnm; done

$ pnmcat -lr pubkey.gpg.[01]_4.fec.pnm > pubkey.gpg.top.pnm

$ pnmcat -lr pubkey.gpg.[23]_4.fec.pnm > pubkey.gpg.bot.pnm

$ pnmcat -tb pubkey.gpg.top.pnm pubkey.gpg.bot.pnm > pubkey.pnm

$ pnmtopng < pubkey.pnm > pubkey.png

Note this will not fit on a business card unless you have a very high resolution scanner and printer available.

0
0
Stuart Longland
Silver badge

I dunno

There's a certain beauty in seeing a PGP signature on the end of an email I suppose… :-)

If only because it's so rarely seen.

0
0
Stuart Longland
Silver badge

Re: He's right! PGP sucks to use!

You can use it to encrypt a message to send via just about any medium. And you can verify that security independently of the infrastructure you used to communicate.

As soon as you start to build a monolithic "secure" system you lose that independence, which is a big loss.

Indeed, OpenPGP doesn't care what the underlying medium is. Carrier pidgeon, sneakernet, UUCP, SMTP, HTTP, AX.25… you name it, if it can carry Base64 reliably, it can carry OpenPGP reliably. The other bonus over SMTP/TLS is that this is end-to-end, whereas SMTP using TLS is only between hosts.

0
0
Stuart Longland
Silver badge

Re: He's right! PGP sucks to use!

Maybe Google, Yahoo, and MS could setup some sort of free public storage for certs from which people could download keys, maybe not.

Like this?

0
0
Stuart Longland
Silver badge

Re: PGP is like Democracy ...

The open source part is WHY the thing is trusted

since no open source cryptography project has ever had major security issues...

True, but at least in the open source world when the problem is found (and it still can take time), it's impossible to sweep under a rug… a company can just stick its fingers in its ears and yell "La la la la!"

There are probably equally heinous bugs that rival HeartBleed in commercial software that will never be fixed. We'll not know what they are because it's in the companies' interest to keep it all hush hush.

14
1

NBN Co claims 96 mbps download speeds for FTTN trial

Stuart Longland
Silver badge
Headmaster

Only 96mbps?

Call me when they can send faster than I can operate a morse code paddle.

I don't care for a data link that runs so slow I can watch each bit cruise past on the oscilloscope at the blistering pace of almost one bit every 10 seconds.

0
0
Stuart Longland
Silver badge
Coat

Re: Yes.

A spherical pirated TV show in a vacuum? (This is Australia.)

Yes, because live TV sucks all around…

1
0

BOFH: We CAN do that with a Raspberry Pi, but think of the BODIES

Stuart Longland
Silver badge

I'm surprised he didn't take the malware angle…

"Ohh, I'm sorry, it seems someone brought an infected USB stick onto the network and so now our security lights are infected with the Saturday Night Fever virus."

Meanwhile a shell script runs:

#!/bin/sh

while true; do

echo $(( ${RANDOM} % 2 )) > /sys/class/gpio/gpio123/state

sleep ${RANDOM} % 5

done

5
0

Your Bitcoins aren't money – but it is barter, so we'll tax it, ta ... says Australia's taxman

Stuart Longland
Silver badge

A fair cop

At least they haven't made it illegal… we'd be living in lala land if we thought it wasn't going to be taxed somehow.

3
0

Intel's Raspberry Pi rival Galileo can now run Windows

Stuart Longland
Silver badge

Re: Windows fans?

x86 gets hot.

Fans required.

My Pentium Overdrive chip begs to differ…

0
0
Stuart Longland
Silver badge

Re: Single-threat?

Meh… high power consumption (compared with AVR), slow boot-up time, sluggish storage… I wouldn't say this is any threat to the Arduino market, or the related Raspberry Pi market.

12
0
Stuart Longland
Silver badge

Re: Its no Rasberry Pi

But it's got an x86. And now it can run Windows. Please show it some love.

Even more reason to stick with the Raspberry Pi and Linux. A full-blooded desktop PC slows down enough after a year's usage. I can't imagine how agonisingly slow this thing will run with an SD card for storage.

7
2

Microsoft Azure goes TITSUP (Total Inability To Support Usual Performance)

Stuart Longland
Silver badge
Headmaster

Re: office 360?

Evidently for you, it's been down 5 days in the last year…

1
0
Stuart Longland
Silver badge
Thumb Up

Total Inability To Support Usual Performance (TITSUP)

LOL Love it.

May I have permission to officially use this acronym when describing issues to our company's customers?

39
0

The Return of BSOD: Does ANYONE trust Microsoft patches?

Stuart Longland
Silver badge

Easier said than done.

On Debian Linux it's as simple as ensuring you've got SSH public keys installed in /root/.ssh/authorized_keys then doing:

for host in host1 host2 host3 … hostN; do

ssh root@${host} apt-get install offendingpackage=version

done

Red Hat isn't much different. And of course, there are tools like puppet, chef or Ansible that will automate a lot of that.

Windows has an equivalent, but I think it needs the higher end versions of Windows Server to manage it all. If you're a small business with a Windows NT domain controller (or Samba equivalent), you're stuffed.

2
0
Stuart Longland
Silver badge

Re: 20th century

So many hardware companies send out buggy "It runs, so ship it" drivers. Drivers clearly not fully following the correct rules in the MS manuals. Then add in the whole rafts of extra weird apps theses same hardware manufacturers throw into the Startup as services or sitting down by the clock in the Task Tray.

Then the OEMs take this, and pour in some proprietary code of their own into the proverbial proprietary soup.

Then there's what we need to get a job done.

Naturally, companies don't test with their competitors' software, they'd rather you just used their own rather than their competitors' programs. So if there's a clash, there's no incentive to assist you with it. A good example of this is VPN clients. Too bad if you need both to get a job done; i.e. company A likes VPN solution X, company B likes VPN solution Y and company C likes VPN solution Z.

Being a systems integrator, we're stuck with having these potentially conflicting VPN clients, which also battle Kaspersky, VirtualBox and in some cases VMWare Player and Microsoft VirtualPC, for control of the host's networking stack.

I look at Windows and wonder how anything works … My work-supplied laptop, a Dell Vostro, dual-booting Windows and Ubuntu Linux, has seen the odd BSOD on Windows 7.

It's been fine in Linux however, has has my own personal Panasonic Toughbook which dual boots Gentoo Linux and Windows 7. I don't use my own machine in Windows often enough to see BSODs, so I can't comment much there.

5
0

Detroit losing MILLIONS because it buys CHEAP BATTERIES – report

Stuart Longland
Silver badge
Coat

Re: Only a complete idiot...

That the thing is running off 9V and fades suggests it is running from a linear regulator which is turning most of the battery energy into heat rather than useful work.

It's doing useful work… it's warmth is keeping the battery from freezing up!

2
0

Time to ditch HTTP – govt malware injection kit thrust into spotlight

Stuart Longland
Silver badge

Re: Cheaper than HTTPS?

I just thought of a partial solution. For static content only simply put a SHA value in the URL fragment. The fragment would need to follow a predefined format so browsers know what it is and means. The returning file is hashed and compared, if it differs then reject it.

Yeeessss, but that SHA value will need to be followed by a digital signature of it. Any old goose can feed their modified page through sha1sum (or whatever tool you use) and fill in that value with their own replacement.

I thought of something similar over the weekend, but I came to the realisation that it will only work for fairly small files, as the client has to receive the entire file before it can begin verification. This isn't a problem for small things like logos, stylesheets and JavaScript. May not be a problem for the page content either.

However, for any streamed content it's a no-go, and you can forget being able to view a photo before it's fully downloaded.

0
0
Stuart Longland
Silver badge

Re: Cheaper than HTTPS?

Not if the browser is expecting to see a signature… Current HTTP/TLS implementations do support using HTTPS with a NULL cipher, so it's in theory, possible.

The trick would be telling the server when to serve up a page using a strong cipher, and when to serve up a page with the NULL "cipher". The browser will see https:// in the URL and begin TLS negotiation, so filtering out the signature there isn't going to work.

Sure your private email text might warrant encryption (the provider won't know how sensitive it is before they send it to you) but the JavaScript, stylesheets and logos: cryptographic verification should be good enough.

This still leaves the issue of trusting the TLS certificate in the first place… sure you could embed a fingerprint in DNS, but crims can poison that too.

0
0

Google's so smart it's discovered SHARKS HAVE TEETH

Stuart Longland
Silver badge
Coat

Shark bites, that's what we thought of when people talked about "terabytes" back in my day!

2
0

The internet just BROKE under its own weight – we explain how

Stuart Longland
Silver badge

Re: Thoughts from a mere user ...

Indeed. Name a Linux-based router that supposedly does NAT but not firewalling… In the Linux kernel, and this has been the case since kernel 2.4 days and possibly earlier, netfilter is responsible for all packet filtering and NAT.

Both come under the same subsystem. Just because they don't expose knobs and dials for you to tweak does not mean the feature is absent from the device.

2
0
Stuart Longland
Silver badge

Re: You don't need NAT for IPv6

But it is not a firewall.

It might be implemented by a firewall - that's how I do the NAT between two of my networks - but that doesn't make it a firewall; a firewall does many things besides NAT that may well not be implemented by a NAT box.

Not a firewall? So then if I gain control to the system at the other end of your WAN link I can just do a:

route add -net ${yournet}/${yourprefix} gw ${yourip}

and just keep playing with the ${yournet} bit until I hit paydirt?

No. Any NAT router worth its weight will do at least some firewalling, such as permitting only packets from existing connections inbound. If it doesn't, take it back to the place of purchase as it is unfit for purpose and a security liability.

3
0

Password manager LastPass goes titsup: Users LOCKED OUT

Stuart Longland
Silver badge

Re: I solved this a while ago:

I did see this some time back.

I just use a purely software solution on my laptop: GnuPG.

0
0

Canadian ISP Shaw falls over with 'routing' sickness

Stuart Longland
Silver badge

Re: Ugh. Best of luck to all concerned

Network down? Surely you jest… networks don't go down!

3
0

Tech city types developing 'Google Glass for the blind' app

Stuart Longland
Silver badge

It may be something the government subsidises.

If enabling blind people to get out and more easily and independently get around means they can more effectively hold down a job, then this will help fund the service being subsidised.

I just find it a little sad that we can't trust a passer-by to provide the information this fellow is racking up phone bills for. Blindness usually isn't a big impediment to conversing with people, not compared to say, deaf/mute, and I would have thought most people could be trusted to get basic facts right.

0
0

Japanese boffins invent 4.4 TREEELLION frames per second camera

Stuart Longland
Silver badge

Now you really can watch grass grow, paint dry and lattice vibrational waves waving…

… and a politician with his mouth shut!

2
0

Page: