* Posts by Chris Miller

3550 publicly visible posts • joined 6 Apr 2007

Oracle sues Google over Java in Android

Chris Miller
Thumb Up

Fight, fight!

Cue "my lawyer's more expensive than your lawyer" battle - is it very wrong of me to hope that both sides lose?

Opens giant economy tub of popcorn and settles back in seat.

NTLM authentication: still broken after all these years

Chris Miller
Headmaster

Very true

I entirely agree, Henry - though my inner pedant can't help pointing out that it's actually late '80s tech (OS/2 appeared in 1987, NT Server in 1993).

The problem is that (in many cases) simply turning off NTLM may break legacy apps. It's basically the same issue that has people trapped using IE6 - they may well know that there's a massive security issue, but can't get the (very much non-trivial) costs past the bean-counters.

Oracle hates discs, loves tape

Chris Miller

Very good

Now offsite your data (and no-one better mention the c**** word).

iPhone users get more sex than Android fans

Chris Miller
Heart

Hardly surprising

It has the word 'sex' in the title, after all.

Chris Miller
Thumb Down

Where to start?

I realise that this is just some marketing puffery for an Internet dating site and not some peer-reviewed sociological research, but even so ...

1) This is based on users of said site, hardly a representative sample.

2) The headline should read: iPhone users (claim to) have more sexual *partners* - which may or may not equate to more sex.

3) And is based on number of partners by age 30 - whereas ownership of an iPhone can't possibly have extended over more than 3 years, and given the rate at which sales have been increasing, I'd guess the average is more like 12 months.

The only remarkable thing is that women are reporting more sexual partners than men, whereas almost every serious study shows the reverse result. Possibly this indicates tat the women who sign up for such sites are even more weird than the men that do ...

'Climategate' university to open up data

Chris Miller
FAIL

How to save £600,000

In the spirit of our straitened economic times, I offer this free suggestion:

1) ZIP all the files

2) Post the output on Wikileaks

Oh, wait ...

Attack reads smudges to retrieve Android password patterns

Chris Miller

Very similar attack

To those against keypad entry systems. Simply check which keys show the greatest wear and then try all possible combinations (usually about 30 keystrokes). This works >80% of the time in my experience.

BBC workers lose £240k of tech gear in two years

Chris Miller
Headmaster

Why not?

Because it would:

a) cost an arm and a leg; and/or

b) come with a whopping great excess (>> cost of a phone or laptop).

First rule of insurance - never insure against any loss that you can afford to cover yourself.

Chris Miller

Not unreasonable number

Given a fleet of several thousand laptops, many of them in locations that have a higher risk factor than the UK. The surprising thing is that fewer mobiles than laptops were reported lost, when I would expect to see a higher number (more of them and easier to misplace).

UK.gov finally kills ContactPoint

Chris Miller
Unhappy

Spotted the typo

"Over a quarter of a billion pounds of public money has been dispensed on a non-project", should read quarter of a million pounds.

Shouldn't it?

Defcon speaker calls IPv6 a 'security nightmare'

Chris Miller

@Nathan

It's true there are nearly 6,000 RFCs for IPv4 - that in itself might be a pretty good argument for moving to IPv6 - but 99% of them are either obsolete or relate to subprotocols that are so obscure that you're unlikely to have heard of them, let alone seen them in operation (I certainly haven't). It sounds like your beef is with the selection of defaults by manufacturers - which I agree is woeful, particularly in the domestic market where end users can't be expected to have much security awareness.

I'd love to see a "secure by design" set of protocols, can I get a "secure by design" operating system on which to run them, as well? I am reminded of the wise words of St Bruce of Schneier: "If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology."

Chris Miller

Read the article again

In many respects, IPv6 is significantly more secure than IPv4. The problem (as ever) will be with people implementing it before they're ready and when they don't fully understand the implications of what they're doing.

Solar plasma aurora storm to hit Earth tomorrow today!

Chris Miller
Alien

Sorry to be a pain

It's my day for being a bit dim - good you point me to the reference.

Thanks (and apologies to those not Niven fans for whom this must be rather tedious).

Chris Miller

Inversion currently under way

At least, that's the opinion of quite a few geomagneticians (if there isn't such a word, there is now!) Certainly the magnetic poles are wandering rather drunkenly around the polar regions, which may or may not be typical behaviour.

But, as LC points out, nothing to lie awake at night worrying about. BTW the solar cycle is just under 11 years - 21 years if you allow for the need to go from N/S to S/N orientation and then back again. But, as the latest cycle demonstrates, it's not quite as regular as it might be.

Chris Miller
Thumb Up

Larry rules!

But are you thinking of 'Inconstant Moon', perchance?

Chris Miller
Thumb Up

when did that happen?

Soon, baby!

Social-engineering contest reveals secret BP info

Chris Miller
Thumb Up

CLI

I didn't mean this to turn into a CLI discussion - my main point was that social engineering (as part of pen testing), is a bit of a waste of time since it will nearly always work and is difficult to defend against in a practical fashion. But it's generated some helpful comments, so that's all good.

I accept that it's easy, if not altogether trivial, to spoof CLI. But it does add a cheap extra layer of security. First, you can't easily spoof a call to make it appear to come from an internal number, which is in itself a defence. Second, for effective social engineering, you'd want to present yourself as a genuine (preferably senior) employee. Such names can often be gleaned from the company web site. But if the helpdesk know the home and mobile numbers, then you'd have to gain knowledge of one of those to make a CLI spoof successful and that may well be more difficult.

As I said, not a perfect defence (nothing ever is), but simple and good enough for many purposes.

Chris Miller

For the avoidance of doubt

I was suggesting* that CLI is a useful basic filter (but not a perfect solution) for the problem of identifying who might be calling (say) the helpdesk. What won't work (in most circumstances) is Security insisting on some lengthy identification process.

I remain of the view that most typical organizations that tried to be completely resistant to social engineering (even assuming such a thing were possible) would be unable to function efficiently and would soon be out of business. All security involves trade-offs, and for most organizations the loss of efficiency involved in becoming completely immune to social engineering attacks would greatly outweigh the benefits.

In certain, limited circumstances resistance to social engineering is vital. This is why, when you call your insurer/bank/... you're presented with a series of questions to check your identity. I imagine most people would be reluctant to deal with such an institution that didn't go through this type of process.

* Note to self: try to avoid the use of double negatives

Chris Miller
Thumb Down

The problem with social engineering

is it's (for a typical commercial organization - may not apply to GCHQ or the NSA) almost always successful and remedial action is close to impossible. If my pen testing shows that I can access internal resources that shouldn't be exposed on the Internet, then I can also suggest possible solutions (e.g. improved firewall rules, ...) - but the fact that I can persuade the helpdesk to divulge the antivirus product in use?

Using a helpdesk is already a bad enough experience (for both the users and the operators), without trying to introduce an initial seven-step process to establish identity* or answering questions about the AV system with: "I'm sorry, I'm not at liberty to divulge that information".

* Which isn't to say that easy and obvious solutions such as the use of CLI is a bad idea.

UAE to cut off BlackBerry users

Chris Miller

Other smartphones

make it obvious (to an eavesdropper) that you're using encrypted services, which might mark you out as a target for further surveillance in some cases. With a Blackberry there's no way for them to tell (except by asking RIM).

Czechs toast Bud-beating beer win

Chris Miller
Coat

Oh dear

I suppose the guys from Anheuser-Busch will just have to search for another European-sounding name for their beer-style product. I understand Gnatspisz, a venerable Hungarian product, is available and sounds quite appropriate.

Broadband advertising speed gap widens

Chris Miller

Which speed is being measured?

Is it the speed at which my DSL router connects to the exchange (in my case, it reports 7616/448kbps)? Or is it the speed at which I can download a file from a web server (in my case roughly 6Mbps - since the data is coming from SamKnows, I guess it's this one)?

But the latter speed cannot exceed ~80% of the former, due to overheads in the protocols being used. If I link two PCs with a crossed 100Mb Ethernet cable and carry out a file transfer, I don't expect to see a 12.5 megabyte transfer rate. Ought I to sue the IEEE because I can't use the full rated speed?

None of this should be used to excuse ISPs that sell 100 x 8Mb packages from a single exchange and only provide a 25Mb uplink to their POP.

Before the iPad, there was the Newton

Chris Miller

June 1996

Just as the MP120 disappeared, we saw the launch of the US Robotics (Palm) Pilot - I knpw this date because the diary on my Palm phone starts in July 1996. Owing a massive debt to its chunky predecessor, it had three huge advantages:

[1] Form factor - it would slip into a shirt pocket. The real test of a PDA is: "have you got it with you, right now?" - the Newton was too bulky and heavy to pass this test, more like a modern netbook or iPad.

[2] Handwriting recognition - Newton's system was a great idea, but neither the software nor the processing power were up to the job. Effective handwriting recognition remains a significant challenge for today's PCs. Palm selected Graffiti, which isn't true handwriting recognition since it requires the use of stylised forms for letters, but minimised the processor requirements.

[3] Simple, out-of-the-box synchronisation with Windows - so that losing your PDA was no longer a world-ending event like losing your Filofax, and content changes made on your Pilot were reflected on your PC (and vice versa).

IBM launches zEnterprise 196 'data center in a box'

Chris Miller

@oolon

Thanks for responding - I can, to some extent, see where you're coming from. Five-nines is equivalent to a second a day or 5 minutes a year, so we tend to measure it over a rolling 12-month period.

Availability is the only thing that counts to the business. It's a second order concern how reliable the hard drives are, as they're in a RAID configuration my systems are still available even if (when) one fails. I do monitor them, because I need to budget for replacement, but actually modern hard drives are very reliable with an MTBF measured in years. You may choose to believe that IBM have some secret sauce that they apply to make them even more reliable, but I believe they use the same heads and platters as everyone else, but put their own chips and connectors on them - partly to improve performance, but mainly to stop you using cheap plug-compatible parts for replacement or upgrade.

Every business should be asking itself, what level of availability does this application require? Five-nines is more than adequate for many typical apps (other factors, such as the application software itself, are likely to be significantly less reliable) - and for that level of availability a Wintel solution can suffice and be significantly more cost effective. This is the reason that there have been essentially zero new mainframe sales in the last decade, nearly all the purchases (which amount to several billions of dollars a year) have been for upgrades or replacements to increase performance or reduce maintenance and power consumption costs.

Chris Miller
Boffin

@oolon

"What the f* do you do to a Windows box to make it as reliable, or 'pretty close', as a mainframe!"

You configure and manage it correctly. Just because you don't know how to do it doesn't mean it can't be done. I expect my Windows servers to deliver at least 99.999% availability and that's just the sweet spot - higher levels are achievable, but it starts to cost serious money and most applications can't justify it.

Of course, if you're a bank or a stock exchange or a telco five-nines isn't good enough. But they usually go for high-availability solutions such as HP Integrity (Tandem to us old timers). IBM mainframes, good though they are, are really just for running legacy code.

You don't work for Big Blue, by any chance?

Chris Miller
Stop

"the rock-solid IBM mainframe environment"

I'm not disputing the reliability of the IBM mainframe environment (though you can get pretty close to it on a well-configured Unix/Linux or even Windows box, if you understand what you're doing), but it's heavily dependent on IBM's total control of the hardware and OS (no third party drivers for this beast). I don't see how plugging an Intel blade into this box will allow it to run Windows or Linux more reliably than a similar blade in a Dell or HP box.

Shops that maintain IBM mainframe environments usually have a clear dividing line between the folks supporting the mainframe and those supporting Intel servers (partly for historical, but mainly for good, practical reasons, the skill sets being rather different). Human nature being what it is, there's often some tension (not always in a bad way) between these teams - the PC guys regarding the mainframers as computing dinosaurs, and the mainframers see the PCs as toys while they get on with the serious computing. If you place an Intel blade inside an IBM box, the mainframers are likely to want to do the monitoring and support - cue lots of 'my server's stopped working', 'nah, our monitor shows it's fine, your problem must lie elsewhere' discussions.

IBM's zEnterprise 196 CPU: Cache is king

Chris Miller

Why aren't they more popular?

The hardware is amazing (and thanks to TPM for another great article), but it's also amazingly expensive - to buy, maintain and support. In simplistic terms of bang for your buck, a Windows or Linux system is going to be an order of magnitude cheaper for all but the most gargantuan workloads.

These beasts still exist mainly because of all the large organisations that need to run millions of lines of legacy code that's either too expensive to convert or (more likely) impossible - since all the documentation has long since disappeared. I have this vision that in 2050 IBM will announce the zEnterprise 1960 to weak cheers from the dwindling band of 90-year-old Cobol programmers, the only people alive who can still support IMS and CICS.

"God sent us this 360 and lo, our 1400 payroll programs run no slower than before." The Devil's DP Dictionary (1981) - Stan Kelly-Bootle

Forget the Jesus Phone, here's the Rude Phone

Chris Miller
Coat

Not forgetting

Deportivo Wanka of Peru (featured in ElReg back in 2006).

IT delays cost HMRC £33m

Chris Miller
FAIL

But that doesn't matter

Because the penalty clauses in the contract recovered the costs from the suppliers*. What do you mean, there weren't any penalty clauses?

* Or, more likely, it was down to HMRC's terminal inability to reach a firm decision.

Perv scanner code of practice still a balls-up

Chris Miller

Good article, but

I don't think raising health scares helps the argument. I don't know the power levels involved, but these aren't X-rays (ionising electromagnetic radiation). So any exposure is probably similar to using a mobile phone for a few minutes or living within sight of a TV mast for a week.

Otherwise, spot on!

Europe outlines snoop laws

Chris Miller

Happy Birthday dear Belgium

What are the odds on making it to 185?

Raumfeld multi-room wireless music system

Chris Miller
Paris Hilton

"separate from any WLAN you may already have in place"

How does that work in a (city) area where you may already have trouble finding free channels? I wouldn't want to fork out for this and find my home network grinds to a halt.

Paris would know ... (we need an 'I'm confused' icon)

Council urges army drinkers to break the law

Chris Miller
Headmaster

You say license, I say licence

British English has two forms of this word: licence is the noun and license the verb - so you require a licence to drive to the licensed premises. Americans simplify this and use only the latter form.

We now return you to our regular programming.

Flaw could expose 'millions' of home routers

Chris Miller
Boffin

The trouble is

That if one of your regular, trusted web sites contains its own security holes, the bad guys could inject the attack code there and then use that to subvert your router. The days have gone when all you needed to do was to stay away from porn, hacking and Russian-hosted web sites.

French website surrenders on Bastille Day

Chris Miller
Alert

100 per cent French?

What, including the chips and disks?

Bastille Day fell on a Wednesday, so I presume all the support staff will have 'bridged' the public holiday and will return to work on Monday. Let's hope there are no further problems in August, when the whole of France takes the month off.

Unless you've been in the support centre of a major French multinational undergoing a severe network outage and watched everyone depart 'because it's Friday 5pm', you really can't understand the French mindset.

UK.gov slams Facebook over Moat fan clubs

Chris Miller

Missing the point

It's all very well trying to defend absolute freedom of speech, except that it doesn't really exist. Society (currently, and you're welcome to argue against this stance) places limits on free speech. I am not free to make public statements that encourage violence against homosexuals, immigrants and other minorities, and if I did so in an identifiable way I would be in trouble. What about the friends and relatives of those whom Moat killed and injured, do you think they might be upset by (apparently) thousands of idiots leaping onto the Facebook and other bandwagons?

No doubt Moat had his mental problems (as, arguably, does anyone that commits premeditated murder), and no doubt we're going to see a lot of 20-20 hindsight being flaunted in the newsrags claiming that he should have had earlier or better treatment. But I really doubt that there are simple and affordable solutions out there that will limit this kind of once a decade* event to a once a century event.

* Yes, I know we've had two somewhat similar events this year, but taking a longer view, I think once a decade is approximately the correct figure.

NASA, Microsoft offer new 3D Mars maps

Chris Miller
FAIL

Shock, horror

Microsoft develop software and it runs in a Microsoft environment, but not in Opera 10 on Slackware. I wonder if similar comments would have been seen if Google had developed it for Google Earth or Apple had made it an iPad app - yes, I guess they would <sigh>.

Now let me see if I can find where that spat out dummy went ...

One experience fits all

Chris Miller

Horses for courses

Quite so, I wouldn't recommend a Wyse/Citrix solution for users of CAD/CAM, Project or graphic designers. But for the 90% (?99%) who really just need Office and Internet access, the corporate benefits greatly outweigh the limitations, even of the rather clunky (compared with an iPad*, anyway) Wyse portable solutions.

* Citrix client now available for iPad, if your clients' tastes run that way.

Chris Miller
Thumb Up

Completely agree, but you forgot the best bit ...

... the Wyse laptop. Staff that move from multiple offices may no longer need laptops, because (of course) all the Wyse 'desktops' are equivalent. But for people who need to be able to work from home, airports or anywhere with a public Internet connection, the Wyse laptop provides all the functionality you described. And when (*not* if) the laptop is lost, stolen or strayed, there's no local data to worry about and no need for complex and expensive encryption schemes

Waterfall Niagara speakers

Chris Miller
Thumb Up

Quad ESLs

http://www.quad-hifi.co.uk/downloads/ESLBrochurelow.pdf

The only hifi speaker worth the name, and a comparative snip at £7,000. Don't listen to them unless you've got the money, because nothing else will ever do - and don't bother if you just want a thumping bass - but for listening to piano or voice these are the :-

Owning Quads is like owning a Roller, if anything ever goes wrong (I broke a connector during a house move) you can take them back to Huntingdon and they will fix them for a very reasonable price.

Hacker swipes details of 4m Pirate Bay users

Chris Miller
FAIL

"Closing some holes in the system are you, boys?"

Clippety-clop, clippety-clop - hang on, is that stable door shut?

Brass band to trumpet last shuttle external tank rollout

Chris Miller

Brass band?

It's a band, Jim, but not as we know it - what's that saxothingy doing in there? Black Dyke it ain't (but I don't expect they use that name across the pond).

RAC prof: Road charges can end the ripoff of motorists

Chris Miller
Thumb Down

@Ben

Really, guys? Seriously? Your thought process was "Let's move this 300ton locomotive from A to B... BY ROAD."???

If you'd seen what Notwork* Rail charge in access fees to make an unscheduled rail movement across the country, you'd realise why (crazily) it works out much cheaper to move them by road 8(. Of course, in the days of BR, it would just have been coupled to the back of a freight heading in the right direction at a marginal cost of a few quid - but this is just the very least of the lunacies generated by our incredibly bureaucratic and generally unworkable 'privatised' rail system.

* What, you thought those £600,000 bonuses generated themselves?

Chris Miller
WTF?

Road charging?

I'll confess to not having read all 100pp of the report, but ...

I can't see the point of road charging, except for a few special circumstances such as city centres and for newly built, alternate routes like the M6 Toll. (NB I'm not saying that I agree with charging in these circumstances, just that I can see some point to it.)

But charging extra for sitting on the M25 in the rush (several) hour(s)? I can assure you that if I'm sitting on a clogged M25, it's because I bl00dy well have to be there, not because I fancied a bit of a joy ride from which I might be deterred by a charge of a few extra quid. If you want to get me off the M25, please provide some viable alternative mode of transport that will get me where I want to go in a reasonable time at a reasonable price.

We already have road usage charging, it's called fuel duty. It penalises those who choose to drive Range Rovers and Bentleys and provides an increased financial incentive to drive more economically.

Budget to cost over a million jobs: Official

Chris Miller

You're both right (to an extent)

Disclaimer: I've never worked in the public sector, but my wife does.

While there are many skilled, dedicated and hard-working staff in the public sector, there are far too many skivers (9-to-5ers are much more common than in the private sector) and middle managers (private sector businesses have spent years flattening their management structure, but this has yet to be applied to the same extent in the public sector).

Wages for comparable jobs are broadly in line with the private sector (as would need to be the case to prevent everyone leaving and allow for recruitment to take place), but there are many for whom it's difficult to identify equivalent private sector work - e.g. planners and social workers.

@Santa - if you really think you can earn so much more in the private sector, why aren't you there? Is it because you:

[a] don't have the right skills;

[b] don't want to relocate; or

[c] get more job satisfaction in your current role?

Whichever it is, your continued presence suggests your salary is appropriate.

Secret ancient code, basis of all modern civilisation, cracked

Chris Miller

Depends on interpretation

A constructivist mathematician might take the view that you haven't actually identified an infinite number of primes (you can't show me a list containing them, or even a way of calculating them all) - only that they are unbounded, i.e. if you give me a prime number, I can always show you a larger one.

Physicists generally take the view that getting an infinite answer* demonstrates that there's something wrong with your theory.

* Black holes are where God divided by zero. - Steven Wright

BT boss brands Britain illiterate

Chris Miller

@Trevor

Thanks - it's nice to get a considered reply. I absolutely agree that language should (indeed must) change over time, but I think its evolution along the lines of txtspk is unlikely because it's unnecessarily difficult to read (and ambiguous). I would like to think that in future our communications will not need to be limited to 140 characters.

I'm a huge fan of Ian (M) Banks, but my least favourite of his books is 'Feersum Endjinn', simply because it contains large sections written in phonetic English like that of the title, which also makes it unnecessarily hard to read (and contributes nothing to the storyline IMHO).

BTW the pre-1800 use of the long (medial or descending) 's' only resembles, but isn't, an 'f' - it survives as the integral sign in maths (analogous to the use of sigma to mean 'sum'). Final 's' and the second letter of a double 's' was written using the modern form of the letter, so successions would have resembled succefsions. The double 's' form led to the use in German typefaces of the sharp 's' (which resembles, but isn't, a Greek beta).

Chris Miller

What's the point of language?

It's to allow you to communicate your internal thoughts to other speakers/readers of the language. Your example is comprehensible, with some ambiguity, but it requires more effort (decoding) from the recipient than if it were written in standard English. It may make it easier for you to write - and if you're sending it to your mates, they may be prepared to make the effort to read it - but if you put it into a CV, why should I be bothered to read it (when I've got another 100 to get through).

Chris Miller

Near enough is good enough

It's closer to a quarter than a fifth. Given that both numbers are likely to have been subject to rounding, it sounds perfectly fair to me.

Apple, Google, Microsoft – are you a Brand Taliban or Brand Evangelist?

Chris Miller

Once more, with feeling

Capitalism is not our moral compass - it's as silly to criticise a business for lacking altruism (which is how efros started this subthread) as it is to criticise a tiger for not being a vegetarian. Capitalism provides a framework within which it's possible for companies to provide goods and services without relying on their altruism, while leaving it open to individuals to choose whether to be altruistic or not. It is far from perfect and other systems are available, though many of them have been found to lead to the gulag or the gas chamber in fairly short order.

Perhaps we've taken the baker/bread analogy too far for an IT forum, but there's a widely-held belief that the nasty UK capitalists have turned our bread into shrink-wrapped, tasteless pap while our socialist cousins across the channel have retained their artisan bakers. Like many widely-held beliefs, this turns out to be a misconception.

When in France, I like nothing better than to pop in to the boulangerie for a tasty baguette. But after a few hours, it has turned into a rock-hard stick useful only for making brandade de morue. Not everyone has the time or the inclination to shop for bread every day, and where British-style shrink-wrapped sliced loaves are on offer to the French, they sell surprisingly well. (Sandwiches are one of M&S Paris best selling lines.) In the UK I can buy either the long-life stuff or fresh - more tasty, but doesn't last as long - it's called consumer choice.