* Posts by John Smith 19

16330 publicly visible posts • joined 10 Jun 2009

UK.gov tells companies to draft contracts for data flows just in case they screw up Brexit

John Smith 19 Gold badge
Unhappy

"Who's stupid fucking idea was this anyway?!"

No one's.

It is a consequence of an idea.

The idea that "Brexit means Brexit," despite no one having a f**king clue what that tautology actually meant

But they are starting to get a clue now.

And I think most people have found they don't like it.

Too bad those banjos didn't realize they were being played when they voted for it.

First it was hashtags – now Amber Rudd gives us Brits knowledge on national ID cards

John Smith 19 Gold badge
Gimp

"By not having it, they can't do it,"

The true fear of a data fetishist

"OMFG there's somebody I don't know absolutely everything about doing something I don't know about, somewhere*"

*When I put it that way it does sound quite irrational, does it not?

John Smith 19 Gold badge
Gimp

"What *you* want, though, is a central system to tie in everything I do to that number. "

Correct.

This is Tony Blairs "National Identity Register" back end re-born (some might think it never died, and in the minds of the senior civil servants who think it's a great idea it never did).

IOW a cradle-to-grave surveillance system.

The wet dream of every Authoritarian politician who demands to know what people are doing 24/7/365 forever.

John Smith 19 Gold badge
Gimp

Re: "people already hand over masses of info to private firms"...

Translation

"You are already several major US corporations b**ch. It's no bother to make you the British Governments one as well."

Now that Rudd's no longer Home Sec she's looking less like a sock puppet and more like one of the True Believers in data fetishism.

In politics there are Democrats (who believe in the idea of democracy) and Authoritarians (for whom it is an inconvenience to stopping them getting there own way).

I think it's clear which side Rudd is on.

We're doomed: Defra's having a cow over its Brexit IT preparations

John Smith 19 Gold badge
FAIL

<government dept> isn't ready for a no-deal Brexit,

I think that's a fairly accurate sitrep on all of them. But, but...

<gollum>

We wants it

We needs it

We must have hard Brexit.

</gollum>

I will guarantee one thing about Brexit

Jacob Rees-Moggs company will make a shedload of cash out of it, either directly or through it's (newly opened) Dublin branch.

Guess who's still in charge of your gas safety, Brits? Capita

John Smith 19 Gold badge
FAIL

Just add a large dose of 'outsourced to India'

That's already a given.

You don't get to be the cheapest without using all the tricks.

You'll note the whole C suite has been swapped out.

So lot's of "startup costs" there....

UK.gov went ahead with under-planned, under-funded IT upgrade? Sounds about right

John Smith 19 Gold badge
FAIL

Looksl like all the usual suspects for IT failure are on display here.

Again.

Activists rattle tin to take UK's pr0n block to court

John Smith 19 Gold badge
Gimp

t seems to be a mere knee jerk reaction and a solution to a non problem and per-leese,

spare me the "think of the children" rhetoric."

Wrong.

This is the thin end of a very thick pole that data fetishists want to bury right up you.

This s**t is already showing "feature creep" with stuff like anorexia advocacy ("Pro-ana") sites on the list and WTF is "Estoterica"??? (no that's not a typo).

This is profiling the UK internet user population by the back door (the only way data fetishists know how to operate).

Y'know what? VoIP can also be free from pesky regulation – US judges

John Smith 19 Gold badge
Unhappy

"fix an incorrectly perceived problem that's already covered by EXISTING law."

IOW The law enforcers should enforce the existing laws properly.

Don't expect anything useful from "Sweet" Pai.

Dear America: Want secure elections? Stick to pen and paper for ballots, experts urge

John Smith 19 Gold badge
Unhappy

Still won't fix the US'ans broken "Electorial college" system

Which only needs a few people to swing a way in a few particular states and hey presto you've "elected" probably the President with the highest score on the PCL-R ever.

Do you really think crims would do that? Just go on the 'net and exploit a Windows zero-day?

John Smith 19 Gold badge
Coat

"I think this method was already in Andrew Tanenbaum's operating systems text book "

I'd suggest "peopleware" that dates from 1987

The discussion of "The Black Team" would be the area to look.

I guess this shows the difference between software and hardware.

Software manual. Functions do what they say but lack checking.

Hardware manual (Intel memory management) functions don't do what they say.

John Smith 19 Gold badge
Unhappy

So classic way to find an exploit.

1) Read what the manual says a Windows function can do and will allow

2) See if its parameter checking stops you from doing whatever you want.

3) Check next function.

It shouldn't be possible to change access permissions to system files without Admin privileges.

But it turns out it is.

I wonder if the code to check was in a dev version but some PHB decreed "Nah, that slugs performance, and it'll never be a problem IRL"

Or did they just not bother to write parameter checking code?

Bug bounty alert: Musk lets pro hackers torpedo Tesla firmware risk free

John Smith 19 Gold badge
Unhappy

"Those who want to be enrolled in the research program will need to contact Tesla directly"

And have a Tesla of course.

Which sort of raises the entry fee a bit.

Activists raise alarm over insidious creep of surveillance in the UK

John Smith 19 Gold badge
Gimp

But let's be clear. By "the state" we mean the small cabal of data fetishists who *really* want it

They are both patient and obsessive in a way only the truly irrational can be.

Start with the PPE graduates.

There seems to be something in the combination of going to an Oxbridge college and doing this course that creates a level of self belief and entitlement that many would characterize as "Arrogant pr**ks" (if they weren't already that way to begin with).

Mikrotik routers pwned en masse, send network data to mysterious box

John Smith 19 Gold badge
Unhappy

"What complete idiot implements remote access in a consumer firewall ?"

Simple.

1) Some code monkey that cut and pasted the code from stack exchange

2) Some code monkey that cut and pasted the code from a higher end product and didn't consider if these functions were necessary.

A code monkey is not a code monkey because their coding skills are s**t.

They're a code monkey because of what they choose to do about it.

John Smith 19 Gold badge
Unhappy

When people release a list of developed exploits....

perhaps it would be a good idea to start developing upgrades to nullify them first?

Not so much changing their tune as enabling autotune: Facebook, Twitter bigwigs nod and smile to US senators

John Smith 19 Gold badge
Unhappy

"put a monetary value on the data that they hold on individuals."

That, right there, is the key to getting these companies on a leash.

Once people see what a staggering amount of cash these companies make from the data they slurp from the flock they farm it might start occurring to the members of the flock they should start charging.

IOW the corporations might have to start paying for some of their free content.

That sounds fair to me.

But you can bet it doesn't to them.

Take a pinch of autofill, mix in HTTP, and bake on a Wi-Fi admin page: Quirky way to swipe a victim's router password

John Smith 19 Gold badge
Unhappy

"It would work in hotels,"

This is clearly not a casual attack.

So professional crims looking to harvest high value targets creds in expensive hotels might find it quite useful.

Likewise anyone else who's a paid spy might find it useful. Not necessarily a go to approach, but in the toolkit.

Maybe the takeaway is "Autofill is not a good idea for login details" ?

Make BGP great again, er, no, for the first time: NIST backs internet route security brainwave

John Smith 19 Gold badge
Gimp

Should be seen as a key part of the "surveillance is a threat to the net" agenda

And knowing who you're talking to (at the network level) is a part of making sure your packets are not getting slurped by malicious actors.*

So potentially a good start.

*Choose your preferred MA depending on political outlook and area of the world.

Boffins are building an open-source secure enclave on RISC-V

John Smith 19 Gold badge
Unhappy

A few notes on VIPER.

VIPER was designed by RSRE Malvern (now part of Quinetq?)

Hardware wise it was implemented as a gate array (physically different wiring) and ran at 1MHz in the test version.

Software wise the PLA implemented a set of finite state machines. It was an accumulator and 2 registers architecture. It's nearest equivalent would have been the 6502

While all the high level verification seemed to work fine what scuppered them was they assumed the conversion from logic design to gate wiring was perfect and (IIRC) the development tools to do so (provided by the PLA mfg) had bugs.

Here's the thing. Although I keep hearing about how foundry processes can deliver GHz capability, and individual gate on FPGA can go very high how is it I never see an actual product (connected gates) clocking at >1GHz?

My suspicion is

a) Individual FPGA cells have acquired a lot of cruft in their design. Too much flexibility slugs raw speed.

b) FPGA cell layout on the chip hinders low latency

c) Place & Route is not nearly as good as FPGA mfg's claim it is. OK you don't have a clock driver circuit every half a dozen gates but surely you can build at least MSI level (an LS 74171 ALU was 96 gates for a 4 bit slice) that has total worst case gate delay on longest path of < 1ns?

BTW regarding "RISC" ME Conway proposed a 2 instruction processor in the 1950's for (IIRC) the Lambda calculus. In the 80's an Israeli team went to the limit with a 1 instruction machine.

Effectively every sub function in the design has its own address. Want to add 3 numbers together? MOV them to the "ACC" address. Want to zero it? Move from the "Zero adder" address.

John Smith 19 Gold badge
Unhappy

Sounds pretty good.

But will the software that runs on it make full use of the security it provides?

SAP slaps down Teradata's 'trade secret' sueball with sick burn

John Smith 19 Gold badge
Unhappy

Terradata's precursor was NCR, one of the companies US anti-trust legislation

written to prosecute.

TBH I don't really trust the claims of either side.

Do I think SAP could have studied the competition and used "Project Bridge" as a trap to get them to cough up trade secrets? Yes.

Do I think Terradata has had few new wins lately? Yes.

Would I trust either of their claims without a team of independent experts going through them? F**k no.

Security bods: Android system broadcasts enable user tracking

John Smith 19 Gold badge
Unhappy

The leakier those permissions are the more data can collect on you.

Which is great. For Google.

Anyone remember the story of the Florida man who killed his wife?. Police found the body by asking the supplier of his flashlight app for the GPS coordinates of the phone while they suspected he was dumping the body.

Which the app suppliers had on their servers.

WTF is that app doing collecting that information. For what? And sending it home?

I know, that's Apple not Android, but (at the very least) there should be something that can basically feed (or generate) Bu***hit data if some app demands that access

Spies still super upset they can't get at your encrypted comms data

John Smith 19 Gold badge
FAIL

Rule 1. Intelligence agencies don't give a s**t about laws. Why would they start now?

You can legislate that pi = 3.

Won't make it so.

Voting machine maker claims vote machine hack-fests a 'green light' for foreign hackers

John Smith 19 Gold badge
Thumb Up

"Ignorance of insecurity does not get you security. "

The most succinct description of why security by obscurity (even with special "National Security" BS sauce) doesn't work.

Yes I also wonder if they have a division of code monkeys who sling IoT s88t

Surprise! VAT, customs likely to get a bit trickier in a Brexit no-deal world

John Smith 19 Gold badge
Unhappy

non-EU nation like "Turkey..get about 1200 permits. If we're lucky we'll get about the same

number of permits to go around the entire British haulage industry after Brexit."

So you're saying that basically Brexit is quite likely to f**k up the whole UK road haulage industry?

Still since most of the "White van man" types that voted to Leave don't run long distance that's not going to be a problem for them.

Except of course when the companies they drive for go down the sh***er as the stuff they collect or drop off ceases to be affordable.

John Smith 19 Gold badge
Unhappy

You may as well change your name to "bloody foreigners".

The thing about that's really had be ROTFLMFAO is all those who basically voted Leave under the "We'll stop the foreigns getting in" idea.

Good news for them is all those nasty Europeans can go back to the continent.

Leaving plenty more room for all their those Chinese and Indians can move into those vacant properties.

Who they will no doubt find infinitely more preferable.

John Smith 19 Gold badge
Thumb Up

A number of financial services have already opened up shop in Amsterdam...

Good point.

I guess I'd always figured Frankfurt and Paris as the big Continental financial centres, and somehow I got the idea Amsterdam is a bit crammed.

But yes, closer to London, good comms, high probability of English language speakers and a refreshingly low key but hostile attitude to the Germans.

What is not to like?

John Smith 19 Gold badge
Unhappy

"if we scrap the renewables obligation, about 30% less on electricity costs."

2 Problems with that.

1) Not imposed by the EU. Imposed by Tony Blair on Gordon Brown's government as a little outgoing f***you to ol' Mad Eye.

2)) The Peer who took a cash-for-clauses deal to require smart meters in British homes has already spent the money.

Another little EU fairly story that turns out to be just a fairly story (but with a British, not EU law behind it).

John Smith 19 Gold badge
Unhappy

And yes I do consider the Vote Leave team traitors.

Good point, distinguishing the people pushing it (many of whom could see a nice little earner in it for themselves) from the people who voted for it.

John Smith 19 Gold badge

Tinkerbell Brexit - Just clap your hands and believe

Hmm.

Would that like Canadian +, Norwegian -, totally bespoke or complete delusional bu***hit brexit?

John Smith 19 Gold badge
Unhappy

"cost saving of..5 and 8 hours of truck and driver's costs on each trip with 'Open Borders'."

Multiplied by the more highly distributed supply chains driven by JIT mfg and distribution over the last 42 years of EEC/EU membership.

Example.

Most European Avon beauty products come from a gigantic factory/warehouse site in Poland.

Consider how many borders they will come through to get to the UK.

The best observation Brexit I've seen is this.

Leave campaign bus "An extra £350m/week into the NHS" (this was admitted as BS within days but left on the side of the bus anyway)

HMG last week "We are asking the food and drug industries to substantially increase their stockpiles to cope with delays in the supply chain."

I predict the number of people who will admit to voting Leave within 2 years of the actual event (which hasn't happened yet) will be about the same as the number of people on VE Day 1945 who admitted they voted for Oswald Mosely before WWII. IE approximately f**k all.

John Smith 19 Gold badge
Unhappy

A good deal benefits both sides.

Such deals only happen when it's a deal between (at some level) equals

Any trade deal between the EU and China/US/India is along those lines.

UK and China/US/India. Not so much.

John Smith 19 Gold badge
Unhappy

According to Professor Minford, the most likely casualties are manufacturing and farming.

Funny, he seems to be in complete agreement with the Agriculture & Horticulture Development Board impact assessments.

In the worst case Brexit scenario only pig farming is left standing.

Everything else is road kill.

Still, that's Natures way, isn't it, unless the government continues the entire CAP system, with its associated costs.

BTW New Zealand is often touted as a possible no subsidy model for UK farming.

It's GDP is bigger than Iran and smaller than Romania.

John Smith 19 Gold badge
Unhappy

"There will be very little to smile about...time if the [redacted] in Brussels has its way."

You're right about the smiling.

You're wrong about the source.

The British did this to themselves (with the help of one Australian advertising guru and a load of illegal campaign funding and illegally acquired FB profile data)

John Smith 19 Gold badge
FAIL

"selected group of importers"..given access to make "certain types" of declarations,

And in line with the "testing" of the Universal Credit system they will be the simplest cases with the smallest number of transactions to the fewest number of countries.

Which will then be used to prove the system "works".

Why can I still hear a funny little voice going "We wants it. we wants it" ?

And remember financial services is still about 3x bigger than any physical exports to the EU.

"No deal" on those and the UK tax base is very seriously f**ked. The businesses will simply relocate most of their operations to Dublin/Frankfurt/Paris depending on the language skills of their staff and living costs.

Salesforce boss Marc Benioff objects to US immigration policy so much, he makes millions from, er, US immigration

John Smith 19 Gold badge
Joke

US born workers. I only have one question for you.

Are you an American or an American't?*

And if you can, will you for the money they are offering?

*With grateful thanks to Robert Rodriguez.

It's a net neutrality whodunnit: Boffins devise way to detect who's throttling transit

John Smith 19 Gold badge
Unhappy

So delay == proxy for throttling. Simple idea.

Maybe too simple?

If it doesn't need to be connected, don't: Nurse prescribes meds for sickly hospital infosec

John Smith 19 Gold badge
Unhappy

This stuff doesn't need to talk to the net

So why let it?

And it looks like medical grade IoT s**t is no better than any other kind.

I wonder if the same code monkeys sling this s**t as for the rest of this stuff.

ETSI crypto-based access control standards land

John Smith 19 Gold badge
Unhappy

"help protect stored data in the presence of a hostile listener on the network."

I'd say that's any government and many actual network operators.

Security MadLibs: Your IoT electrical outlet can now pwn your smart TV

John Smith 19 Gold badge
WTF?

"exploit stems from a buffer overflow in the Universal Plug and Play (UPnP) software"

It's August 2018 and stilllllll this s**t.

F**king code monkeys, slinging more software s**t.

I tell myself "You shouldn't get so upset. It's no worse than most other s**t"

Somehow being no worse than other s**t, is not making me feel better.

Python wriggles onward without its head

John Smith 19 Gold badge
Coat

Why do I keep thinking Guido's title should have been

King Snake Head.

Joking aside I kind of like Python and it seems I'm not alone.

Home Office seeks Brexit tech boss – but doesn't splash the cash

John Smith 19 Gold badge
IT Angle

"Why the fsck has this person not been in place since June 24th 2016?"

Yes, that would be the IT question related to Brexit.

The thinking behind it will probably be protected under a "year rule"

30,40,50 or 70 do you think?

It'll be at least 30 before this bunch want anyone to know the discussions on this clusterf**k were as shambolic as everything else.

John Smith 19 Gold badge
FAIL

I'm beginning to think no-one ever really thought this Brexit idea through.

No one did.

That was obvious from the day David Davies refused to request any any impact assessments be done by any department.

John Smith 19 Gold badge
Happy

Of course it will work. Crapita aren't involved

Hmm...

Well that does improve the odds of success from 99:1 against.

To 98:1 against.

Maybe as high as 97:1.

DeepMind AI bots tell Google to literally chill out: Software takes control of server cooling

John Smith 19 Gold badge
Coat

All joking aside when you've got 100s of 1000s of servers in multiple bit barns

The mechanical thermostat has hysteresis, slow(ish) response and mechanical failure modes.

So more likely a network of thermistors feeding a control station even without the AI.

TBH though I would have thought the problem is sufficiently constrained in dimensions that something rather simpler would have done.

OTOH if you do have all that "Deep learning" stuff set up maybe re-purposing it is pretty cheap (and as we know to the man with the hammer everything is a nail).

'Oh sh..' – the moment an infosec bod realized he was tracking a cop car's movements by its leaky cellular gateway

John Smith 19 Gold badge
FAIL

GPS location on the router home page.

For PHB who are think the SoA in vehicle tracking is "I got a tab for every car. I just go to it and there's its position."

unfu**ingbelieveable.

Now the default password is not necessarily an issue.

Provided (after you use it) it says "For security reasons please change this password to your preferred password, and record the new one in a safe place."

The first bit should be easy. It's usually the latter (and tracking all of them together) where it get tricky.

UK.gov told data-sharing plans need vendor buy-in

John Smith 19 Gold badge
Gimp

TBH HMG might start proving it can be trusted with the data it demands from subjects.

Except that's pretty f**king hard to prove when all the evidence is that they aren't.

It's amazing just how many times, when given a chance to do the right thing (provide an audit trail data subjects can look at, require judicial oversight for data collection requests etc etc) they do the wrong thing

IOW exactly how a data fetishist thinks.

More data --> better data

All data, all the time, forever --> best of all.

Web cache poisoning just got real: How to fling evil code at victims

John Smith 19 Gold badge
Unhappy

So non-core services offered by a SaaS supplier likely to be less secure thatn core

I find myself strangely unsurprised at this discovery.

But it sounds like a neat trick.

Proving once again "Never f**king trust anything that comes in from a user to your server"

Ever.

IRL you may never meet a real Black hat. But on the internet your web site is just its IP address from all of them. From Moscow to Berlin, from Islamabad to Kazakhstan, from Kuala Lumpor to Perth.

Boffins build the smallest transistor, controlled by an atom

John Smith 19 Gold badge
Unhappy

1 atom switched junction <> 1 atom wide junction.

So still a ways to go before the end of Moore's law.

But I do like the thinking behind it.

And metal is a better conductor than Silicon will ever be (the clue is in the name. semi-conductor).

Now, can they do a normally on transistor that switches off when you add an atom?