Posts by copsewood

100,000 a day

Owning a newspaper beats owning a football team for some rich people and I can understand why. If you are sitting on a huge pile of cash you may as well either have some fun or make some noise using it.

Linux distributions are secure up to a point

Technically Linux is just the kernel program. It's the Linux distributions people use that are likely to be secure relative to Windows. And occasionally not: Puppy Linux used to have the default desktop user running everything as root a few years ago, but too few people used it for many to notice. Also if and when world + dog are using Linux and point and click Linux executables are therefore in a high proportion of dodgy emails and on most compromised web servers, Linux distros won't then be very secure unless the browser and desktop middleware ensure each such executable can only be executed or installed easily inside its own disposable sandbox.

Same in London, Glasgow and a faker's audio lab ?

This is because the entire UK grid is synchronised. You wouldn't get the same variation pattern in London as in Paris because mains electricity is exchanged between the UK and France using DC and not AC. But you'd get the same pattern in Paris as in Frankfurt. And if the historical frequency variation data isn't already published somewhere on the Net it probably soon will be.

Let's hypothesise you wanted to create a faked signature and you had access to the historical data of the AC variation within the AC control region against base 50Hz frequency from the date and time you wished to simulate. You then transform the mains using a DC converter (e.g. go through a bank of 12V car batteries) and then modulate the local AC mains as output from the AC->DC->AC converter to the same time signature you wished to recreate. If we don't yet know whether this is possible, it would take further research to prove or disprove whether this approach could fool this forensic method. If it could, then someone wanting to claim a recording was faked would presumably have to demonstrate a probability that this approach was used to reinforce the faking of a date/timestamp on a recording.

While we will welcome use of such approaches to convict the guilty, this could be of interest to someone genuinely believing they were framed by this approach. Let's face it, history isn't short of examples of supposedly unchallengeable forensic methods found to have been used to wrongly convict the innocent.

Go probably matters enough to some IPad users

Who are very unlikely to buy I-anything in future because of this. If free software is worth developing and promoting, business models based upon controlling users will ultimately have to be destroyed. If that means killing the market for user-controlling devices all well and good.

privacy and expression

Your copyright does not give you a right to have my letters steamed open because my privacy right supercedes your copyright here. You should also have no right to have my Internet connection spied upon (same idea), but some governments seem wrongly to think that it should.

As to freedom of expression being suppressed, Disney's Mickey Mouse plagiarised Steamboat Willy, because SW was out of 30 year copyright in the 1920's, but MM is still in copyright jail 90 years later. As the useful public domain depletes due to extreme copyright duration, many new expressions becomes genuinely more difficult. For example, I saw a TV program describing the impossibility of creating a historical program reviewing a number of civil rights documentaries made during the 1960ies because each documentary would require contacting hundreds of rights holders, who are difficult or impossible to trace and if interested likely to be too expensive to deal with. Consequently copyright interferes with freedom of expression in a world where preservation of history is important, and our ability to represent important parts of it becomes impossible, or in any kind of artistic situation where new work requires representation or inclusion of old work.

honeypots and honeynets

One problem with these is that the analyst simulating an infection in order to monitor black hat/malware behaviour has to make sure their infection behaves closely enough to what the blackhat is controlling to fool the blackhat, while also making sure the simulated infection does not behave like a real one in the sense the honeypot/honeynet needs to be part of the solution rather than part of the problem. Various approaches are used, including having outgoing connections go through a custom very restrictive rate-limiting firewall. Most typically a honeynet is setup to become infected, while being strictly monitored and controlled, in order to study the malware used to infect it.

Possibly one of the most useful and effective honeynet techniques is the fully automated spamtrap which attracts great volumes of spam, measuring the addresses from where the spam is relayed so these bot addresses get onto the DNSBL blacklists used by most MTA mail servers in real time.

finger simulation

How long before crooks figure out how to simulate your live finger by reading it and then creating a prosthetic one that reads the same in these machines ? Don't see the need for cutting fingers off, all they need to do is mount a scanner inside a door handle.

Can you educate without a language ?

Of course teaching ideas, principles, problem solving, critical ability etc. are what education is about. Teaching language and mathematics is fundamental to these things. When it comes to the natural language in which teaching and learning occurs, schools have little choice, but a natural language has to be used or little education could occur. I'm all in favour of children learning a second natural language at a young age as this promotes much greater flexibility of thought.

If learning computer use in any deep sense is to be a required part of education, this clearly cannot occur from the perspective of a dashboard set of controls liable to change every few years. That is all most schools do, unfortunately, and this in practice is analogous to teaching a bit of reading while leaving all writing to a priesthood whose mystical secret knowledge is considered too abstract and elusive for mere mortals to understand. This is how things were with literacy in the middle ages, and we are now repeating this mistake in computing education if we don't teach programming in some language.

So either an artificial language choice has to be made or our computing education won't go beyond the superficial. Clearly the choice of artificial language for the purpose of teaching is important - in the sense of the choice we make not putting students off, and helping them to learn the underlying principles and concepts of computing as well as possible. The number of responses in this discussion topic suggest others think so too.

DKIM requires knowledge of domain reputation

Domain reputation is much more likely to be reliable than the reputation attachable using one or more DNSBLs to the originating IP address. We'll still need white/black/grey listing systems, but these will no longer relate to the IP address. They will relate to the goodness/badness that can be automatically derived concerning the reputation of the authenticated domain name e.g. by counting whatever arrives at very large spamtraps that isn't NDNs with null sender address. Then the spammers will have to pay mules to register their domains for them, but it won't take them very long to burn out a domain.

more probable delivery systems

"If some mad mullah developed a nuclear bomb and decided to hit us with it, they wouldn't send it in a fancy ICBM with a smoke trail leading back to their homeland. They'd put it in the back of a Transit and drive it to the target."

More likely a shipping container shuffled through enough container ports to achieve plausible deniability as to origin. Which makes the whole idea of deterrence using expensive survivable submarine ICBM systems a bit like the Maginot Line - a very expensive system designed for the last war, not the current one.

indeed

Proprietary vendors are not going to understand the specialised scaling requirements of individual users as well as the users themselves, assuming the latter have a clue. Contributing patches upstream and maintaining them there reduces the duplication of effort involved in maintaining a local fork.

Welcome back to the UK ?

"Ah, so you advocate stripping rights from people with creative talent.What a bitter man you are!"

The history of your nation's constitution started, I seem to recall, with the stripping of property rights from the British crown in 1776 ? So to apply your arguments to your own history, this history of political right stripping makes any sense of US national pride a matter of spite, bitterness and jealousy ? Andrew, the more I manage to wind you up, the funnier you sound. Besides, I'm not sure we would want all those Americans taking up seats in our Parliament, so good riddance !

check your Received header chain

You need to look at a few full email headers. If your postmaster rips open your envelopes, throws these away and cuts off your letterheadings as some webmail providers do, then you'll stay ignorant until you choose to use a decent incoming mail delivery service. When you can check your full headers, the IP address delivering to the first trusted gateway in your trusted incoming chain is the one you filter/reject it on, blacklist if you want to and check blacklists for. This can all be done automatically.

closer but not quite there

The correct comparison would be which of the following generates how much GHG:

a. Wilderness of various kinds including wetlands.

b. Arable farming

c. Livestock farming based on grassland suitable for arable

d. Livestock farming based on grassland unsuitable for arable

e.Livestock farming based on grain fed livestock.

As I understand it wet wilderness generates a great deal of GHG. We call methane "marsh gas" because that is how methane occurs in nature. Clearly draining wetlands, which has occurred extensively to provide agricultural land removes natural sources of GHG, as well as destroying a great deal of biodiversity. But we do need scientifically motivated and full comparisons here, not religiously motivated selective ones coming from those who imagine vegetarianism to be holier than meat eating so report science selectively in order to impose their religious views upon others.

Badgers, because badgers, rabbits and wild animals fart too.

XP without security patches

Gets itself compromised in minutes leaving you with a nest of viruses.

The security patches you need will still be within copyright even if copyright on them is reduced to 12 months.

Customisable when you want it

I've had no trouble customising my Ubuntu desktop with my somewhat exotic email requirements which go way beyond what I've ever seen achieved on Windows or Mac. Under the hood it's little different from its parent Debian distribution which I still use on my hosted server and this gives it the customisability needed. However, having things just work with popular defaults and being able to use GUI administration tools for the most common things saves me time where I do not want to have to spend it. Also without the Ubuntu ease of use, my 90 year old Dad would probably have had to give up using a computer once he had to replace his Windows 98 system a couple of years ago. Windows XP was then no longer a desktop option from his preferred hardware supplier (Dell) and the demands Vista was making upon him on his new computer were completely beyond his tolerance threshhold.

Don't think so

If nuclear power were that profitable then why would they need to offload the long term storage costs and insurance cost onto the taxpayer ?

US law != world law

The DMCA only applies to those willing to risk travel to the US or indigenous serfs of the corporations there who buy such laws from US Congress inc.

Indemnification is for lawyers with large budgets

It's a good thing to have well trained developers who understand coding with reference to security issues. (That's how I make some of my money.) But unless you are developing from scratch for a trivial microprocessor (itself developed from scratch) using machine code you are relying on code created by tens or hundreds of thousands of previous software engineers working in thousands of different organisations, either as part of the toolchain used to create your application, or your operating platform, or recursively in respect of earlier systems where these platform and toolchain artefacts came from.

Open source distributions are developing an effective form of suppy chain management with cryptographic signoff by developers and integrators. This is something likely far better than anything achieved in the complex and closed source world. But either way, the integrity of any final system beyond a given level of complexity still depends upon a web of trust with a great number of people past and present involved and it won't be possible to get them all to sign the proposed contracts. So if the platforms and toolchains are not going to be indemnified, what value is it to the customer of a more expensive application in practice if the latter is indemnified regardless of the legal status of the former ?

This one isn't going to fly in the open source world where licenses specifically disclaim developer liability, though there is nothing to prevent specific code being developed and released open source with side agreements. And if the source code supply chain isn't open source the customer has no way of knowing where all the platform and toolchain code came from or who checked it to what extent anyway.

@iggle piggle - What Right ?

"and those are the rights of the copyright holder not to have their work blatantly copied around the internet with no consideration of their wishes."

What right do copyright holders have if the laws supporting their vested and vocal interests are unenforceable and generally ignored ? Were London cabbies really supposed to keep bales of hay in their cab boots for horses long since retired until the 1970ies when this long obsolete law was finally revoked ? And should this question have been considered differently had the producers of hay bales owned the printing presses ?

Copyright laws based upon 20 - 30 year terms prior to work entering the public domain, when these affected the behaviour of a few dozen rich owners of printing presses were proportionate. Copyright laws based incrementally on these earlier laws but extended to 50 - 90 years, theoretically affecting the behaviour of everyone capable of copying anything for any purpose whether profit making or not are treated with the contempt these deserve .

been there done that

I got a cheap Acer Aspire one SSD with Linux on it because no other OS would have been of any use at all. The limitation isn't the processor, because with X forwarding, offloading processor intensive jobs to be done elsewhere is very easy. For me the limitation is the keyboard and eye and shoulder strain. The keyboard is just large enough to touch type on but not very accurately, which can be a problem in command line mode. I got it because I can't be bothered to lug a large laptop around when I could use mobile computing. It is useful to have the option to use it when I'm traveling, remotely to manage my servers, find a place to visit, check a weather forecast, other occasional web browsing, showing and uploading photos etc. but half an hour a day on this thing is about my limit. Doing this on a lower power ARM chip with longer battery life would make a lot of sense, given all the software I want to use on it is available in source code form and can be recompiled for the more power efficient chip.