Posts by Glen Turner 666

Boyer explains Dr Bouman's role

There's an excellent essay on Facebook by Misty S. Boyer explaining Dr Bouman's role in the project, with copious references. You'll need to go and find it as I can't paste it here as the text is too large for a Reg comment.

https://www.facebook.com/paganmist/posts/10156249525816313

It *is* a fascinating debug feature. But as the slidepack points out, there's the ability to use it for havoc by using the debugging facilities. For example, burning a fuse to activate a debugging feature of the random number generator, in which the RNG always returns the same number. Being a fuse, that change will survive a reboot.

Not the flight systems, the entertainment system, but still...

Its not a safety of flight issue, but he'd dropped the entertainment system at the beginning of that transatlantic flight people would be rightly upset about the selfishness of entertaining himself at the cost of everyone else's boredom.

About Oracle's entire future, not just Oracle Cloud v AWS

Well obviously Oracle is upset, because their future is on the line.

Oracle make an expensive on-premises database. AWS make an off-premises compute cluster, which also includes a database API. So the US Department of Defence moving to AWS and re-writing their code to use AWS's API rather than Oracle's API means that the use of Oracle's database ends, which means that the annual licensing fee paid to Oracle also ends.

The threat from DoD's AWS strategy is not limited to DoD. They are a huge employer of contracted IT staff, and many of those contractors will carry their heretical notions into other government departments.

Oracle's complaint that there should have been multiple vendors falls a little flat. It's not the job of DoD to keep Oracle afloat, but to seek to maximise DoD's own efficiency. Which using just one cloud API does. But of course Oracle is going to try it on, after all if they win even 10% of the DoD's business that's still a billion bucks.

It's also interesting to reflect how Amazon owning AWS has allowed AWS to thrive. Oracle's usual strategy would have been to purchase this upstart system, much as they did with MySQL. But Amazon's systems are completely reliant upon AWS, so Amazon can't sell AWS without risking the availability of Amazon.Com's $0.5m per minute.

China doeth protet too much

Let's not forget that China has history of doing the same. Australian mining executive Stern Hu was jailed by the Chinese for eight years after China wasn't getting its way during iron ore price negotiations and Rio's refusal to admit Chinese company Chinalco into one of its projects.

Pencils don't leak when stored

We use a pencil because they are easier than pens to store for the long period between elections. If that worries you, well you are permitted to use your own writing device to mark the ballot.

Voter ID will almost certainly disenfranchise everyone living in remote areas. Very few people have their issued documents (birth certificates and so on) and getting replacements when the mail takes three weeks and is based on addresses rather than names isn't straightforward.

A lot of the posts here have poor familiarity with Australia's polling process. The idea that you'd be able to open a ballot box and fiddle with the contents is a little unrealistic. So pencil marks are fine. It's well worth volunteering to be a scruitineer at least once in your life. It is eye opening to see the degree to which Australian elections are secure.

There's little fraud. Partly because the compulsory voting means that the real voter will also present themselves, leading to fraud being quickly discovered. Australian's aren't upset by being forced to appear on a Saturday to vote. They are upset when being forced to appear on a Saturday to vote and then being told they voted twice. That's the sort of anger which leads people to give their full cooperation to the Federal Police, and then not letting the Police slack off.

The undermining of out voting process is really happening through the postal voting system. For example, by political parties putting themselves forward as the agency to approach to obtain the postal voting papers through. The wide range of reasons for postal voting is also too broad: eg, employers should be forced to release people for voting, rather than those staff seeking a postal vote. Postal voting means that incidents close to the election date have less influence then they ought to. You'll remember it was only days before the first ACT election that it started to be known that the leading party was a pack of new right loons. The recent by-election in Wentworth would have been much less close if there were less postal voting, as noted by former PM Turnbull.

RSS also useful for enterprises

An interesting choice because RSS is very useful for enterprise applications. It's the easiest way to get "dashboard summaries" into people's browsers (for things like Top Ten open issues, or unread phone messages). So by removing these features Mozilla is pushing their users towards IM clients like Slack.

Why CPU rng

A few reasons:

1) The CPU's random number generator can be random, based upon provably random phenomena rather than a pseudo-random number based upon mathematical manipulation.

2) There are some sources of actually-random data in a computer, although they are usually not the same strength as "provably random". An example is the jitter from disk drive events. But these sources are rapidly disappearing as physical devices towards silicon. This is the operational problem with not enough 'entropy' (aka real randomness) being available as a machine starts.

3) It's "too easy" for these actually-random sources of data in a computer to be influenced from outside the computer. Since they are not built as cryptographic devices. Whereas the random instructions within the CPU can include tamper detectors (such as for high EM fields).

4) Timing and other covert channel attacks are simpler against software than against hardware. Those attacks are also simpler against hardware not intended to be cryptographic devices than against hardware designed with covert channels in mind. It is easier in hardware to build a black box where all instances of the instruction take the same time to complete, use the same power, and so on. (As an aside the current issue with CPUs is that the care of design needed to defeat covert channels done for the RDRAND instruction needs to be repeated throughout the CPU design for other instructions.)

These reasons explain the last line of Ted's LKML e-mail: "Note: I trust [Intel's hardware instruction] RDRAND more than I do Jitter Entropy [from the computer's hardware devices]".

Steele memo not only source of Russian influence

Note that the Steele Report isn't the sole source. From July 2016 Australia's intelligence agencies were warning the US's FBI of Russian attempts at subversion of their Presidential election. The initial Australian intelligence was gained from old-fashioned "drink the source under the table" espionage.

Obviously this second source doesn't fit into the argument the Nunes Memo is promoting, since it makes the Steele Report irrelevant -- the FBI was going to investigate whatever the provenance of Steele's work.

Is that a log in your eye I see before me?

No one wants to deal with the government agency empowered and best placed to deal with high impact cybersecurity issues -- the NSA. Until the US Government fixes this, criticising non-government entities is pointless.

Another set of predictions

The development we didn't predict. The reputation of Silicon Valley -- and IT startups in general -- was trashed by their insularity, their poor behaviour towards women, their dismissive attitude towards social responsibility in general, and towards paying taxes in particular.

How my prediction went. Poorly, WPIT didn't make the mainstream press as a potential sinkhole of taxpayer funds and a risk to the nation's economy which needs to be managed beyond the usual levels of IT project executive oversight.

2018 prediction: optical networking prices will continue to plummet, and many corporate networks will insert a WDM fabric under their ethernet transmission. The NBN's powered boxes by the side of the road will look archaic within half a decade. A newer design would use small, cheap, unpowered in-pit WDM muxes. Yes that needs fibre-to-the-premises, but fibre is now cheaper than copper for all but trivial cables.

Related: networking gear from China will become so cheap that bespoke-made items will make sense for large networks.

Fast down the straights but steering not precise

Yes, it's faster. But it's also buggy. Been using it for a day and issues with: Reddit posting, Facebook layout, New York times scrolling. These are not obscure websites or activities. So perhaps wait a while.

Warrant for access to a safe?

You can't get a warrant to access a safe from a safe manufacturer. There is no backdoor. They'll just tell you to buy a drill and brute-force it.

You can place a warrant against the safe's end-user. But that's exactly what the feds are trying to avoid here. Because this isn't about access to gain evidence, it's about access to do surveillance. That's why the Five Eyes forum was seen as appropriate by the Australian government, and downright Orwellian to the rest of us.

Externalities

So what's the cost to people running internet routers? We've taken a handful of route table entries and auctioning them by /24 increases the number of route table entries a hundred-fold. I think we should probably put a stop to this behaviour before it becomes endemic and filter out the more specifics of auctioned addresses.

SDN future is driven from cloud providers, not supplier strategies

"The problem is that large customers rely almost exclusively on Cisco and VMware, and they aren't interested in the open-source switches and open-source hypervisors with open-source management software that's needed to make hybrid SDN actually workable today."

This paragraph summarises my issue with the article. It's writes as if the enterprise vendors are the major source of influence over SDN. Whereas SDN is being driven by the cloud vendors, all of whom build their own switches, all of whom run their own software on those switches. It's likely that the future of SDN in the enterprise will be a byproduct of the main game at those cloud vendors; rather than anything in the strategic plans of VMware or Cisco.

In my view it's very likely that one of the cloud vendor SDN technologies will become so widely known that enterprises persisting with traditional enterprise networking and VxLAN will find themselves in an expensive niche.

I'd be a little bit cautious to ascribing an outage to the last thing to fail in a chain of failures. Especially in a report written by one of the players. It soft-soaps AEMO running its own weather models, and thus missing the warnings from BoM. The result was that the SA grid hadn't been prepared for a major weather event. Also there's a number of forward-looking statements in the report about future grid design, but the question why AEMO management failed to address these design issues prior to the SA outage isn't discussed.

There's plenty of blame for all involved. Even for SA residents and their installation of air conditioning rather than purchasing efficient homes in the first place. Demand management is one area which the SA government hasn't sought change, despite it being one of the cheapest ways to lower electricity prices.

Let's see what other countries do

I suppose the test will be what the UK and France do, as they have access to substantially the same facts.

Banning large batteries from the cabin isn't the worst idea. It's basically a decision that they'd like to deal with explosions of 150g to 1000g of explosive in the hold rather than in the cabin. The list of airports seems approximately where a substitution of battery for explosive could be expected which also have flights to the USA.

I also wonder if the agencies are concerned about an explosive laptop being used as a tool in a larger scheme, such as breaching the flight deck door.

Weather in South Australia

Folks, it hardly matters what the energy mix was. Let's have a thought experiment where we return to operation the coal-burning power stations at Port Augusta and Leigh Creek. The six tornadoes would have still cut the large powerlines between Adelaide and those generators.

The essential failure was the lack of awareness of South Australian weather at NEMCO. That lead to poor decisions, such as not bringing online all the gas generation actually located in Adelaide. We even had this misunderstanding from the Deputy Prime Minister, who said that this wasn't a severe weather event on par with a cyclone, which is to misunderstand the destruction a tornado can cause, although in a smaller area than a cyclone.

The shutdown of wind power due to electrical distribution system instability was very unfortunate. But again, that software behaviour was squarely NEMCO's job to know. And they didn't. At least being software this issue is cheap to fix. Not that there was enough wind power for the state in any case, since those tornado-affected distribution lines were carrying power from many of those windmills too.

The discussion about nuclear reactors is even more laughable. Less than a year ago South Australia had a Royal Commission into the nuclear fuel cycle -- including nuclear power -- which reported that all forms of nuclear power are uneconomic for this state.

What is really interesting is the very different read of this issue within South Australia -- people who actually experienced the edge of the weather event -- and elsewhere.

"Effectiveness" is code

Note that the spokesperson is saying that the future review is into the "effectiveness" of the section. In Australian Public Service policy language "effectiveness" is a very different thing from "efficiency". "Effectiveness" is how well the mechanism works _without regard_ to other factors, such as expense or the robustness of the Australian Internet.

This would signal a substantial policy change from the current s115a, which requires the judge to weigh up the competing interests when approving a proposed injunction to block access to the "online location". That is, the legislators desired website blocking to be "efficient" rather than merely "effective". Therefore "effectiveness" should not be the primary criteria for evaluation of the legislation.

It would have been useful for Simon to have questioned the spokesperson on their choice of words. If the response was written then the expectation is that words hold their usual meaning.

My prediction: WPIT

The acronym WPIT will become known outside Canberra. The Welfare Payments Infrastructure Transformation is essentially the replacement of the Model 204 database and applications code originally established by the Department of Social Security in 1983. The code has survived name changes (to Human Services/Centrelink), umpteen ministers, and 35 years of budgets and mini-budgets of changes (all of which had to be live by a particular date, a date usually set for political or accounting reasons rather than as the result of an implementation plan, so we're not talking a lot of programming to a deadline with no nice-to-haves which might ease future maintenance or migration).

The cost of rewriting this code to run on a replacement system is said by the government to be $1b to $1.5b. $1.5b seems optimistic: even on simple SLOC-based measures the 30m lines of code will cost roughly $2b. It's hard to see how it could be lower, as a lot of the measures for reducing cost aren't available for this task (eg, incremental feature delivery). All this technical discussion hides that Australia doesn't have many people with management experience of this scale of project and management is where the real risk hides (the seeming over-optimism about future project costs is a worrying sign).

This is high stakes IT: the scale; the risk to clients; the macroeconomic risk. Stuff this up and there's no saving your government and your country could enter recession.

The Minister appears competent, which is a good start. But of course if he's too good then he won't be content to stay at DHS for the decade this job will take.

Not sure this works in Assange's favour

I don't think this is a win for Assange. He still can't leave the embassy, as the UK will arrest him for his failure to appear, at which point the USA might well lob in a deportation request. A request which will then be top of the queue, assuming that Sweden withdraw their request for arrest.

As for things being different with President Trump, let's see. Because Trump owes the FBI a lot, and the US law/intelligence agencies desperately want Assange. If only to make an example of, as they are doing with Manning. I'm not sure Trump views Assange as anything more than a convenient dropbox for the work of Putin, and if Wikileaks didn't do the job then someone else would have been found.

I get the feeling that this is much more about solving Equador's problem than Assange's problem.

Update -- Comodo to abandon trademark registration

This thread <https://forums.comodo.com/general-discussion-off-topic-anything-and-everything/shame-on-you-comodo-t115958.3.html> contains the most hilarious statement ever by a CEO, see comment #3. A staffer later posts that Comodo will file to abandon the trademark registration:

"@robinalden Reply #28 on: Yesterday at 03:41:45 PM:

"Comodo has filed for express abandonment of the trademark applications at this time instead of waiting and allowing them to lapse.

"Following collaboration between Let's Encrypt and Comodo, the trademark issue is now resolved and behind us and we'd like to thank the Let's Encrypt team for helping to bring it to a to a resolution."

BYOD

I think it very much depends on the sector as to what BYOD means.

For universities it means that students bring their own laptop and expect it to work with minimal fuss: connect to wireless, print, plug in somewhere to recharge. There's no attraction at all in a device without a screen -- the huge use of mobiles by students suggests that the screen is actually the important part of the computer.

For schools I wonder if you could take your idea once step further. The kids don't carry their computers around at all, but only the computer's storage (say, a Micro SD card). That storage is the boot device for a VM at both home and school. Add some simple software maintenance and I think this has some value and is worthwhile poking around with. The biggest problem would be Windows.

Business doesn't know what to do about BYOD, and they keep watering down the concept in the hope that it becomes something else. Unfortunately in doing so they lose the benefits of the BYOD approach, and loop back to the start of the process without making any headway. Increased BYOD by contractors and the lack of "enterprise mobile" means they'll have to grasp the nettle eventually. If only offering "outside the firewall" Internet with a certificate-mediated access (VPN or PKI) back into selected resources.

Perhaps more attention to dimensions and weight?

Looking around uni is always interesting, as students put down their own cash for laptops and expect to use them seriously rather than for games. The typical notebook by far is the Macbook Air, followed by the Dell XPS 13. With that in mind I'd suggest that this review doesn't give enough attention to dimensions, weight, and battery life. Just on dimensions alone it is difficult to recommend a lot of the laptops in this review, as they're not going to fit well into a school bag.

If you want to see what bargain manufacturers could be doing for school users then look at the Toshiba Chromebook 2. Small, light, good screen, quiet. It's well underpowered for WIndows, it's lack of sockets limits its upgradability (and thus lifetime), but you'd hope that manufacturers would take hints from the form factor.

Return to Home not much safer

The Return to Home function doesn't solve the problem. There's 25% odds that path to Home will be across the firebombing circuit. Realistically Return to Ground is the only safe alternative. But there's a strong scofflaw element within drone operators and due to the likely loss of the aircraft such a safety mechanism is likely to be disabled.

What's needed here is a social change. As one small example, no stories in the online media with INCREDIBLE DRONE FOOTAGE OF FIRE from non-official sources.

BTW, there's a huge lack of understanding of aviation in the drone forums discussing this issue. Such as postings claiming that rotor blades aren't under any stress hitting a drone, or that drone shrapnel can be sucked through turbine blades without threatening the aircraft. There's no appreciation at all for the pilot workload of firefighting operations, something apparent to even beginning pilots.

BYOD works in some organisations, not that you'd know it from this author

Reading this article you wouldn't think that universities happily have thousands of BYOD devices on their networks every working day. It would have been better if the article, rather than condemning BYOD outright, looked at how they do it and the risks and benefits to the organisation.

Rather too upbeat

What an odd article. No large computing platform uses Oracle hardware or software: Google, Facebook, Amazon, and so on. They don't even subcontract Oracle's engineering expertise to construct their own internal-use products.

What's left is really the crumbs, with an "enterprise" label whacked on. And those crumbs are under threat from the products developed or maintained by the large computing platforms: from Linux to OpenStack to Software Defined Networking. Worse still, despite the increased costs over Google, Facebook, etal the performance and uptime of enterprise applications is typically worse than the cloud applications.

Maybe the Liberal Party supporters of metadata collection could publish their phone call metadata for the past few days of political instability. I can think of nothing more illustrative of the privacy dangers of metadata collection than that request.