Ah, the braided rings: perhaps THIS time a probe will send back a decent photo of 'Message Bearer' ... ;-)
I for one welcome the Chtaptisk Fithp...
124 posts • joined 6 May 2008
Ah, the braided rings: perhaps THIS time a probe will send back a decent photo of 'Message Bearer' ... ;-)
I for one welcome the Chtaptisk Fithp...
Nexus 5X here with Android 7.0 on.
Location for the Store is "off" and I didn't' turn it off, it's just "off". I didn't see any request to enable it either....
The only thing I did note was that I had Developer mode "uncovered" before the 6.0-7.0 upgrade, but it was disabled. Post upgrade, it was ENABLED and "Automatic system updates" were enabled...
A link to other materials here would be useful :)
The 5X has an encrypted file system, however other sources on this vuln show the password is left sitting "unguarded" in the extracted image, so someone with the image could unlock the device, or clone it.
Hopefully Google have either salted this passphrase now, rather than just stopping the panic enabling extraction.....
One of the offices I work at has three lifts. Above each one, on each floor, is a 4"x2" ish panel, showing the floor the lift is on, and a directional arrow.
Except one day the left most one was showing a teeny tiny Windows 2000 screen.....(not a BSOD, just the desktop...)
I decided I'd never have a Smart TV, until the only way I could get a larger panel with 3D support was a Smart TV.
So I had a play, and while the interface isn't super whizzy, it works - although the unit has the most stupid design flaw - I can turn if OFF via Ethernet, once it's OFF, it doesn't respond to WoL, so you have to resort to a pinky interface, or good old IR. Well done there, that manufacturer.
But still, as it the box supports YouTube, Google Play Movies, Talk Talk TV/BlinkBox & NowTV. If any of those fail, those apps all support Chromecast, and I've got one of those too. £25 isn't a lot to shell out. Or, as mentioned, I could resurrect the Pi2 I have lying around...
I've got one of these (and scanned it for posterity) if El Reg would like to run an expose on it...
It ticked all the boxes:
1) Shiny company name
2) Shiny company address (Geneva) - which, if Streetviewed, is a cinema and hairdressers....(presumably a unit above it)
3) Webmail email address
4) "Phone" number that points to a REGUS FAX number
5) Offer of lots of good investments
The upgrade has had some fun with my machine.
a) Restart after updating - well, no, it powered the machine off
b) ICMP (inbound) ping/response was disabled, after I'd explicitly enabled it
c) Jumbo Frame support magically got disabled
d) System Restore - also magically turned off - I created a Restore Point FIRST, and when I ran some diags/checks afterwards, System Restore on C: was disabled.
I'd advise you to check all your settings, just in case...
It landed on my PC.
"Restart to install updates" - except it shutdown and powered off. Nice.
It also disabled incoming ICMP (which I'd explicitly turned ON before). Nice. That upset my elementary monitoring.
It turned off my Jumbo Frame support, which upset my file transfer speeds, and me.
I'm also using a local account, but it said it required access to my MS account "for something". It then showed up under Account again (since removed and logged out and it's not come back. Yet).
It enabled Windows Ink without asking. It got turned off.
Cortana is absent, as I'm using a local account. Good.
^^ This. Use the mobile app, get requested to install Messenger. Use the mobile website, get diverted to install Messenger. Cancel, and you can use the mobile website. If you use a mobile with "desktop view" it kind of works (but Android & Facebooks auto scrolldown/refresh keeps confusing it).
Important messages still go via SMS, and some friends have already migrated to Signal.
IANAL, but doesn't that constitute Misuse of Computers somewhere along the line?
Or do the terms of Win7 (et al) basically state you absolve your self of any/all choice? Or (worse) that the wording regarding "updates" is that they are offered without warranty, and WinX gets labeled as an "update" to get them around it?
Disclaimer : I have WinX (Home & Pro) on two machines, and don't hate it. Only gripe is the "Oh hai, buy Office 365 plz" self installing appvertisement...
Well, combine it with ANPR/speed camera and facial recognition...
"You have....FIVE...points remaining on your licence...."
It may well stop nagging you, but I've just fired up my W10 box, to have a notification that my version of Office (2007, paid for, working nicely still) is not the latest one, and would I like to upgrade? (50% off! Buy now! Every year!)
Erm, no thanks!
"George found it. George was curious.
Now George is an Unemployed Silly Bugger.
Don't be like George - hand it in, don't plug it in".
"I doubt that's as simple as people may want it to be. Even if the cloud-dependency is limited to the user interface (i.e. telling the home control unit how you want it to react to specific events, which it then continues to do autonomously) it needs to have that user interface added somehow, either on the control unit, or by adding that functionality to the control app on your phone/tablet/laptop."
It's not simple, but it's an option. There are other solutions to call commands - or they could expose REST type interfaces. OpenRemote (that I use) ties multiple IoT things together, and whilst OR does use a cloud designer, once it's synced to your controller device (in this case, my NAS), it no longer needs the cloud. If their servers die, I can't extend it easily, but I'm not entirely hamstrung. There are bound to be other similar things out there.
Is there a WiKi of IoT makers and wether they do/don't need cloud? There probably is, I'm just lazy and confident someone will be along with a LMGTFY link shortly :)
I have a blend of things, most of which have 'net connectivity in some form, but not all are cloud dependent. Philips Hue can be cloud linked, but doesn't need to be. LightwaveRF is the same (but by default is cloud linked). My biggest issue has been vendors (i.e. LightwaveRF) constantly developing the firmware and not publically releasing any API - so when you figure something out, it often breaks without warning - although their helpdesk has gotten much better at providing info post breakage!
I hadn't heard of Revolv, but would at least hope that they (or any other bought out team) would be able to provide a last firmware update that decouples the unit from the cloud and operate locally.
"The Google Store Promotional Codes Terms apply. Offer (one redemption per person) only available in the United States while supplies last."
Soooo, if they (currently) require multiple runs to capture/identify the signals - presumably any machine running "other code" at the same time (as most machines do?) might well create obfuscation? Also, why not simply build in random calls during the decrypt, for optional "secure decryption" - every X operations, head -Y /dev/random into /dev/null (or /tmp/file), and use a decent RNG to generate X & Y. It'd slow the process down, but theoretically create enough chaff to hide things, and wouldn't be the same on any replay?
"I'm sorry Dave, you want to add encryption to a self encrypting drive? I'm afraid we (and various agencies of choice) can't decrypt that (so we don't like it)".
I was mortified to see the default is to save BitLocker keys "into the (MS) cloud" for you(r safety). Unless you have Win 10 Pro, in which case you are allegedly deemed capable of not losing your keys.
"The adaptive cruise on the Volvo is easily the best of any car out there, far smoother than competing systems and able to follow the car in front at a range of distances from "miles away" to "Audi". "
Not on mine, although maybe that's as I have a '60 plate S60 D5 which was one of the early release "new look" ones.
The adaptive cruise is good, but the closest it lets you get is at least 2-3 car lengths, whereas the average Audi can get so close they may as well be in the back seat.
Also, mine is a bit naff at spotting people changing lanes into yours, between the car and the one it's following - you can watch them move over, until they are firmly in the lane with you and driving normally, THEN the car will go "ooh, a car" and promptly slow down/brake. If you have the distance set at 2-3 car lengths, that can be quite 'interesting'. I've learned how it behaves, but I suspect it REALLY annoys the car(s) behind....
Does BitLocker assist here?
Assuming you've turned on the PCRs which check the BIOS and/or option ROMs haven't changed checksum, and you've got boot protection enabled (i.e. key/passphrase required) then the O/S should have a hissy fit on boot up, which should ring alarm bells?
"Start the reactor...."
I saw SIP in use originally in a commercial arena, and wanted to play - so setup Asterisk, with an SPA3102 linked to my DECT handsets. VoIP + PSTN failback, all worked nicely - until you realise the some PSTN carriers don't play nicely (Virgin + Clear on Disconnect? Not without lots of emails).
I've used 'free' systems like Voxalot, and commercials (like SipGate, VoIP.co.uk etc) and never had bad quality on any. The hardest bit is generally sorting out why Asterisk will play nicely with Trunk Provider 1, and not Trunk Provider 2....typically down to some esoteric setting.
But it's nice wangling cheaper/lower cost calls. If Google Voice hurried up and came to the UK properly I'd be plugging that in too....
Mine comes up with a nice fat "Warning! Your client is vulnerable to CVE-2015-0204".
It is indeed. Run with SandboxIE and Ghostery/Adblock (as mentioned) it is quite the speedy thing....
To be fair, I hadn't seen any juddery images, although I do have a nice TV which does iron out a lot of crap (24Hz compatible TV, AMP and BD player have removed any jerky BD videos for example).
However, since Android Lollipop landed, my previously working (on 4.4.4) "Cast Screen" functionality has gone walkies. YouTube and other apps work, but I (and others, judging by the forums) can't cast screen anymore...
Way to go backwards!
Tom Selleck and a police unit in the style of "Runaway" immediately!
OpenRemote (www.openremote.org) - it's a free (for home use) server you can clap on a box at home (if you don't mind a JVM) with Android and iPhone clients, which lets you talk to anything that has an IP.
My *nix based installation serves custom screens and talks to Philips Hue, LightwaveRF, Globalcache iTach (IP2IR), and an IP enabled A/V receiver. Others have much more! Now both mine and my wife's phones (and our tablet) can act as unified remotes. My server also has a VPN so (if needs be) I can run things remotely/securely (OpenSSL/BASH vulns aside!)
Personally, having found Hue to be the easiest to work with, I'd love everything to speak JSON and use REST APIs - but as long as it has an API, I can wrap it in :)
So read this and went "eep".
However I checked my script, and it's #!/bin/sh, so that's ok then (and bash has also been patched on my box).
But I'm also using client certs, tls-auth files, non-default ciper algorithms and of course the auth-user-pass-verify. But if you've managed to get my certs, tls file and password, I suspect that's the least of my worries :)
Amen to that.
Google provide 2FA for their entire suite of apps (behind the "Google Account") - they also provide printable one time codes in case you lose your phone/flat battery etc.
Google Authenticator also allows other codes to be added from other apps. My Joomla installation and a NAS box (with PAM 2FA based auth) are sitting looking at me, under my Google Account.
Facebook also provide 2FA, which pops up on your mobile if you try to login on a PC.
Using the above has in no way been complicated, and it's reassuring knowing it's there.
Insert obligatory Dick Tracy reference here :)
If they made them chargeable from movement ala some 'normal' watches, and thinner I'd be interested - until then I have a very nice traditional swiss affair which shall continue to adorn my wrist :)
Not just YouTube. Some selective things seem to happen. I use OpenDNS, and performance to their servers (resolution time) went to hell recently. Use Google/VM DNS and all ok.
Diags from their end all showed ok, just "suspect routing" betwixt VM and OpenDNS...
Seems to have recovered more recently, but still...
We're about to "try to look inside that place you cannot look"....
Given the current tactic seems be "Block the IP resulting from a DNS query", I can see them shortly resort to "just redirect the whole damn domain", followed by "just block access to DNS".
Because they are that stupid.
Incidentally, the court order to block a site (ala BitTorrent) - doesn't that just apply "to the ISP", rather than it's customers? As (IANAL) customers are not subject to the order - although they are impacted by the ISPs compliance with it, gaining access via other methods (another DNS/IP, or VPN) is not the fault of the ISP, or a breach of an order against it's customers, because one doesn't exist.....?
"Why is your phone encrypted? Please meet RIPA. Hand over the decryption keys".
The Hue bulbs do have f/w and update - although Philips don't really tell you about this...
When I bought mine, when you turned them on, they went from 0% to 100% smoothly over about 1.5 seconds....then one day, one started turning on to 100% pretty much immediately.
I dig into the hub interface shows that the bulbs were being updated - the hub reports the bulb f/w to homebase and (I presume) proxies the s/w to the bulb over it's hybrid Zigbee interface. Works though, just a bit slow (the bulbs have to be powered on at the switch, even if you have them 'soft off').
The hub also does talk to the 'net and you can control lights remotely, although you can disable that and run them from LAN only - if you so desire/require.
I was really keen on LIFX, but every time I asked them about 802.1x capabilities (my WLAN runs TLS & cert auth) I never got a proper answer. Not even a "No, it doesn't do cert auth".
Philips Hue sidesteps this by having a wired controller using Zigbee - and was available, and has a nice REST API, so I went down that route....
Albeit only on/off control - but better than nothing :)
LightWaveRF controller, £60 (ish)
LightWaveRF relay (which can operate in volt free switching mode), £30.
Time taken to wire relay to my boilers volt free thermostat switch, about 5 mins. Time taken to mount relay in a box on the wall and spur power to it, about 10 mins.
LightWaveRF's app works remotely, so you can turn it on/off remotely, or set timers etc - or (as I also have) control it via other systems, in my case OpenRemote.
My boiler has usefully currently got a fault (suspect air pressure switch) and is 14 years old - so if I do upgrade the boiler, I may well go down the thermostat route however!
So, I'm in the UK and I place a call (on a landline) to someone in the US (or anywhere outside the UK and it's associated territories).
That call is routed over UK based equipment. Intercepting it (and "interception" is the word used in the article" requires a warrant. Why is the same not true of anything in transit to an internet site?
Granted once it's arrived at said destination, if said destination is outside the UK, and/or set to be public, then fine, look at it all you want....but snarfing it "in flight" still counts as interception within the UK.....doesn't it?
It always irks me how many people (or their companies) can afford (them) to be driving around in high class Beemers, Mercs, Audis etc, and they either haven't got Bluetooth (either as standard or retrofitted). Not really any excuse anymore other than "I didn't want to spend the cash". Or worse, I HAVE spent the cash, but I'm too lazy to switch Bluetooth on.
I am seeing more and more people with headphones on in the car, presumably either to listen to music and cut out road noise, or because they're using the headphones with mikes to make calls. Either way, that's also cutting down on situational awareness a bit.
I've got in-dash GPS now (current and last cars) - but they are expensive, and both mine are "2nd user" cars :) I'm quite surprised more manufacturers haven't released/announced Miracast (or other wireless display) capable displays. Got a smartphone? You'll invariably have some form of Nav, so why not just have it sent to the car....?
That would cut down on the cost of providing a car with GPS antennae and systems, the in car nav updates, re-use owners phone tech, get screen mounted tat off the screen/out of view. Even providing a mobile "slot" with an NFC tag to help auto activate Miracast is possible.
I posited something similar a while back (http://forums.theregister.co.uk/forum/1/2014/01/09/yahoo_always_on_crypto_unstrong/#c_2074093) - so I'm pleased to see it.
My only 'concern' would be that (as mentioned above) I'd like to see it opensourced (with deterministic build instructions) and audited to show that the plugin doesn't harvest and send back your private key & passphrase (regardless of who authored it!)
Just let it scan the el Reg forums and comments. That should keep it busy until the end of time...
ISTR that the problem was that no-one could generally get it to build correctly from source....
From : http://istruecryptauditedyet.com/ :
"Implement deterministic/reproducible builds. Many of our concerns with Truecrypt could go away if we knew the binaries were compiled from source. Unfortunately it's not realistic to ask every Windows user to compile Truecrypt themselves. Our proposal is to adapt the deterministic build process that Tor is now using, so we can know the binaries are safe and untampered. This is really a precondition to everything else. And it's not an easy process"
Works for me - Android & iOS clients - and speaks to almost anything that accepts a TCP/UDP connection. Has event driven scripting too. Granted it's not going to be simple for the man on the street, but I had mine talking to Philips Hue, LightWaveRF, GlobalCache IP2IR and an Onkyo A/V receiver, with a nice custom tablet interface in a week. All different standards/interfaces, one controller. Sorted.
Chuck in Tasker and Autovoice, and it's voice controlled too....
It was initially tape with my ZX Spectrum. Then a micro-drive - with extra capacity added by stretching the tape :)
The a move to PC - we had 5.25" and 3.5" floppy drives. Then acquired a ZIP100 drive, then eventually a ZIP250. And then an LS-120 Superdisk which was backward compatible with 3.5" disks - but that annoyingly died, so I got another - which eventually did the same... :(
Since then it's all mostly been USB and/or flash card storage - although an Ultrium 1 and now Ultrium 3 drive kick about for the really big backups :)
I say that as the heating controls have been "coming soon" for quite some time.
I've got LWRF for some devices (couple of lights and a relay to override the central heating system) - but have a variety of gadgets now running in the house on various protocols, and used OpenRemote to tie them all together - have a look (www.openremote.com for the commercial app, and www.openremote.org for the opensource variant). Note that it's a command interface/state tracker, not an actual controller, but it can talk to almost anything you throw at it - and they can sell you a box to run it on (I have mine on an HP microserver).
I started out with HomeEasy kit for lights, and now have Philips Hue, LightwaveRF, Globalcache iTach and other IP enabled kit all talking to it happily :)
I too saw the possible acquisition message in source.
I have no coins, but surely it's a poor way to handle things either way!
Nah, Wago connectors :)
Whilst refurbing, I wanted to kit out the house with some Hue bulbs, and needed to replace the light fittings as (at the time) only ES27 Hue bulbs were available. Terminal/chocolate blocks were mahoosive given the flush(er) fittings I wanted, and then I stumbled across Wago connectors - push fit and lever/clamp - and they're really tiny.
No more trying to hold a fitting *and* chocolate block *and* wires in one hand whilst trying to tighten a fiddly tiny bl**dy screw with the other for me :)
Check all your in-path devices.
I had "sideways" jerk (particularly with horizontal panning) on some films - being played by a PS3. It had 24Hz enabled automatically (depending on content), my A/V receiver passes through 24 Hz and the TV is 24Hz capable.
And the "capable" word was the problem - as I was blaming the telly. I had to enable "movie mode" on the TV to get 24Hz behaving, which has now eliminated the stutter. This differs from the 100Mhz "Trumotion" stuff, which makes everything slide around sickeningly :\
The stupid thing is the TV was telling me it was a 24Hz signal, but it didn't deal with it "properly" until an option was enabled. Le sigh.
What about kit that "upscales"? It's not entirely clear if they just upscale, or can actually handle 4K content too (and just relay it).
I recently swapped out my Onkyo TX-SR609 for a TX-NR609 - basically the same model A/V, but with (and the reason I bought it) a shiny CAT5 port and DLNA etc, and also 4K upscaling. Most of the docs only say "upscaling", although one says "Upscaling and processing" - so it's not clear if it could actually cope with 4k content natively. They do say it will upscale to 4K2K (3840 x 2160) - so if it can output, I'd assume it could relay it?
Still ,anyone who buys this beasty : http://www.costco.co.uk/view/product/uk_catalog/cos_1,cos_1.1,cos_1.1.7/142976
will be a bit narked if it doesn't work, won't they? :)
Just because you can't see a problem (presumably because you're far too stupid to see the several blindingly obvious ones), doesn't mean there isn't one.
I do wonder what'll happen with those people who (like me) have disabled the priority and other inboxen though. Hopefully there will be some subject based identifier to allow a filter....