* Posts by Richard 12

6092 publicly visible posts • joined 16 Jun 2009

Alert: 15-year-old Python tarfile flaw lurks in 'over 350,000' code projects

Richard 12 Silver badge

You aren't perfect

Sooner or later, you'll forget to check through absolutely every path in a tarball containing tens of thousands of files, and lose something important.

And you probably won't even realise it happened until weeks later.

Richard 12 Silver badge

Re: This is why security is a discipline separate from coding

That only protects the OS. Arguably the easiest thing to fix.

It doesn't stop user data from getting trashed.

Richard 12 Silver badge

Re: Zip too

Many (most?) of the popular zip libraries fixed these things at least five or six years ago.

I remember when QuaZip fixed theirs - it was still on Sourceforge, so ages ago.

Path traversal attacks are a well-known logic flaw, and no, you can't fix it by saying "user needs to check all the paths before extracting"

That's abrogating your responsibility as a library maintainer. Bad Gustäbel, no cookie.

Microsoft debuts Windows 11 2022 Update – now with features added monthly

Richard 12 Silver badge

Microsoft will allow all software to run exactly once on each machine, so malware had better do all the damage the first time.

In all seriousness, I've found that Endpoint Protection will fairly consistently allow a "potentially dangerous" application to run the first time, then block subsequent executions.

Which is both utterly pointless and incredibly frustrating.

'Last man standing in the floppy disk business' reckons his company has 4 years left

Richard 12 Silver badge

I hope you soldered on a standard coin cell holder so they could swap it themselves five years later.

Richard 12 Silver badge
Boffin

Re: I'm surprised

They aren't quite generic.

The industrial machinery that uses floppies generally runs it using its own custom software interface that just so happens to rely on particular quirks or a particular region of the standard timing ranges that the drives they were using had.

Which means you often can't just drop in a generic drive and have it work reliably, or at all.

The emulators have a fair bit of configuration available so you can match it to the quirks of the "original" drive - particular delays, sequencing etc.

So while they'll probably all work on anything, you might have to configure some magic settings and best of luck finding the right ones.

Intel's stock Raptor Lake chip will do 6GHz and overclock another 25%, if it keeps cool

Richard 12 Silver badge
Devil

Teams is based on Sharepoint and Electron, which are both wasteful spawns of Satan himself.

Richard 12 Silver badge

Re: Using the right tools

Wow, you're really engaging in full-on doublethink and redefining terms in the middle of sentences.

Please learn the meanings of terms like "scalable" before you make a further fool of yourself.

For example, upgrading a Mac Mini M1 to have 32GB of RAM is totally impossible. Compare that difficulty with any Intel or AMD server, desktop (or most laptops).

Richard 12 Silver badge

Will you start the fans, please!

That's going to need some pretty effective cooling.

Is it a new socket too?

Seems like forever since you could upgrade a CPU after 3-5 years without swapping the motherboard as well :(

Richard 12 Silver badge

Re: Using the right tools

The fundamental design of the Apple Arm is that it's a monolithic system-on-chip.

That's the scalability compromise. It's all in a single package - CPU, GPU and RAM.

That means two and a half things:

The TDP of the entire system is limited to that which can be dissipated within a single package. So it cannot ever be as fast as a system where these components are physically separated, because it cannot dissipate the heat.

It cannot ever be upgraded. The RAM and GPU are fixed at SoC manufacture, and thus the only options possible are the ones the chip manufacturer chooses to supply. If your workload requires more RAM or a better GPU, tough. Can't buy one. (They might be able to reintroduce external GPU over USB-4, but never RAM.)

No 32bit software support. At all.

(The first two of these are specific choices by Apple. You could make a SoC with x86-64 cores or a discrete system with Arm cores)

None of these really matter for a cheap (to build) commodity consumer grade laptop, but they do elsewhere.

Linux luminaries discuss efforts to bring Rust to the kernel

Richard 12 Silver badge

Re: Odd choice

A lot of kernel-mode drivers are already written in C++.

As I understand it, Tlthis work is basically to allow Rust to be used for kernel-mode drivers too.

Which is a good thing, drivers are hard. If the toolchain can help (be that memory safety guarantees, RAII etc) this is good.

However, it's still going to be a subset of those languages that can be used.

Richard 12 Silver badge

Re: It's not an insult

It depends.

When the checks are all either compile-time or the ones you'd be manually putting in if the toolchain didn't do it for you, then the runtime cost is zero while the development savings are useful.

The trouble is when it adds runtime checks over and above the necessary. Which is the same problem people have with C++ exceptions, and why a lot of developers turn those off.

Richard 12 Silver badge

Re: All of that effort

C interop with C++ is better than anything else ever could be, as it's explicitly defined to be a superset of C. The bindings are no-op, and the minimal binding is quite literally six lines at most - sometimes no lines of code at all.

Rust may or may not be a good language, and does indeed have excellent bindings. But don't make silly superlative claims.

Bad UI killed the radio star

Richard 12 Silver badge

Always cycle your disks

Many years ago, I worked with a system that used floppy disks.

It had the running data on board in non-volatile RAM, and could save one copy of said data to a floppy disk.

Save and Load were next to each other looked almost identical in the UI, right down to the "Are you sure?" confirmation prompt.

You know what's coming, of course.

At the end of a very long, multi-hour programming session, I accidentally hit Load instead of Save.

Fortunately, I followed protocol and saved every 20 minutes to a different disk, so only had to re-write the last 20 minutes of work. That only took five minutes as I'd just done it.

The modern versions of this system have an onboard SSD that can store many thousands of said files, and automatically keeps the previous hundred or so revisions.

And by default, it automatically saves a new revision before Load, so you literally can't make that mistake. I made sure of that.

Arm execs: We respect RISC-V but it's not a rival in the datacenter

Richard 12 Silver badge

Re: Toast

They aren't direct competitors (yet) though.

ARM sell actual core designs and guarantee their performance, while RISC-V is just an ISA - it's not a core.

You need a lot of specialist expertise to turn that ISA into an actual working RISC-V chip, and you don't know up-front what you're going to get because it's not a tried-and-tested design.

The real competitors are the likes of Si-Five who will sell you a tested core design.

Heart now pledges 30-seat hybrid electric commercial flights by 2028

Richard 12 Silver badge

Re: Doesn't make sense

There's a very small number of short hop routes where it might make sense, I guess.

But it's still only going to be able to make two to three flights a day, at most. I guess that works for some inter-island routes that local laws require they fly, but not for commercially viable routes.

Richard 12 Silver badge

Re: United Airlines? Chicago O'Hare is their hub.

Jet fuel requires transportation too, so it's reasonable to assume moving the fuel is a similar CO2 cost either way.

So just need to compare the burning.

Burning fuel at high altitude is believed to cause a higher CO2 equivalent than at ground level, I think 1.5-1.8 is the usual multiplier.

So if it only burns the hybrids during takeoff and landing, I guess that might be a saving but it's not exactly large.

Richard 12 Silver badge
FAIL

Re: Neat

They can't.

The UK National Grid publish a white paper every year reminding everyone that there isn't enough generation capacity to do even 10% of the electric stuff that is supposedly planned, and that the grid itself doesn't have the capability to distribute it.

In places like Texas, the state grid can't even cope with normal loads.

Appeals court already under fire for upholding Texas no-content-moderation law

Richard 12 Silver badge

Re: Consitutaional right to block content and legal precedent?

It is clearly unconstitutional for the Government to force you to say something you do not wish to say.

The social media platform therefore has a clear constitutional right to choose which drivel they wish to publish.

This is a blatantly unconstitutional attempt by the Texas Government to force them to publish things they don't want to say.

If you accept this, then logically, the Texas Government can force you to say anything.

Richard 12 Silver badge
Trollface

Re: So if I wanted to troll Texas...

Politicians have more meat on them, and the benefit of historical precedent.

https://youtu.be/VVsrv5zftYE

The next deep magic Linux program to change the world? Io_uring

Richard 12 Silver badge

Re: Io-uring is not new news

True, and true.

It's only really interesting at the very top end of I/O - file servers, databases, HPC etc.

That said, because of that it also means that certain things that would otherwise need to be kernel drivers for performance, can be done in userspace instead.

Which is nice.

Microsoft rolls out stealthy updates for 365 Apps

Richard 12 Silver badge

Re: "a process that Lieberman said takes about four seconds"

Outlook takes 10-20 seconds to start normally. Excel et al can take far longer if the document is large.

Do they genuinely think anyone believes that?

Richard 12 Silver badge
Thumb Down

Confidence level zero

Outlook for one is still incapable of restoring itself on the same monitor with the same layout after updates.

It's annoying, but at least I get some warning and can postpone it to the start of the next business day.

So now I'll randomly come back after lunch to find all my Office applications stacked on the primary monitor?

Amazon 'punishes' sellers who dare offer lower prices on other marketplaces

Richard 12 Silver badge
Unhappy

Re: Prefer to pay more, sometimes pay less

In some cases I've found that's actually because the Amazon seller is a fake, who has simply copied the name and product images from the real online seller.

Don't know how common that is, but it's very obvious that Amazon's process is failing almost as badly as ebay at spotting fakes, even blatantly dangerous ones.

NASA reshuffles dates for Artemis I launch attempt

Richard 12 Silver badge
Meh

Re: Reading the corner cutting...

There are some who aren't entirely convinced that would be a bad thing, per se.

Red Hat says staff can stay away from the office forever

Richard 12 Silver badge

Re: If it's anything like where I work...

Nothing to do with WFH.

There have always been people who don't bother doing their jobs and rely on their colleagues and/or underlings to do the work.

In some ways WFH actually gives the slackers less chance to hide, as they can't rely on pointless presenteeism or buttering up the boss quite as much.

Demand for software experts pushes tech salaries higher in UK

Richard 12 Silver badge

Re: Ehrm, What is the Problem

The pile of abuse above shows where part of the problem lies:

There's a lot of men in IT who think that any woman is not there on their own merit.

This (and outright misogyny) then leads to abuse, both direct and indirect - also proven repeatedly in multiple studies.

Which of course means women leave the profession, because WTF would you stay in a career where a significant number of your coworkers and managers continually undermine you?

There is also an important difference between equality and equity.

Richard 12 Silver badge

Re: Life should be a meritocracy

That's a straw man and ad hominem, and you know it.

Richard 12 Silver badge

Re: Imbalance

Go back 20 years and you'd be saying women don't want to be surgeons.

30 and women don't want to be doctors

40-50 and men don't want to type anything

60 years (I think) and men don't want to work in computer programming, only algorithms.

Given that all the above are long proven false, why are you so certain now?

Backblaze thinks SSDs are more reliable than hard drives

Richard 12 Silver badge

Re: The choice isn't really about reliability

Missed the point.

Reliability matters, but not for the data (it's a boot drive, the data is a clone of a million others). It matters for the downtime.

Losing the boot drive takes out the server for a few hours, and consumes the valuable in-person time of a technician to go and physically swap it out.

Richard 12 Silver badge

Re: SSD is still a physical storage device

The published specifications are typical bathtub curve, with the "high failure rate" occurring at around 50-100 years old in a write-rarely read-continuously situation that is a typical server boot drive.

It's nice to see that the specification isn't wildly wrong.

Storing logs on the drive will greatly shorten the lifetime, how much will depend on how the OS and drive firmware handles appending.

We had one batch of drives with a firmware fault that killed them within a few weeks of taking logs, as they did a full block erase-write for every tiny log line...

OVH opens less flammable datacenter at site of 2021 fire

Richard 12 Silver badge
Holmes

Re: "the lack of [..] an automatic fire extinguisher system"

You mean it's almost like they just filled an existing office building full of kit and never hired a fire protection engineer to risk assess.

Blue Monday for Blue Origin as rocket bursts into flame

Richard 12 Silver badge
Flame

It's going to hurt sales

While the emergency separation is rather more survivable than staying with the booster, it's seriously violent.

If there had been any passengers aboard, they would have been injured. And if old (like most billionaires), they might never really recover - or even die as a result.

While customers have of course have been told the risks, watching the capsule rip itself away from a fireball then decelerate hard (both many Gs) makes it feel more real.

Hybrid work not working? Try building an 'intraverse' to fix it, says Gartner

Richard 12 Silver badge

How do Gartner still exist?

Seriously, who pays them and why aren't they spending the money on something useful, like pizza and donuts for the staff?

NASA picks a tailor for Artemis moonwalking suits

Richard 12 Silver badge

Re: Robotics

Can't do that on Mars.

The entire point of sending people back to the Moon is to practice manned exploration in a location where it's possible to scrub the mission and come home in a few hours to a day (survivable with only emergency O2 bottles), as opposed to several months.

The other reason is of course because it's feasible within a political cycle, while Mars is not.

As to why people?

Partly because humans explore. It's what we do and why we're the most successful large animal on the planet.

And partly because a human can slap a bit of gaffer tape on a broken bit and continue, instead of scrubbing the mission.

Richard 12 Silver badge

Re: Now you think of a suit?

The SpaceX suits are just balloons.

They have one purpose, and that is to save the life of the occupant should a loss of cabin pressure occur.

You can't do any real work in them in a vacuum. Can barely bend your elbows, fingers won't work etc.

In sci-fi terms, they're pretty much the emergency rescue bags you shove someone into when there's no time to put on a proper suit.

Great to have, but not a space suit.

SiFive RISC-V CPU cores to power NASA's next spaceflight computer

Richard 12 Silver badge
Boffin

Re: In these apps speed and feature size are way less important.

Missions beyond LEO need a lot of on-board processing simply to navigate and aim the instruments. It cannot be done remotely.

A flyby of a moon can last a few seconds, during which the spacecraft needs to do a huge amount of work to ensure all the instruments can collect as much data as possible.

The more accurately the instruments can be aimed, the more sensitive they can be.

It'll then spend the next few weeks uploading, then go to sleep again for months.

There's also the need for rapid "find the most interesting spots" during approach. There might not be enough time for such targeting data to be sent back from the spacecraft, a human rapidly pick which places look the most interesting and send the list back.

If the spacecraft can be told "look for things that look like this - or just surprising" perhaps it can do the fine targeting itself.

Unhappy about excluding nation-state attacks from cyberinsurance? Get ready to pay

Richard 12 Silver badge

Re: Excluding them makes it worthless

By the normal "acts of war" definition (state declared), the only cyber attacks that have ever been acts of war are the ones perpetrated by Russia upon Ukraine.

Excluding state actors would also mean things like refusing to cover a police car crashing into your building, leaving it to you to recover the costs from the police without any assistance.

On the other hand, perhaps killing off the entire ransomware insurance industry will take out the ransomware industry too.

Richard 12 Silver badge

Excluding them makes it worthless

As it immediately means the vast majority of claims will not pay out.

You can't have it both ways, Lloyds.

The crime against humanity that is the modern OS desktop, and how to kill it

Richard 12 Silver badge

Re: Too many or too few desktop UIs

You can update iconography without throwing away usability.

Since Win95, many would say the only significant improvements to the Windows shell have been:

- Type-ahead find.

- Better typography/font rendering

- Pinning items to the taskbar (not quicklaunch)

- Taskbar "badges" and "progress" indicators

Possibly also the "show desktop" button, system tray indicators and a few other smaller additions that some will like.

The only removal that was an improvement was Quicklaunch, and that was only because pinning serves the same purpose while being harder for developers to abuse.

Most of the other changes have been cosmetic, which is fine, or actively harm usability, which is not.

Richard 12 Silver badge

Re: Agree and disagree

Try Start, Esc, Alt+F4, Enter

The first part gets focus onto Explorer (task bar), so Alt+F4ncan shut down.

I think this has worked since XP, but it might be older.

Richard 12 Silver badge

Re: It does suck

There are several things in Win 11 that are demonstrably long-proven to be crap, actively user hostile and ought to have out some Microsoft manager on a desert island with a single bullet.

To name two:

- You do NOT move important UI items between interactions. Show/hide is fine, but never move. (Muscle memory)

- You put the most important pointer-driven items in the corners. (Easiest to hit.)

Both of these also apply to touch - corners can be found without looking, and everybody hates it when stuff moves out from under them.

Bye bye BoJo: Liz Truss named new UK prime minister

Richard 12 Silver badge

Re: Please don't take this the wrong way, but

Pensioners are one of the major Tory heartlands.

It's very odd that they seem hellbent on killing off about 1/4 of their voters.

Richard 12 Silver badge

Re: Lol...

Of a group that are sufficiently interested that they joined a political party.

Either they're actually dead or they can't bring themselves to support either of the available options.

No idea which group is larger, of course...

Convicted felon busted for 3D printing gun parts

Richard 12 Silver badge

Re: Can any American gun enthusiasts please explain

Produce sufficient evidence to have a trial.

This is called "rule of law", and is something MAGA Republicans are utterly terrified of.

Otherwise, stop spreading unfounded rumours - accusations like that are not protected speech, there are civil and (in some cases) criminal penalties for that kind of thing.

Anyone hear the rumour that Ghostman lied on their form 4473? It's got just as much to back it up.

Google, YouTube ban election trolls ahead of US midterms

Richard 12 Silver badge

Re: the point here is how Twitter reacted

There have been larger trials and meta-studies since.

Ivermectin has no detectable effect on covid.

This is a very good example of journalists (term used loosely) causing panic by not understanding how science works.

They didn't understand what they were reporting, and never bothered to follow up the story later when it was shown that it didn't work.

Really, any place that reports "compound X cures Y" should be forced to report all followup studies with equal prominence.

Richard 12 Silver badge
Mushroom

Re: Try a little critical thinking

No, Presidents cannot.

Declassification has a deliberately longwinded process, including redaction and similar.

The President is not able to wave their magic wand over a box and declare it unclassified.

There are also several types of classified information that the President cannot declassify under any circumstances whatsoever.

It also only affects the sentence, not the crime. Trump took government documents (confirmed by Trump) and refused to return them (also confirmed by Trump)

Nobody is permitted to do that. Those documents are the property if the USA, not any individual. The archivists will find you and they will get them back.

Chances good for NASA Artemis SLS Moon launch on Saturday

Richard 12 Silver badge
Mushroom

Re: Rollbacks & Paranoia

The whole thing is now disposable.

This is the last hurrah of the Shuttle engines and SRBs.

One bit I really don't understand is why they're not recovering the SRBs. They even had to make new endcaps specifically to remove the capability.

There was early talk of catching a detachable engine block using a helicopter, but that was unsurprisingly quietly dropped.

TBH, a lot of the design feels very much like they know damn well the SLS will be cancelled before they've used up the warehouse full of Shuttle main engines and SRB casings, and don't care that they'll have learned nothing about engine design and precious little about anything else by then.

On the other hand, it'll be spectacular, and will hopefully inspire more people to keep funding NASA et al so the Moonbase and Mars trips happen anyway using the commercially viable launchers later on.

Here's how 5 mobile banking apps put 300,000 users' digital fingerprints at risk

Richard 12 Silver badge

Here's the list of safe apps:

(null)

Richard 12 Silver badge
Pirate

Re: How are you supposed to do the auditing?

That won't tell you what's being transmitted.

Or whether the keys used can open other boxes, which is the main problem highlighted here.