* Posts by Crazy Operations Guy

2513 publicly visible posts • joined 29 Jun 2009

TweetDeck XSS flap: Miscreants flash their naughty bits at users

Crazy Operations Guy

This was bound to crop up eventually

I wish that they'd put some sort of protection against this kind of thing into the HTML spec, some sort of tag to mark a section to be text-only and should not be executed or rendered. To prevent XSS attack, you could always dynamically create a 'check code' at serving time. Or maybe use a length setting. Or both.

Something like this:

The source file would look this:

<NoExecute> (data to be displayed) </NoExecute>

and would be sent to the client as:

<NoExecute check=asgdy8y3894he98hqwdh> (Data to be displayed) </NoExecute check=asgdy8y3894he98hqwdh>

-or-

<NoExecute length=256> (data that has been padded to be 256 bytes in length) </NoExecute>

Something like this would solve a lot of problems and will help alleviate a lot of security issues where the user is allowed to enter arbitrary data.

Feedly DDoSed by ransom-threat crims: 'We refused to give in'

Crazy Operations Guy

Too bad Deep-packet inspection has been abused

I've always wanted ISPs to deploy Deep-packet inspection for the sole purpose of identifying malicious traffic and either blocking/throttling the connection if its from another ISP/NSP or redirecting the customer to a remediation site with free anti-virus, removal tools, help articles and local computer repair shops.

The problem is that ISPs can't be trusted to not turn around and use this same technology for advertising or throttling services like Netflix or Hulu.

SLOW DOWN: Insecure-by-design software on road

Crazy Operations Guy

"Let's hope the hordes of folks apparently contemplating new “things” learn from this incident"

But security gets in the way of innovation; how can developers connect toilets to instagram when they have to waste time with pointless tasks like 'setting a password' or 'disabling unneeded services'

Google to acquire satellite eye-in-sky Skybox for $500m

Crazy Operations Guy

Does Google even have a business plan?

With all these acquisitions, I am doubting that Google actually has one. What is their goal anyway? Are they a search engine, a car company, handset manufacturer, operating system vendor, advertising agency, or what?

From what I've seen, I think their business plan is "throw money at cool stuff, something is bound to make money"

'CAPTAIN CYBORG': The wild-eyed prof behind 'machines have become human' claims

Crazy Operations Guy
Joke

Screw artificial intelligence

We should be finding a way to install actual intelligence into Captain Cyborg.

Egghead dragged over coals for mining Bitcoin on uni supercomputer

Crazy Operations Guy

A fitting punishment

He should have to do the same number of calculations by hand as the computer did for mining.

UK govt preps World War 2 energy rationing to keep the lights on

Crazy Operations Guy

Actual preparation for the future

I've always been of the thought that the best solution for the energy sector would be to build plenty of high-capacity nuclear reactors with the unneeded capacity being shunted to a sea-water processing plant that produces fresh water and extracts hydrogen, deuterium, tritium and other useful chemicals. This would provide fresh water for the future when it has become so much scarcer than it already is (Or at least emergency coolant for the reactors). Extracting hydrogen and related isotopes will greatly help when fusion power is ready for production or at the very least reducing the price for hydrogen-powered cars and hydrogen-burning power plants.

This would certainly be a long-term investment, but the pay-out will be huge with benefits to society and humanity. We need to stop thinking short term or relying on future generations to solve our problems.

Cisco COO: 'I actually thank God that we had a crisis'...

Crazy Operations Guy

Re: I think they still need to make some cuts

Yeah, but what happens when your office grows and need more of one of those features? You are going to have to shell out quite a bit of cash to get a bigger device for all that, or a separate appliance and increase the cost of managing it all. This is where a lot of customers decide to ditch Cisco and go with ShoreTel, Palo Alto Networks, or whatever company is offering better prices; and why there is a pile of Cisco gear in my customers' offices.

While those routers offer good features and good performance on the inside, the WAN side is too slow to use at any of their locations, they've been growing rapidly and need more WAN bandwidth than the Cisco ISRs they have can offer. This is why I proposed the idea of a blade form factor for everything, the routers could have been kept in place and Cisco would have one more happy, loyal customer. Rather than buy all new equipment (And replace it all again in a year due to projected growth, spending even more), they went with HP's networking gear who were offering discounts steep enough that they could replace the HP kit every year for the next 5 years for the price of one replacement cycle with Cisco (HP offered such a steep discount due to the customer getting all their laptops, desktop, servers, printers, etc. through them)

Crazy Operations Guy

I think they still need to make some cuts

Such as why they have both the Catalyst and Nexus lines of switches, they're both data-center grade and compete in the same space. Its seems to fairly common with Cisco that multiple product lines will do the same thing but be slightly different in some small way.

What I'd like to see is everything move to be blade-centric. Where you can take a switch blade from a high-end many-blade chassis, slide it into a 1u chassis and make an access switch. Or get a 2-blade chassis, a router blade and a 24-port switch blade. Bam, now you have all the networking you need for a branch office in a small, convenient package. Or a company outgrows a switch, simply just move the blades into a bigger chassis and now they have more capacity and only had to buy a new chassis.

Having a common form factor for all products would radically decrease development time and manufacturing costs. It would allow them to get customers hooked early and give them a well-defined and easy upgrade path.

Facebook, are you listening? Fusion-io chucks 6.4TB 'Atomic' flash kit at world

Crazy Operations Guy

Re: Price for the curious?

All of yours and those of your children and possibly your parents' too, if Fusion-IO's previous prices are anything to go by...

Crazy Operations Guy

Re: So what does Facebook have to do with this?

Didn't know that, would have been nice if it was pointed out in the article...

Crazy Operations Guy
WTF?

So what does Facebook have to do with this?

Other than the blurb at the end, what the hell does Facebook have to do with a product release from some other company? From what I've read about Facebook architecture, they are quite happy to just use custom built hardware based on cheap, commodity parts.

Has Google gone too far? Indie labels say it's crunch time for The New Economy

Crazy Operations Guy

"Indie Labels"

Umm, what? Isn't that a contradiction of terms? I thought that independent meant that the band was without a label and publishes thing themselves. Or did the music industry change when I wasn't looking...

China puts Windows 8 on TV, screams: 'SECURITY, GET IT OUT OF HERE!'

Crazy Operations Guy

Re: How many times...

Whatever happened to 'Red Flag Linux' anyway? Wasn't that also based on Ubuntu?

Crazy Operations Guy

"This gets messy with code signing involved."

Not at all. The code signing section is just a piece of metadata stuck to the binary and can be stripped without difficulty. This was done to enable signed executables to be able to run on machines that don't understand code signing without needing to modify the file.

Crazy Operations Guy

If the government hates it

Then the people will love it.

I think most of the Chinese government's problem can be boiled down to "Microsoft can't spy on our people; that is *our* job!"

Security stock slinger Symantec speeds up with latest Backup Exec

Crazy Operations Guy

Re: "< /dev/urandom"

I could use urandom, but then how am I going to get my customers to buy R2?

Crazy Operations Guy
Joke

Re: Fast?

Recovery is easy:

< /dev/random

It'll probably give you better results than Backup Exec normally gives you.

US bloke raises $250k to build robo-masturbation device

Crazy Operations Guy

"female personality or it's bound to get a head ache"

Depends on which definition of 'head ache' you are using...

Crazy Operations Guy

Re: Down with this sort of thing

Not the whole human race, just the wankers. Although we'd have to find a way to keep the government from collapsing due to lack of new politicians...

Crazy Operations Guy
Gimp

A few years back I worked with a woman that was really into AI and machine learning; her partner was a neurologist. She built an AI that would take data from various skin sensors (Salinity, blood flow, temperature), an EEG, and an EKG machine. The AI would then take this input and use it to control toys attached to robotic arms to stimulate nerve clusters in specific ways that would produce the best experience base on feedback from the sensors.

Last I heard, she was trying to get funding to reduce equipment needed, especially trying to get it so it was no longer a tangled web of cables and taking less than an hour to get hooked in.

Remember Anna Kournikova? Come with us on a tour of bug-squishing history

Crazy Operations Guy

"Epic"

Can we please stop using this word? The word has lost all meaning at this point by its overuse by the younger, unprofessional crowd. It breaks my heart when a professional journalist uses it and ends up sounding like some teenager that plays World of Warcraft all day...

Failover in FOUR SECONDS? HP's SAP-specific iron hits the streets

Crazy Operations Guy

Re: Wow!

Even 256 GBs is ridiculous for an SMB. I've seen SMBs where all of their servers combined added up to about 256 GB of RAM. Although I suppose it depends on what qualifies as an 'SMB'...

Amazon workers in Germany celebrate strike anniversary with ... ANOTHER STRIKE

Crazy Operations Guy

Re: The final solution

Exactly my thought. I've been seeing a lot of shops installing self-checkout systems in response to increasing wages and other staffing costs.

Its even easier to implement automation in a warehouse since most items are in a regularly shaped box and would be trivial for a robotic arm to grab it. Attach an arm to a rail on the top of the shelves and a conveyor belt along the bottom of the shelves. Add another set of arms and conveyor belts to automate the stocking process. Add unique RF-ID tags or bar-codes to every item and you could potentially automate the packaging process as well.

All you'd need is a couple laborers to handle packing of irregular items, a few technicians to fix an maintain machinery, a manager or two to watch over the people and some security guards; monitoring of the machinery can be done via a bunch of cameras and other sensors watched over by an off-shore team.

The only reason humans are still being used for these tasks is that they are cheaper than robots, but that balance will tip in favor of machines in not too much time.

Google to plonk tentacles on 'unwired' world with $1bn launch of 180-satellite fleet

Crazy Operations Guy

Re: Flies Over the Great Wall

They'll just shoot them down, they've already demonstrated that they can[1]. They could also hack into the control units of the things and de-orbit them, or jam/DoS the up-link and/or down-link. There are many other things they can do.

[1] http://news.bbc.co.uk/2/hi/asia-pacific/6289519.stm

Microsoft lobs Files app at WinPhone users with lots of ... uh ... files

Crazy Operations Guy

Re: Apple

That is what I've always hated about Apple's systems: hiding things form the user. It seems their UI model is: "Don't worry your pretty little head about that, here play with these shiny bits instead"

Oi, ebook price fixer. Yes, you, Apple – stop whinging and get your chequebook out

Crazy Operations Guy

Nice hole you're digging for yourselves Apple.

They should just pay the damn fine before the judge gets tired of Apple's shenanigans and raises the fine into the billions of dollars, its not like they'll miss the $840 Million anyway...

IT'S ALIVE! ISEE-3 responding to commands

Crazy Operations Guy

Re: Bah!

The group has written permission from all the various agencies and owners of this satellite to take control of it. So long as they don't do anything nefarious with it like ramming it into something or cause interference with other spacecraft, they'll be fine legally.

Clingy fondleslab owners TORPEDO industry forecasts

Crazy Operations Guy
FAIL

When have 'Industry forecasts' ever been right?

Every time I see some forecast from IDC or whomever, it ends up getting followed up with "Well, I guess we were wrong, but here is a list of excuses we didn't see coming but everyone else did"

Seriously, how can anybody not take into the account that when people pay over $500 for a tablet that they are going to give it to someone else rather than have it collect dust in a drawer? Especially since current tablets aren't all that much better than the previous model, which still work quite well for most uses.

Valve says no Steam Machines until 2015, fingers crossed

Crazy Operations Guy

Re: What's wrong with these people?

I was going to say the same thing. They committed to completing this years ago, or at least HL2:Ep3 (didn't they say they were switching to the episode model to avoid this exact situation?). I can't count all the boondoggles they wasted time on, off the top of my head, there is the Linux initiative and the 'Big Picture' feature. Adding more features is all well and good, but you should at least complete your commitments first.

May whatever god they believe in help them should they ever try to go public, missing important commitments and spending resources on profit-less projects like this is a sure way to end up with a share price of zero and the FTC/SEC/IRS/SS/DoJ crawling up your ass for fraud and misconduct.

MH370 'pings' dismissed as false positives

Crazy Operations Guy

Re: Easier than doing real journalism

No, CNN is too busy covering Donald Sterling. Who cares about 250 people when a celebrity did something?

LulzSec turncoat Sabu avoids jail time thanks to co-operating with Feds

Crazy Operations Guy

"guidelines of 259 to 317 months imprisonment.

Why not just say 21.5 to 26.5 years? At this scale, and given how much those numbers change throughout the sentencing hearing and the sentence itself, does this much accuracy really matter?

GSMA: There are more mobile connections than people... but who's hogging them all?

Crazy Operations Guy

Re: Monitored house alarms.

SIMs are also in traffic lights, environmental sensors, power control systems, emergency vehicles, buses, Telco roadside boxes, etc. You also have this Internet-of-Things fad that is taking a lot of SIM cards as well. You also have GSM-to-Serial port adapters for managing remote networking devices.

And this is just what I've seen today, there are a lot more applications.

After the cyberpunks, prepare to fight a new wave of nasties

Crazy Operations Guy

Re: need a new agency...

I know its a joke, but, yeah we certainly need something like that. Although it might be better as an international group with cooperation from IANA/ICANN and Interpol. Probably build it out of employees from various security companies and ISPs with an oversight organization filled with Government employees from the US's FCC, UK's OfCom, etc.

Microsoft Cortana EULA contains the Greatest Disclaimer of ALL TIME

Crazy Operations Guy

Why do people want voice assistants anyway?

Whenever my coworkers try to use one, they end up fighting it for a couple minutes because it can't understand them for one reason or another. Half the time it ends up calling random people we work with or adding appointments to their calendars. I usually just type whatever we are looking for into my phone and then just enjoy the Sisyphean display going on in front of me.

New XSS vuln hits eBay as rubbish passw0rds persist

Crazy Operations Guy

So many stupid pssword restrictions.

A proper hashing algorithm is just going to digest the password and turn it into a fixed-length string of hex characters. It shouldn't matter what or how much you cram into the password field. The hashing algorithm should just see the password as a series of bits, nothing more.

Whenever I see restrictions like this, it just screams "here be exploits!" and far too many times I find that the site is vulnerable to even the simplest of SQL injection attacks.

Crazy Operations Guy

Re: A half-million in fines ? Who cares ?

Most consumers are idiots (especially on eBay) they'll forget about this the second a celebrity does something (such as saying something stupid or even just existing).

eBay slammed for daft post-hack password swap advice

Crazy Operations Guy

Re: "One extra step"

The people I would want to be able to access the file are barely technically literate enough to open the file, adding that extra step of figuring out which file to rename is just going to cause problems and delays. This is also why I only have two files on the shared device: The password database and a portable copy of KeePass. It becomes pretty obvious what the database file is. I did this so that if the KeePass project dies or the file format changes too much, they can still access the database without any trouble.

Besides, I change all my passwords every 90 days (You get used to it after a while), if a attacker has the capability to crack the file in that little time, they wouldn't be stopped by a triviality like a changed file extension. I haven't done anything to get anyone with those kinds of resources to waste that much of them on me, of course they would just go the easy way and get an (illegal) court order from the FISC and get my data right form the source.

Crazy Operations Guy

Preventing certain characters is the most annoying thing ever.

In a properly implemented system there is no reason to prevent the use of any characters in a password. The password should just be pushed right into the hashing algorithm and converted to hex right away.

I suspect that a lot of bad passwords are created because of weird draconian restrictions like 8-16 upper or lower case letters only.

I used to use various Unix and SQL commands as my passwords as they were easy to remember, sufficiently complex and would be very hard to pick out via key logger.

Crazy Operations Guy

Re: ebay's password policy ...

I went a more secure route and stuck all my passwords in a KeePass file stored on a shared cloud drive with the password to the file on a piece of paper in a sealed envelope stored in my safe deposit box along with the deed to my house, wills (both regular and living) and some other very important documents. The key has been entrusted to my attorney.

This way someone won't just stumble upon my password by rifling though papers (As kids are wont to do) and I can update my passwords in a matter of seconds while still allowing family and trusted persons to get to my data in case I am incapacitated.

Expulsion from Garden of Steven: Apple staffers tossed out of Fruit Loop

Crazy Operations Guy
Thumb Up

Re: Traffic

That assumes you aren't still stuck in the sea of tail lights that is the highway. During the time I was there, it would have been faster for me to walk than to drive on 101 at rush hour.

Malware-as-a-service picks Android apart

Crazy Operations Guy

Re: Alternatively...

I already use an non-android device, and yet there are still security vulnerabilities and malware.

Every platform sucks for one reason or another. With Apple you are pretty much just renting it from them; Android is highly variable between manufacturers and TelCos; Windows Phone means that if I want to have work e-mail on my phone, the phone is now pretty much property of my company; and Blackberry might not be around tomorrow. And all of these platform have security vulnerabilities, Android is just prevalent so it gets reported more often.

Crazy Operations Guy

With the proliferation of malware on Smart phones now, I think I might just dig my old Palm Pilot (Tungsten W) with phone functionality from the drawer and use it instead...

IANA starts handing out recovered IPv4 addresses

Crazy Operations Guy

Re: Sitting on the 9.0.0.0/8 here

Something tells me that HP won't need both 15.0.0.0/8 *and* 16.0.0.0/8 (acquired from DEC via Compaq) And then there are the huge ranges the US military has when its all on private lines and has very rarely been seen on the Public Internet.

I can understand a large cloud provider like Amazon needing that many, but certainly not the likes of Du Pont, Ford or Xerox.

Rubber-glove time: Italy to probe TripAdvisor over 'fake reviews'

Crazy Operations Guy

There isn't a good solution to fraudulent posts

It becomes an arms-race between he website trying to get rid of fraudulent posts and the companies hired to manipulate the reviews.

You could hire professional reviewers, but they cost a lot of money, can be corrupted and only have a limited view of what they are reviewing.

The least terrible solution I've seen uses a combination of a 1-10 system and a 'useful / not useful' rating attached to the review itself. Reviews with no or a low ratio of "useful"s to "not useful"s isn't counted in the overall rating of the product. It could still be gamed, but its better than most other systems I've seen.

EE boffin: 5G will be the LAST WORD in mobe tech – literally

Crazy Operations Guy

"5G will be the enough"

Yeah, just like how no one is ever going to need more than 640k of RAM...

US giant NBC 'leaks' PRIVATE Amazon keys in Github Glenn gaffe

Crazy Operations Guy

Why the crap are they using GitHub in the first place?

NBC Universal is part of #46 on the Fortune 500 which pulled in 6.2 Billion dollars in profit last year, so why in the holy hell are they using some 3rd party service to store their most sensitive pieces of data. A company that size must have at least 1 internal document management system like SharePoint. Anything internal at all would be so much safer than any 3rd party service, at the very least you;d be able to have a definitive list of whoever has access.