* Posts by foxyshadis

389 posts • joined 17 Oct 2006

Page:

Good news, OpenVPN fans: Your software's only a little bit buggy

foxyshadis

Those are bugs?

"....here are the bugs the review did turn up:

* There's a buffer library API that handles dynamically allocated memory safely;

* Wrappers like strncpyt() and openvpn_snprintf() protect unsafe C standard libraries by protecting against buffer overflows and unsafe NULL termination; and

* Keys and other sensitive data are securely wiped from memory to prevent information leaks."

A bit more explanation might be needed?

9
0

BDSM sex rocks Drupal world: Top dev banished for sci-fi hanky-panky

foxyshadis

Re: Dries Buytaert is a joke

One of the first things they pound into HR's heads is that you can't bring up why someone left, or you can be faced with a lawsuit. He brought up that it was all over being Gorean, HR (or in this case, the lead) can refute the specific claim, but they still don't get to air all the dirty laundry, especially if there's a lot of bickering and he-said-she-said.

To me, it sounds like he was involved in a lot of internal strife, and it was him or someone else (or maybe even both). It's perfectly reasonable to fire someone who is causing office issues, unless it's for being a protected class.

5
1

Can you ethically suggest a woman pursue a career in tech?

foxyshadis

Uber and Oracle

Two of the most sleaziest and most hated companies in the entire industry, by men and women alike, and they just happen to be your only two examples. There certainly are more out there, but the fact that the tabloid-headline-grabbing excesses of a mere _two_ companies out of the hundreds of thousands of companies that employ IT and software devs points more to shallow thinking and reaction to headlines than a reasoned position.

20
2

Public IPv4 drought: Verizon Wireless to stop handing out static addys

foxyshadis

I wonder how much of the IPv6 resistance...

...came from the ludicrously long public addresses and the insistence that all internal addresses be external addresses. It's IANA's fault, they began the idiotic policy of beginning all registrations with 2001:0200::/23, then 2001:0400::/23, etc, so all public addresses start ugly and painful. Only in 2006 did they start allocating 2400::/12, 2600::/12, because everyone HATED the old scheme. Then ISPs do the same thing with their allocations, so you get to start off with something like 2601:201:8201:9390::/56 (my actual Comcast allocation) before you can even start using your own digits.

Then there was the constant drum-banging for a decade about how "NAT is evil, NAT is not security, NAT is a kludge." The entire reason that IPv6 is 128 bits instead of 64 bits is that NAT was supposed to go away forever, and we would all be in the glorious world where every network-connected device is public again.

Of course NAT is one layer of security, and admins actually don't think allowing all of their PCs to be publicly accessible for the latest vulnerability du jour is a good idea! The bad taste of that crusade and the related overengineering probably retarded IPv6's growth by a decade.

0
0

'I'm innocent!' says IT contractor on trial after Office 365 bill row spiraled out of control

foxyshadis

I guess you've never worked as an independent contractor, where the rule is to acquire the licenses first, then bill the entity on a cost-plus basis for the time involved. After all, most jobs are legit and pay on time, and running around with a client's credit card is seen as a serious faux pas.

Most likely the tech really did shoulder the £62K on his own; he says he already billed them and had proceeded to a civil suit before cutting them off, so what more do you want from him?

62
0

IT guy checks to see if PC is virus-free, with virus-ridden USB stick

foxyshadis

Re: Not work but...

Once you see how bad it is, it's a lot easier to just boot it up with a usb/cd of the new OS, clear partitions, and start fresh. Fighting for control is a lost cause.

27
0

Dear Microsoft – a sysadmin's wishlist

foxyshadis
Coffee/keyboard

Drunken Dr. Seuss

I am amused by the juxtaposition seen in this article.

https://www.dropbox.com/s/ah9edhmdxz9c39s/drunken-dr-seuss.png?raw=1

0
0

Mumsnet ordered to give users' real life IDs and messages to plastic surgeon they criticised

foxyshadis

Re: Errm ...

"UK libel law is something I don't understand. Now you have to be able to prove everything you write, even in private. Absurd."

Slander, the spreading of defaming stories in private, has been a tort in Common Law far longer than the UK has had colonies, and is much the same in the US. This isn't UK libel law, it's UK defamation law, encompassing both public and private statements.

5
1

Naughty sysadmins use dark magic to fix PCs for clueless users

foxyshadis

Re: "Mechanical Sympathy" and magic

Many years ago, Microsoft RDP and Citrix had an odd bug that sometimes caused a modifier key (shift, ctrl, etc) to stick despite being unpressed. Ever since then, I've always had a habit of running a finger across all the modifier keys just in case, when a password doesn't work the first time, to "remind" the system of the actual state of the keys. It seems to work! I rarely mistype my password twice in a row. ;)

5
0

After promising Donald Trump jobs will come home, IBM swings axe

foxyshadis

Re: The last trump?

That name would be tantamount to high treason, a hanging offense....

It'll obviously be Republican People's Republic of North America.

2
0

Galileo! Galileo! Galileo! Galileo! Galileo fit to go: Europe's GPS-like network switches on

foxyshadis

Re: Meh!

Think of it more as adding 50% more satellites to the GPS cloud -- 100% more within a few years. Significantly better accuracy for the whole world, no chance the US could one day say "not yours."

4
0

Ghost of DEC Alpha is why Windows is rubbish at file compression

foxyshadis

There were never any big instruction set changes to the Alpha, once it was done it was done, later revisions just sped up the chips. DEC/Compaq fronted most of the money and half the engineering to make it happen, because their customers wanted it. It was far more than a marketing ploy, but once Compaq threw in the towel, there was no way Microsoft was going to shoulder all of the burden.

The speed challenges were always more about the crappy compiler, anyway; Microsoft's Alpha C compiler was worse than UNIX ones, and much worse than its x86 compiler. (Which if you've used VC6, is saying quite a bit!)

1
0
foxyshadis

Back in 2003, when I first made the attempt to offline compress the OS, it was an absolute night-and-day performance difference in startup and daily use, thanks to how crappy hard drives of the day were. I didn't say on the full disk, I just said to use it by default; Microsoft could have improved almost everyone's experience for little effort, even if it was only for the Windows and Program Files folders.

Now I have an SSD, and only enable compression on disk images and the OS to fit a little more until I can upgrade it. Performance difference is pretty much zero, when I've benchmarked, because the overhead of compression was designed to be low for 20-year-old CPUs -- it's undetectable now. (Unless you force LZX mode, which I'm too lazy to.) Sure, the SSD itself would compress for performance purposes, but it won't actually give you back any of that extra space.

For the external mass-storage disk, of course, there's little point in bothering.

The days of resource constraints that can be relieved by workarounds aren't behind us for everyone just yet.

0
0
foxyshadis

Re: One Step Beyond?

The first date in the Wikipedia article is 2000, let's go with that.

Oh, the Opteron didn't come out until 2003? Eh, shrug.

0
0
foxyshadis

I'm not sure that calling it rubbish is even all that accurate -- it's not bad for what it is, and competing modern options like LZO and LZ4 aren't much better, they're mostly just faster. It's annoying that they didn't include both a fast and slow compression, like they did with cabinets and wim, but I understand that they solved the 90% problem and going beyond that would just mean new UI work and lots more testing.

What's rubbish is that fact that it's not used by default on all installations since 2004 or so, by which point the disparity between CPU overhead and reading from disk had become completely absurd and file compression was rock-solid. Every OS since XP SP2 should have made it mandatory; it basically halves the overhead of OS and program installs, and is like a little extra space for everything else.

1
1

Two first-gen flaws carried over to HTTP/2, warn security bods

foxyshadis

Code Red WAS the digital Pearl Harbor. In fact, old folks might argue it was the Morris worm, and ILOVEYOU is another good contender. We've been at war ever since, and it's not getting any quieter, just new battlefronts opening up as old ones are won or lost.

5
0

Encyclopedia Dramatica user hit with £10k damages after calling ex-councillor a 'paedo'

foxyshadis

If it's indexed by Google, then you don't have to have heard of it or dabble in it to end up harmed by it.

5
0

By 2040, computers will need more electricity than the world can generate

foxyshadis

Yup, doesn't matter if the linear lines are on a log scale, real life has never followed straight trends. The P4/Power=>Opteron/Core2=>Arm transitions have probably each temporarily _reduced_ the world's computing power needs until device count caught up again; it's not unlikely that this will happen again at some point. That might be the laziest prediction every made.

2
0

Seagate in 10TB drive brand brainstorm

foxyshadis

What's the point of FireCuda?

I don't understand the Firecuda line. 1-2TB SSHD? You can fairly cheaply buy a real SSD to fill that gap, or an SSD+HDD combo to maximize your capacity and performance, instead of a premium-priced half-assed compromise. (Even most laptops have M.2+HDD combos now.) The market Firecuda is trying to serve is shrinking every month, and I wouldn't be surprised if the brand is retired after disappointing sales in the first generation.

0
0

Dell confirms price rise post Brexit vote as UK pound stumbles

foxyshadis

Re: No Problem...

Damn, you want an M.2, two drive bays, AND an optical drive? Geez, that seems a bit much for a portable unit. I found a 128GB M.2 + 1TB spinning rust was good, with an external Bluray reader in the bag in case it's ever necessary (only a couple of times), and today you can easily get 1TB M.2 and 2TB SSD or 4TB spinning rust, which is a pretty massive combined capacity without even needing a second 2.5 slot.

Nowadays you're starting to see laptops with NO 2.5 drive bays, so maybe it'll become a real problem someday, but those are still mostly the tiny super-tablets and ultraportables I have no interest in.

1
0

You know how that data breach happened? Three words: eBay, hard drives

foxyshadis

Degaussing hard drives has never been a workable data erasure method, despite it working so well with tape. Even back kin the 90's, you needed more magnetic power than any commercial electromagnet can provide, unless you have access to a weather radar unit, and they've only become better since.

https://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

1
0

Coders crack Oculus DRM in 24 hours, open door to mass piracy

foxyshadis

I think the reporter is a little bit confused, since the DRM was the hardware check, not a software check. This patch doesn't change anything about whether or not you can pirate a given piece of software, it's about whether you can actually play it with another headset once you get it, by paying or by piracy.

0
0

Salesforce.com crash caused DATA LOSS

foxyshadis

That's better than Amazon gives you ("Your instance went down! Too bad! Time to rebuild!"), but I thought the whole point of going to SaaS was that the vendor took care of replication so that server crashes with major data loss just wouldn't happen.

10
0

Compression tool 7-Zip pwned, pain flows to top security, software tools

foxyshadis

Re: More guidance please

7-zip ignores the file name when parsing it, so any .zip or .rar could potentially mask a UDF or HFS exploit. Obviously anything you have up to now wouldn't be a problem, you just have to carefully examine or decline everything new (or use another unzipper) until you upgrade to 16.x.

7
0

US Supremes to hear Samsung's gripes about the patent system after Apple billed it $550m

foxyshadis
Big Brother

Won't be 4-4

It's pithy to assume that the Supreme Court will break even because it does in some highly controversial cases, but if you look at its recent patent decisions, there hasn't been a single 4-5 decision in the last 16 years, and many are unanimous: http://writtendescription.blogspot.com/p/patents-scotus.html

7
0

Telling your wife why you were fired is the only punishment

foxyshadis

Re: If you don't want to be traumatised by people's pictures ...

You'd think having a strong stomach would be an occupational hazard; I've never met any tech who hadn't browsed /b/ out of curiosity, not to mention been linked to goatse and other things all their life. By the same token you'd think that in an internet awash in porn, you wouldn't need a little titillation from selfies, but apparent some guys have a stronger creep factor and need to know their spank bank in person.

2
0
foxyshadis

Re: I doubt it

What cops are going to fully believe the word of an avowed pedophile? He can blab, they can come by and ask some questions, but absent any corroborating evidence, the investigation would be dropped as an attempt to deflect blame.

Maybe if it happened a few times in a row, someone would issue a warrant, but if all the data's been long purged, there's not much they can do there, either.

1
1

You've seen things people wouldn't believe – so tell us your programming horrors

foxyshadis

Not so much your compiler, as every C/C++ compiler ever made. That is perfectly valid code, although modern compilers will spit out a warning if you enable all warnings.

0
0

'You've been hacked, pay up' ... Ransomware forces your PC to read out a hostage note

foxyshadis

I don't think "growing sophistication" and...

..."uses VBScript" belong together in the same description.

I don't see how writing code to encrypt network drives but disabling it indicates sophistication, either. Cryptolocker and Cryptowall were already doing that by the end of 2013, and they're 90% of infections.

1
0

Toshiba rolls out PC-busting monster: 1 terabyte TLC flash SSD

foxyshadis

Re: Why SATA?

You do know that SATA Express runs on the PCIe bus now, right? It's not limited to legacy 6 Mbps at all, though you CAN plug it in there for backward compatibility. SATA Express is about 16 Mbps, three times as fast as SATA 3.

Not that TLC was ever meant to be any kind of speed-demon anyway....

0
0

Reverser laments crypto game protection, says wares dead after 2018

foxyshadis

Re: Demos

"On planets where normal sale-of-goods laws apply. If you buy a tin of beans from Tesco today for 30p, and then tomorrow you find they've got a special offer and the same beans are 20p, you don't get to take them back and re-buy them at the lower price. If you bought them, then you bought them."

On what planet? Every Tesco I've set foot in will let you return anything but alcohol no questions asked, at which point you can walk back into the store and rebuy the same item. If the petrol and time is worth it to you then they aren't going to stop you. Some stores have more stringent return policies, but certainly not Tesco.

2
0

Mozilla warns Firefox fans its SHA-1 ban could bork their security

foxyshadis

I've known this for a while

Now all I really want is a list of sites that don't work, so I can either avoid them or try to pressure them to update. By now Mozilla must have done surveys and have a list or two.

6
0

Windows' authentication 'flaw' exposed in detail

foxyshadis

Resetting the password

It's not a one-click process, but Microsoft has a tool to do all the hard work for you:

https://blogs.microsoft.com/cybertrust/2015/02/11/krbtgt-account-password-reset-scripts-now-available-for-customers/

You have to reset it twice, but if you do that, it won't replicate; the script just waits until everyone's on the same page to do it again. You could conceivably set this to run every so often during lulls.

7
0
foxyshadis

You call yourself a sysadmin?

Use Google, educate yourself: http://terenceluk.blogspot.com/2011/05/wheres-krbtgt-account-in-active.html

If you're not a sysadmin, you probably don't have access to ADUC so don't worry about it.

3
0
foxyshadis

Re: And you still run Windows?

Thanks for listing all of those Active Directory alternatives. BTW, by far the most common alternatives are Samba and ApacheDS... which are vulnerable to this as well, since they're compatible with Windows AD. Pretty much all of the Linux alternatives are Windows AD compatible in fact! Novell eDirectory is about the only exception, and that's deader than a doornail, incredibly limited compared to newer software, and still requires occasional critical security patches.

6
4
foxyshadis

Re: Well, Ain't that dandy!

A visa is permission to enter, remain on, and leave foreign soil. Visa the company took its name from this, as in your visa to the retail world. (Or your visa to the debt world, only no one's going to revoke that.)

7
0
foxyshadis

That's idiotic

When Windows 2000 came out with Active Directory, would you be saying, "Oh look, of course Microsoft's answer to the unmanageability of multiple and large domains is to upgrade to their latest desktop and server, trust us, enable these new untested doohickies and pray"? Every OS version has added new management tools and new security protections, I don't know why that's such a hard concept to grasp.

12
4

Entropy drought hits Raspberry Pi harvests, weakens SSH security

foxyshadis

"Using /dev/urandom with a sufficiently seeded pool gives an identical outcome to /dev/random (instant return with good randomness) but in an insufficiently seeded pool, now returns instantly and leads to a predictable key."

Since urandom and random both use the same PRNG, the same broken PRNG in this case, it makes no difference whatsoever how much entropy you seed it with once you have enough. It'll be equally valid or equally broken either way, one is just much more flexible than the superstitious alternative. (And "enough" occurs early in the boot cycle, long before any certificates are generated.)

0
0
foxyshadis

Another Debian fail?

This is exactly the same problem that Debian had almost eight years ago, now another Debian-based distro does the same thing. How has it managed to repeat itself?

https://wiki.debian.org/SSLkeys

2
12

Industrial control system gateway fix opens Heartbleed, Shellshock

foxyshadis

They had to work pretty hard

To patch one problem only to make themselves even more vulnerable. Wow.

1
0

Sketch dev pulls out of Mac App Store, cites slow reviews, tech limitations

foxyshadis

Re: "App Review continues to take at least a week"

The only way I know of to do upgrade pricing on the Apple App Stores is by selling redemption codes on your own storefront, which is exactly the opposite of the friction-free experience the App Store is supposed to be all about. Really sucks for developers who want some income while being fair to customers, without going all the way into a subscription model.

4
0

WordPress.com ditches PHP for Calypso's JavaScript admin UI

foxyshadis

Re: wordpress is bloatware

Of all the many reasons to loathe Wordpress, the fact that it uses a few more tables is the dumbest I've ever heard. Oh no, my database uses 5KB more of my 150GB disk now! Oh no, my queries are faster and more manageable after I've written a few hundred posts and started using tags and comments! Whatever shall I do!

Face it, you didn't deliver what your client wanted because you thought you could fob off a half-ass project and convince them that was all they wanted.

5
1
foxyshadis

Re: Wordpress.com !== Wordpress

Most of the users wouldn't even switch, because they wouldn't even know an update was available, let alone that it was a new platform. Self-hosted Wordpress blogs are among the most abandoned and full of long-patched holes, which is why they're so heavily exploited. It's like running a Windows 2000 server today.

2
0

Behold, the fantasy of infinite cloud compute elasticity

foxyshadis

Re: so I can't see why this is worth an article?

Most El Reg op-eds are poorly researched rants, but they at least get interesting discussion going in the comments.

3
0

World's most frustrating televised Linux install just got more frustrating

foxyshadis

It's only frustrating

if you haven't completely ignored the most useless install the world has ever seen. In some ways it's like DOTA, but stripped off all the fun and team-play. Who gets invested in this?

1
0

So what's the internet community doing about the NSA cracking VPN, HTTPS encryption?

foxyshadis

The NSA just recommended dropping ECC

Which means that everyone should probably switch to ECC as soon as they can. The NSA is little more than a black-hat these days.

4
1

Google's .bro file format changed to .br after gender bother

foxyshadis

@ Jagged

Poe's Law is the only law on El Reg.

0
0
foxyshadis

@ Steven Roper

I appreciate that you were willing to put all of your paranoid delusions out front and center, so that everyone can see just how insane your persecution complex is. That's a rare and admirable quality in a commenter today, so many people just want to troll without heartfelt convictions.

11
6

Diskicide – the death of disk

foxyshadis

I love that last graph

It nicely sums up how content-free the article is (after first explaining the basics of HDD and flash). It's mostly either an extended exercise in wish-fulfillment or pulled right from the nether regions. I hope flash succeeds and comes downmarket too, I'd like to be able to afford more, but even at QLC 16nm I don't see how it's likely to fully compete with a combination of iterative SMR (and eventually HAMR) tech, and potential future flash competitors (memristors, if they ever get off the ground?).

Flash has probably reached the point where it can perform nearly all of most consumers' needs, but businesses' need for storage will seemingly expand to fill as much as they can afford.

3
0

PETA monkey selfie lawsuit threatens wildlife photography, warns snapper at heart of row

foxyshadis

Re: Utter Stupidity. Utterly Pissing Me Off.

Is there anyone left who thinks PETA is anything other than a collection of attention whores and elites enriching themselves? The only thing they care about is being in the news, no matter what the cause and how it's achieved.

3
0

Page:

Forums

Biting the hand that feeds IT © 1998–2017