Posts by Rune Moberg

Angry Birds won't work

Without gravity, the birds will never be able to hit any pigs, unless the pigs are located at a higher elevation.

Roxio should immediately design a few 'pigs in spaaace' levels to rectify this.

turd of gold

Actually... The character Roger, in the TV show 'American Dad', once laid out a perfect 24K cable (without realizing it himself) studded with valuable gems.

Kinda makes me curious who copied whom.

Spammers from h---

April 29th 2010, some ruddy b---- named Cecil Lee thought it would be funny to use my e-mail address to sign up for the PlayStation Network.

And after a while, after having received at least a dozen e-mails from this network, I must say I am impressed.

There is no "unsubscribe" link handy. It seems I must sign in using the account created.

Ah, but isn't there a "forgot password" function? Yes, press this and you are met with "The server is currently down for maintenance".

On the plus side, I am always up to date with all news concerning the Playstation Network, change of policies and whatnot. Too bad I do not own any Sony devices, except for a small handheld video camera. Maybe it will play the latest PS3 games?

Malware?

I just installed "Google Earth" from some website, and it installed a trojan called googleupdate.exe to my task scheduler. I have no idea what googleupdate.exe does, but I sure as heck did not ask for it to be installed!

Will google.com also warn against those, or will idiots like me remain totally unprotected also in the future?

Small cars are good for the environment

Toy cars like the ones pictured in the article are good for the environment no matter what fuel is used.

The cars are flimsy on the road, so there's a higher probability that they'll fly off into the road and hit a couple of trucks before finally finding a not so windy spot.

And given their lack of crash protection, that means the car's inhabitant will be dead as a door nail.

One less person to feed. One less person that exhales CO2.

Which is a win-win situation for the environment and the rest of us who refuse to sacrifice road safety. (I drive 700+ km weekly and never leave home without my Saab -- bullet proof and sticks to the road no matter what. Next week I'll get a new one that drinks E85)

DEP relies on digital signatures now?

"The attack also got around a second major defense that's known as DEP, or data execution prevention. The feature blocks the execution of code unless it has been digitally signed"

Nope.

DEP allows the CPU to check every memory page to see if it has been marked as executable. The application has access to a set of APIs to mark pages as executable (or not).

Digital signing OTOH means an entire module (such as an executable or dll) has been signed with a certificate of sorts. That way it is possible to detect if a module has been tampered with prior to executing this module. (or one could have a policy forbidding non-signed executables to load, like MS did with 64-bit Windows where all drivers now have to be signed)

“But it shows that just because that possibility exists on a platform doesn't mean that it's impossible to exploit. That's the key lesson here.”

The key lesson here is that if you do not mark ALL of your modules as ASLR and DEP capable, then you're screwed. ASLR was not compromised in the case described in the article; It was never enabled.

That said, the article do cover some basics correctly:

1) Less code means less exploitable surface (I've been saying this for years)

2) ASLR is still neat

3) Code needs to undergo some form of quality control and developers must be in control of their build system (so a module not marked as ASLR capable will slip by)

The biggest mitigating factor though, is that few users are admins these days. Today's malware rarely get to embed itself deep into the OS and is relatively easy to deal with.

And finally: Even this year I have observed more problems with AV than with malware. The "cure" is still worse than the disease. I also note that AV systems themselves present exploiters with an expanded attack surface. I am also greatful for a particular AV that alerted me to some malicious stuff that turned out to be an internet shortcut (a 238 byte text file) that was part of the Foxit reader installation. It was very useful to be alerted of such "threats".

I, for one, welcome our new perv overlords...

I find the current arrangement to be one of convenience. I've started driving my car more and am willing to spend days on the road as long as I don't have to be near any pervport (oh, that is "airport" to you).

You see, back in the day, pervs where everywhere as well as those hungry with power abusing their authority at every turn. These days they're all employed by pervports, so we normal people do not have to interact with them on a daily basis.

I'm currently waiting for the 2011 Saab 9-5, and once it arrives I'll be an even happier camper.

@AC "standard ports"

You missed my point by about a light year.

1) True, you should block specific ports. However, today most organisations block ALL ports, which... leads to your third point "but the way it is MISused by developers.". Well, *duh*! If your network is only open for http, then that is what most application developers will use! As a developer, you cannot use a nice and shiny peer-to-peer protocol when only http is allowed.

2, 4 and 5) I know. I've written several http servers from scratch myself.

Re-read my first post again. And THINK. If the security guys gives you peanuts, then what will you eat?

Do you want an application that is properly designed, or one that will actually work in most of the paranoid networks out there? My personal preference won't put much food on the table, so I close my eyes and use the tools at hand. From what I can tell, that is what everyone else is doing too.

Yeah, no, but

OK, so let us assume man-made global warming is an undeniable fact... I am surprised by all the focus CO2 gets. What about NOx and particle emissions? All this CO2 focus (part of a natural cycle and something nature seems to handle quite well) seems to make people forget about NOx.

In some cities the air is so polluted they urge people to not drive at all. And that pollution is not related to CO2 at all.

Are we 100% absolutely certain that the current level of CO2 emissions will kill us all? We can't even spend one minute thinking about other air pollutants?

false sense of security

I needed/wanted to run a suspicious looking executable. I used ESET to manually scan it. It found nothing. Later when I scanned the trojan this executable unpacked, again it found nothing.

It was my own fault for trusting the virus scanner, yes. But had I not had a virus scanner, I would have been a helluva lot more careful.

Adding more code (with potential security holes of its own) surely is not the way to go as far as protection is concerned. Padding exploits is the only recourse.

Oh... I better upgrade to Linux, because surely there is no such thing as mysterious trojans there... Is there? (the way some Linux-heads act, it would be natural to assume this to be the case)

what about upstream speeds?

Those of us who sometimes uses the net for workrelated activities are usually more worried about upstream speeds. I currently have a beefy 18Mbps ADSL2+ connection because I need the 1.5Mbps upstream speed it provides.

It is unfortunate that the ISPs who offer good/proper upstream speeds do not get more attention. Here in Norway, a fiber provider were reported to the consumer authorities when they rightfully pointed out that their competitors did not offer _real_ broadband.

could always flog the thing on eBay...

If all else fails... My initial bid is $1000 btw, but I refuse to pay through PayPal.

Old-school development tools

Jolyon,

I was a die-hard Delphi user until last year. I first started in 1995, before which I mostly used Turbo Pascal.

Delphi was and still is pure brilliant. The compiler is stunningly _FAST_ (infinitely sweeter than any C/C++ compiler out there) and the language is among the nicest.

But.

Unicode support was added a year ago. The product managers back in the day had severe problems understanding the needs of the developers. Imagine that... Waiting to offer unicode support until 2008... It is... An ID ten-T mistake.

They were late to implement generics. They stalled on inlining. They STILL do not have a 64-bit version out there.

Compared to Java, Delphi shines. It shines so bright it is hard to understand why there are so many Java projects out there. But of course, with limited (or non-existing) cross-platform support, Delphi is a hard sell.

Delphi on .net makes little sense as far as I can tell. C# is 'good enough' (far from nice, but 'good enough' certainly). WPF is key. Without proper WPF support, Delphi is just not an option. There are few reasons to use Delphi.net.

Given the track record of the Delphi team, I see very few improvements the last ten years. They stalled. They owe the Delphi community a huge apology. They played around with that Eco-cræp, and forgot about improving the compiler and their core component library. Big mistake.

As for the virus; Who cares? Just avoid installing viruses, and you'll be fine.

Rock hard security is not comfortable

Dare I suggest that there is a huge difference between logging on to your online banking account and signing onto facebook or your local newspaper's flame-wall?

My local paper sends me a password by SMS... Yes... As if I care if some five-year old gets hold of my password there and starts posting nazi-propaganda or links to pictures of naked women. (I do the latter already -- 'cause I've always been a weak one for the naked women...)

Some sites simply take themselves way too seriously. Besides... Typing blind forces many to type slower. Thus their passwords are almost easier to shoulder-peek.

Swedish for it stank something fierce

@AC 17:44

"Det stank fruktansvärt" (http://allehanda.se/start/kramfors/1.1150002)

@Paul -- well, at least your uncle let you ride in the back of his pickup. Imagine having to walk home by yourself... :P

@The Reg -- what? No icon with stink lines?

Cyberlink? No thanks

My LG HD-DVD reader / bluray burner came with PowerDVD 7 bundled ("bungled" more like it).

Upon installation, it required no less than two updates. And I had to repeat this a couple of times, because it forgot my OEM license key at least once.

But that was only the beginning of my woes. I have some old SCSI devices (DVD-ROM, CD-RW and CD-ROM -- I'm a sucker for optical drives as it is nice to keep game discs somewhere I can find them) and PowerDVD froze. Another gentleman on their forums confirmed this. PowerDVD7 doesn't work. It gets stuck when enumerating the SCSI bus.

Cyberlink's support told me to check my DVI cable... Yes... As if my monitor somehow caused a mishap on the SCSI bus... They insisted on not helping me.

And now my PowerDVD again prompts me for an update. I did not dare touch it... I know too well how Cyberlink's updates work (or don't!).

Three instances...

I had two services (not running, although they were set to "automatic") and one process going (presumably started by one of the services?).

One service was named "Google Software Updater" ("C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe") and the other "Googles oppdateringstjeneste (gupdate1c9a3cf291cf151)" ("C:\Program Files\Google\Update\GoogleUpdate.exe" /svc).

I hope they are both legit... I have a clean installation of only standard tools, so I'm surprised they messed up like this.

The article touches on one interesting question... Almost every application now has its own updater running in the background. There is one question these companies need to ask themselves: "what will happen if everybody else does this moronic thing?".

The apps should perhaps check on launch... Or let the user do it manually through the Help menu or something. But an update service? That is overkill in 90% of the cases.

SD read speed

I believe many of today's laptop still deliver sub-par performing SD card readers. They manage 1 MB/s - 2 MB/s tops. They _should_ deliever ten times that speed.

My old Fujitsu wasn't only slow (reading SD cards) but also consumed 100% CPU power.

So I am very interested in learning about reader speeds with the latest generation of laptops and netbooks.

Bright idea

I was very happy the other day, stranded in an airport in Istanbul, with only coin-operated luggage trolleys as far as the eye could spy. I'm a Norwegian, so I did not have on me any of the local currency, nor any Euro coins.

I finally hunted down an abandoned trolley and solved my problem that way.

To Ryanair: Peeing in a cup is free. Your move.

expiration = bad

On one hand, it is good that they put some effort into keeping people from cheating. Cheating ruins the fun for most customers. Quite obvious I think.

But this sounds like a very bad idea. An expiring certificate?

One of the common complaints about DRM is that it makes it less certain that a particular software title will run in the future. There was a problem with DRM when Windows 2000 was released. Same with XP. There were definitive problems with 64-bit Windows, but at this point Microsoft seems to have started adding some of the DRM device drivers as part of their OS distribution.

Games are part of our culture. Last year I bought a rereleased collection of the old Space Quest games that came with a ready-to-run emulator. Great stuff. 20 years from now, I might want to play one of today's games again, but I doubt I want to keep the old hardware around.

Game publishers should be more sensitive to such issues. I used to buy many games, but now I seldom bother. FS:X was one exception, because it does not even require me to hunt down the DVD before launching the game. That was a good customer experience. (and no, I did not subsequently let all my friends have a copy too)

Playing games should be convenient and easy. But the publishers want us to become librarians first, so we can keep intimate tabs on our collection.