* Posts by Androgynous Cupboard

496 posts • joined 7 Mar 2012

Page:

Oh snap! UK Prime Minister Theresa May calls June election

Androgynous Cupboard

Re: Workers

Doesn't mean workers vote Labour. I predict a largish swing to the Lib Dems in the "employed counties" and turnout lower everywhere else, because really what's the point?

PS. Can I also add that hope that the Labour party hurry up and split already? In their current form they're no use to anyone. Enough infighting - split into two and do your fighting at the polling booth like everyone else.

14
0

US border cops must get warrants to search citizens' gadgets – draft bipartisan law emerges

Androgynous Cupboard

Re: There is a positive side to this...

Er, I think you'll find the IOC is not well known for taking a strong stand on moral issues in the host country. A sentence which may just win me the "understatement of the year" prize.

6
0

Startup remotely 'bricks' grumpy bloke's IoT car garage door – then hits reverse gear

Androgynous Cupboard

Re: Why would you need to control your garage door

Why give your brother-in-law a spare key when you can just generate him one?

Obviously it needs to be signed by a trusted CA, or you can run your own with openssl, provided you can store the CA key offline securely (make sure you back up the storage). And obviously you need to be sure that you're using a modern hash algorithm, SHA2 probably. And, of course, you've got to ensure he's using a strong password on his keychain. And watch for side-channel attacks when you generate the key. But, on the whole I think you'll find an RSA key much more convenient.

3
0

Head of US military kit-testing slams F-35, says it's scarcely fit to fly

Androgynous Cupboard

Phew, bullet dodged.

Luckily for the UK, if the F35 it turns out not to work then our new £6bn carriers will just switch to another carrier launched plane, of which there are several. After all, it's not like our carriers can only launch one type of combat aircraft is it? Because that would be just silly.

36
0

Miss Misery on hacking Mr Robot and the Missing Sense of Fun

Androgynous Cupboard

Re: I'd heard of this

Jesus, now you've spoiled the remake too. Enough!

6
0

Manufacturers reject ‘no deal’ Brexit approach

Androgynous Cupboard

Re: It'll be fine

May may try to play poker, but with 28 players, it could become a Russian roulette

May I propose that we rename Russian Roulette "British Roulette", in recognition of our current trajectory?

3
0

UK Home Sec: Give us a snoop-around for WhatApp encryption. Don't worry, we won't go into the cloud

Androgynous Cupboard

Re: Colour me surprised

Vast numbers of comments on this thread presume that just because a desirable public key is in existence, it will leak. If this were the case the banking system would have crumbled years ago and your digital passports would all have long been cloned, yet mysteriously this isn't the case. "All a hacker needs to do is get into the system" comes from an absurdly simplified view that everything is stored online, no doubt on a Windows 95 box protected with "password" like you see on the telly. That's just not how it works, and (@MMalik et al) if you'd bothered to read my post you would see it's not what I described.

Properly designed, properly implemented secure systems can and do exist, and the fact we're in the era of both the "Internet of Shit" and some very high profile recent data breaches doesn't negate that. Both Manning and Snowden walked away with data because it was available to download, and because they were trusted to do so; that was the problem. You need to first get that shit offline, and then start with a complete lack of trust between all parties to do this properly. If nothing else I think we can agree we have that already.

Enough with the "what about the l33t hackerz" replies please. This isn't slashdot.

0
4
Androgynous Cupboard

Re: Colour me surprised

@Dan 55 - may I call you Dan? No need for surnames here.

My hypothetical example is really just about key management, specifically that you can design a system where it would be impractical for NSA & law enforcement to electronically hack in to read messages without compliance from WhatsApp. You're asking what happens after they have the key, the answer is - of course - security is potentially compromised.

@John Robson, @Mike Richards and pretty much everyone else.

Gents, this is a lot of fun but once you get into bribing this guy or rooting that, frankly we're in the world none of us are experts in. There are easier ways to do this, as TRT points out above. I'm simply describing a process where this could be done technically, through legal, if not necessarily moral, channels, without introducing a weakness exploitable by a third party.

Signing off now, have to iron out bugs in my OCSP verification code. That's the trouble with crypto, it's all in the f*ing details.

0
4
Androgynous Cupboard

Re: perhaps itself encrypted with a key known only to law enforcement

@Zippy

In my example system the generated plaintext private key doesn't have to be stored, it can be deleted. But yes, you're right - there's an assumption that this is done properly, and that the NSA weren't running a side-channel attacks on the computer generating the key, or bribing the WhatsApp employee who generated it, or that Facebook are just a front for the CIA/Alien overlords, and so on. But if any of these are the case, we have bigger problems.

Designing a system to minimize this risk is complex, and it's also quite good fun as a thought exercise, but it's straying from the (really very simple) technical point I am trying to make: a properly implemented backdoor for law enforcement is technically possible without opening that backdoor to everyone. Sorry. I don't like it much either, for what it's worth.

0
8
Androgynous Cupboard

Re: perhaps itself encrypted with a key known only to law enforcement

Christ. Go read (and implement, as I have) RFC2315, in particular section 10 (enveloped data), then come back to me. The key words from that section begin with "For each recipient".

1
2
Androgynous Cupboard

Re: perhaps itself encrypted with a key known only to law enforcement

My dear Streaky, PGP is very much a thing, You should google it.

I think we're at cross purposes here. "A weakness added by technical means" is wordplay and not helpful to this discussion.

Clearly you are upset at the concept of law enforcement having access to comms that you feel should be encrypted for ever until the end of time. That's not unreasonable, but I'm not interested in legislative or emotional arguments. Yes, people will leave a messaging platform that does this. I already made that point in my first post.

I'll restate my point for clarity. Encrypted communication between two devices could be "backdoored" for law-enforcement without making it easier for a third-party who snoops on the traffic to decrypt. The argument levelled against "backdooring" is that it opens the door for everyone, not just law enforcement, and I am saying that is simply not the case here.

As I'm clearly playing devils advocate, here's how I would construct the system.

Law enforcement generate a keypair and send the public key to Whatsapp, and keep the private key in safe. WhatsApp generate a keypair, and use the public key as I've described. They encrypt the private key with law-enforcement's public key, print it out and put it in a safe, then delete the "plaintext" private key. Or, if you prefer, store parts of the printout in multiple safes in multiple jurisdictions, including bank vaults.

Now to decrypt any communications you need the private key of law enforcement (in their safe), the encrypted comms (on WhatsApps servers) and access to the safes in WhatsApp's offices, which they're only going to open with a court order. It's safe from NSA hacking, it's safe from NSA and Law enforcement acting together, it's safe from WhatsApp acting on their own.

Of course no system is impenetrable, but if you think this system (if implemented as described) is vulnerable then please tell me how you would do it, either as an over-zealous government, a corrupt law-enforcement official or a third party. Facts please, not hyperbole.

2
22
Androgynous Cupboard

Re: Colour me surprised

No. Not a technical weakness. The symmetric key remains encrypted, buy you now have a choice of two public keys to decrypt it. Brute forcing either is impractical, so no technical weakness is created.

It is clearly still "end-to-end" encrypted, as the message it encrypted on device A and not decrypted until it's read on device B.

There is clearly an ability for a third-party to decrypt - that's the point - but it's not a technical weakness. Let's be clear, I'm not advocating this system and I am not keen to allow Amber Rudd to read my messages, but criticising he on the grounds of "it can't be done, technically" is incorrect.

But if you know better, please explain in detail why this is the case - as I just aded to my post, this method is used by PGP amongst others, so I'm sure they would be delighted to hear your analysis.

4
20
Androgynous Cupboard

Re: Colour me surprised

While I think Rudd is, in general, an idiot, what she is describing is technically possible without introducing any technical weakness.

Communication is normally encrypted with a symmetric cipher like AES256, and the key exchange is done with public keys: device A generates a session key, encrypts it with device B's public key. Only device B can decrypt it, and, therefore the session.

However it's possible to encrypt the session key again with a second public key. The corresponding private key could be held by WhatsApp, perhaps itself encrypted with a key known only to law enforcement. WhatsApp (or whoever) stores the encrypted chatter between devices, and can decrypt it with that private key as required.

This is different to the "decrypt the iphone" debate, which is done with a symmetric cipher. Introducing a weakness there introduces it for everyone, not just law enforcement. But where the encryption involves a key exchange between two devices, then allowing a third-party to decrypt communications can be done and, from a purely technical point-of-view, introduces no weakness in security.

Obviously there are other issues, not least for the company that is likely to see people abandoning any platform that does this for one that doesn't. But that's a different problem.

(edit: I should add this mechanism is not something I've just dreamt up, it's used by PGP, Acrobat and probably any system that facilitates the encryption of a document or message for multiple parties)

2
34

Dishwasher has directory traversal bug

Androgynous Cupboard

Re: It's crazy, but it's very Miele

Here's the machine here: PG 8258. You're unlikely to have one of these in your home kitchen...

1
0

Large Hadron Collider turns up five new particles

Androgynous Cupboard

Re: Puzzled, as usual

I blame Uexit

0
0

Git sprints carefully towards SHA-1 deprecation

Androgynous Cupboard

@bazza

I took apart the two PDF documents they created, and I believe they started with two files containing an arbitrary binary stream - in this case, a JPEG with an embedded binary blob. They then diverged the content of both files until they had the same hash.

The two key points here are:

1. Both files had to be modified. Creating two files with the same hash is different to creating one file with the same hash as another, and much easier.

2. The JPEG embedded in the PDF has a binary blob which is of considerable length, and this blob was modified to engineer the hash collision. The nature of PDF means these modifications will still give a valid file, and I imagine you could say the same about any format which allows an arbitrary binary marker, i.e. TIFF, JPEG, PNG, but not something like XML or - and I'd want to confirm this before I staked my life on it - ASN.1 encoded X.509. So your point about modifying PDF being harder than modifying "two arbitrary byte streams" is true, but not by much, as PDF is allowed to contain arbitrary byte streams.

Point 1 is the key and personally I think some of the panic on this one is not yet warranted. SHA-1 is badly damaged, but 6000 CPU years to create two files which demonstrate a hash collision does not make an attack vector. Not yet.

2
0

SVN commit this: Subversion to fix file renaming after 15 years

Androgynous Cupboard

Re: SVN will never beat GIT

We've got over 30,000 commits in a very large SVN repository. We tried migrating to Git a while back but the requirement to have the full tens-of-GB repository stored locally on our CI servers stopped us cold. With SVN it's a couple hundred MB, just the version we're testing. Git brings a lot of improvements, but it's not a panacea.

0
0

Forget quantum and AI security hype, just write bug-free code, dammit

Androgynous Cupboard

Re: 1980s computer science

Three slots a day? My Dad used to have to post his punched cards to the nearest computer. Which, as he was in New Zealand in the 70s, was in Australia.

I imagine they checked their work quite thoroughly before posting.

2
0

GitLab.com melts down after wrong directory deleted, backups fail

Androgynous Cupboard

Re: All of the above notwithstanding, it's a bit hard to understand use of rm -rf ...

I tried that, but it just moved the cursor to the start of the line

6
0
Androgynous Cupboard

Back in the days before package management I was upgrading some libraries including ld.so - the dynamic library loading library. I moved or deleted the old one, and the next command to run was "mv newlibrary.so ld.so". But of course "mv", along with every other command on the OS, was dynamically linked. It didn't end well, although I did learn my lesson.

2
0
Androgynous Cupboard

Re: All of the above notwithstanding, it's a bit hard to understand use of rm -rf ...

Pray tell, how else would you have us delete a directory?

5
0

Support chap's Sonic Screwdriver fixes PC as user fumes in disbelief

Androgynous Cupboard

Clothing related malfunction

My Dad told me one about a mainframe he worked on back in the 70s that would spontaneously reboot, but only when one particular operator was using it. They eventually traced it to static charge from her nylon stockings...

8
0

Hackers crack Liechtenstein banks, demand ransoms

Androgynous Cupboard

Who's responsible?

"Hackers have days ago breached a Liechtenstein bank". Is the sub-editor on holiday?

1
0

Reg man 0: Japanese electronic toilet 1

Androgynous Cupboard

Re: Toilet dreams

You should all consider eating less cheese before bed. Much, much less cheese.

2
0

Donald Trump confirms TPP to be dumped, visa program probed

Androgynous Cupboard

Re: oh yea..

A friend moved from the UK to the US and was astonished that you could be fired, immediately, with no notice and for no reason. This was nothing to do with H1-B, it seemed to be just the way it worked in the US. As a consequence her entire office spent half the time working and half the time covering their own ass. I imagine if you wanted to shake up the law to provide more security for US workers, that would be as good a place to start as any...

11
0

Why I just bought a MacBook Air instead of the new Pro

Androgynous Cupboard

Re: They lost me at "no touch screen"

Anyone that puts their grubby fingers near my screen has them removed. I can't speak for your five-year old, but my two-year old knows not to prod.

More to the point, even with out a five year old or the need for a clean screen, it's an incredibly slow way to input data. Move hand from keyboard to screen, jab, move back. I can't think of a single pro in any field that would prefer that over a keyboard shortcut.

5
0

Tesco Bank limits online transactions after fraud hits thousands

Androgynous Cupboard

Typical Daily mail, blaming foreigners again.

3
0
Androgynous Cupboard

Re: These idiots woke me up TWICE !

I don't know why the downvotes. Nothing fucks me off more than a bulk SMS, and sending two or three in the wee hours of the morning for something which could have undeniably waited a few hours would have me ringing CEOs doorbells too. The original poster pointed out that he received several in a short space of time, which would have got through the do-not-disturb feature you describe.

1
0

Apple drops dongle prices to make USB-C upgrade affordable

Androgynous Cupboard

2017

Could it finally be The Year Of The Linux desktop?

2
1

Run a JSON file through multiple parsers and you'll get different results every time

Androgynous Cupboard

If you read his article you'll notice he refers to RFC7159, which states "JSON text SHALL be encoded in UTF-8, UTF-16, or UTF-32.".

No, this isn't in the original "spec", so if you were working from that it wouldn't be a hard fail. But it is in one of the specs that claim to define JSON so is a reasonable thing to test.

Snowballed into this bullshit? I'll be generous and assume you are unfamiliar with the process of "testing your code", but working from a collection of edge-cases is pretty much the definition of testing when you come to implement a specification. I have worked from plenty of specifications without them and they are all, without exception, bad specifications. Words are always ambiguous, a test case that passes or fails is not.

"most Java shops use Jackson", oh I don't think so. We were so dissatisified with that, and the various other half-baked or over-baked options that we wrote our own, which is now passing all but a few outliers thanks to the efforts of Mr. Seriot, to whom I am much obliged for his efforts.

5
1

Samsung are amateurs – NASA shows how you really do a battery fire

Androgynous Cupboard

I expect they're configurable because you can use the same design to manage LiPo, LiFePo4 and the various other lithium chemistries. Each has a different "safe" voltage range - LiFePo4, for example you don't really want to push beyond about 3.6V if you're aiming to maximum the number of charge cycles. I think LiPo is about 4V.

Presumably that's the issue - someone selected the wrong chemistry. Although I agree this sort of thing should be locked down unless it's under development.

Topical: I've just ordered the 9th iteration of my LiFePo4 BMS circuit board today. So it's either not a trivial problem, or I'm a bit shit at it. Or, perhaps, both.

1
0

Web devs want to make the Internet of S**t worse. Much worse

Androgynous Cupboard

A different point of view

I've developed a small piece of hardware with serial comms (via bluetooth, but not directly using the bluetooth API) and built a UI for it as a Chrome App. It's a great approach - I've done plenty of Swing but wanted something that's easier to distribute (check), quick to prototype (check), leverages a technology I'm familiar with (HTML/CSS/JS, check), portable across platforms (check). Frankly it's a great solution.

Except Google have announced they're dropping Chrome Apps, and there's no replacement. They're trying to push this Bluetooth API as a replacement, and if it came off it could have been a partial solution, although it's too far off for me to make use of it. The point is it's a very useful thing to have in the toolbox.

Yes, there are obvious security concerns, just as there are with DOM extensions for microphone access and videocamera access (WebRTC, already a part of many browsers), geolocation (same), and the various other things that need to do more than display a flat page, tasks which are currently confined to Flash or Applets.

But I don't see you lot bleating about that do I? What a bunch of whining jessies (last bit because I'm going to get downvoted, so I may as well deserve it)

1
0

Is this the worst Blockchain idea you've ever heard?

Androgynous Cupboard

Good lord, he's invented the digital timestamp

Whatever you do, don't mention RFC3161

5
0

Snowden investigator slams leaker-detector background checks

Androgynous Cupboard

Re: in plain English

Actual core beliefs, or what an organisation says are it's core beliefs during the interview?

9
0

Majority of underage sexting suspects turn out to be underage too

Androgynous Cupboard

I simply can't imagine why no-one wants to swap nudey pics with you, Mr Dogshit.

16
0

Dublin shopkeeper catches forecourt fouler with his pants down

Androgynous Cupboard

Poor chap

Sounds like a bad dose of Ian Duncan Smith. At least I think that's what the initials stand for.

0
0

Eric Raymond revisits his biggest mistake, updates 'Pilot' language after 20 years

Androgynous Cupboard

Re: Software luminary?

He's also a notorius gun-nut and sent this to Bruce Perens

Damn straight I took it personally. And if you ever again behave like that kind of disruptive asshole in public, insult me, and jeopardize the interests of our entire tribe, I'll take it just as personally -- and I will find a way to make you regret it. Watch your step.

Quite the charmer.

3
2

US govt pleads: What's it gonna take to get you people using IPv6?

Androgynous Cupboard

Allow me to answer those questions US.gov

Benefits related to implementing IPv6: given we already have a working IPV4 network, none

Anticipated return on IPv6 investment: none (see above)

Anticipated costs: a full audit of every network connected piece of hardware or software (the full stack, not just the OS) to ensure they function correctly. Failure to do so correctly will likely open our organization up to security breaches which, due to a lack of in-house knowledge of IPV6 will be harder to identify or remedy. Dollar value unknown but makes Y2K look like a pound-shop special offer.

HTH

2
2

Unlucky Luckey: Oculus developers invoke anti-douchebag clause, halt games for VR goggles

Androgynous Cupboard

@Updraft Re: Americans, again not realising there's a world outside them

Although I disagree with your conclusion, it's fair to say any conclusion is going to depend on which metric and news sources you choose.

If you're interested in who the victims of gun violence actually are, rather than who you think they are, you won't get much better than piece in the Guardian by Gary Younge.

He picked a random day and wrote about every child in America killed that day by guns. There were ten, by the way. No massaging of statistics, no editorial opinions, no selective quoting. Just a typical day in America. He's a superb writer but it's a tough read.

5
0

BBC to demand logins for iPlayer in early 2017

Androgynous Cupboard

Re: BBC ??

Ha, quite right - real intelligence, BBC, what a laugh. I get all my content from ITV and Sky news..

2
1

Ever longed to be naked in Paris? City council votes TODAY

Androgynous Cupboard

Naked Yoga

That might fly in a London gym, but not where I went. A thousand times no.

(aside: a mate finally left the nudist colony he lived in for three years after following an old man up a ladder on their way to repair a roof. There are some things you just can't unsee)

2
1

UK copyright troll weeps, starts 20-week stretch in the cooler for beating up Uber driver

Androgynous Cupboard

There's nothing preventing you from being director of your own company, and given you've seen how it can be tricky for someone with a previous conviction to get a job, forming their own company and working for themselves might be the only option they have. The restrictions on directorship are to prevent people using their company (in particular, the limited liability bit) to defraud.

There's no "us and them" here at all: owning a small company is nothing special, I'm on my seventh I think, and three of those never did a thing. Half the people posting here will have at least one.

2
0
Androgynous Cupboard

Re: "He'd better make sure he never drops the soap"

> I'm a vegetarian and like to spend holidays on Scottish islands. Sounds like fun to me!

Home Office would be one step ahead I expect: you'd be incarcerated in Leicester Square McDonalds.

3
0

Oracle confirms Java EE 8 is delayed for 'major enhancements'

Androgynous Cupboard

Re: Please just let JAVA die....

I'm not sure you understand the process.

Java 8 wil run almost anything written for earlier versions. The differences (which we look for in minute detail to ensure compatibility for our products) are minimal and usually relate to security issues, which - in practice - means applets or JavaScript.

If you're running an applet you are basically out of luck. The technology is already dead after being starved of love by Sun/Oracle over the last 5 years.

For anything else (like Java EE that this article is about) Java is healthy and useful. And backwards compatibility is excellent compared to every other language I have ever worked in. There are methods deprecated in the late 90's that still work in Java 9.

1
0

Latest F-35 bang seat* mods will stop them breaking pilots' necks, beams US

Androgynous Cupboard

Re: minimum weight

> Does this imply that they are all lard-arses?

Or that no pilots are affected because they're not doing any flying due to a lack of planes.

1
0

Hackers hijack Tesla Model S from afar, while the cars are moving

Androgynous Cupboard

Re: Why

Pure speculation, but I would imagine it could go something like this:

1. Web browser allows access to something innocuous - I don't know, turn on the stereo.

2. Buffer overflow found in the handler for this action in the webbrowser

3. Buffer overflow exploited to load executable code onto the computer.

4. exploited code sends specially crafted CAN bus message targetting the systems on the same bus as the stereo.

It's not necessarily the case that you can control your brakes with a web browser, but could be that the devices the web browser is controlling are on the same comms bus. I have no knowledge of Tesla's internals, but most modern cars use a bus system and I presume something as electrically complex as a Tesla would do too. Running N individual wires to N devices back to a single control unit simply isn't practical.

That said, I believe aircraft have their entertainment systems on a physically separate wiring harness. Not a bad idea all up.

1
0

Microsoft thinks time crystals may be viable after all

Androgynous Cupboard

Re: More on MS Copy

Not a programmer I take it?

progress = byteswritten / totalbytes

estimatedduration = totalbytes / byteswritten * elapsedtime

For copying one or more files, that's it. The longer it runs the more accurate and stable it becomes. And it will never, ever go backwards. Fucking this one up is bad enough, but leaving it that way for twenty years is what really beggars belief.

1
1

Tesla driver dies after Model S hits tree

Androgynous Cupboard

Re: @AndyS

I'm not sure if the Tesla uses LiFePo4, but they're likely using a variant which is similarly stable. You can optimise for stability or power density, and car batteries are typically optimised for stability - these are not the explode-in-your-pocket cellphone batteries.

If you need convincing, This video is worth a watch, if only for the bit where the guy unloads a gun into the battery. He doesn't even have a high-vis vest on, try doing that in Europe. It's from Sinopoly, one of the largest manufacturers of LiFePo4 cells.

0
0

Inside our three-month effort to attend Apple's iPhone 7 launch party

Androgynous Cupboard

Re: If one compared companies to countries

The first and probably last time a comment beginning "In Soviet Russia" was actually amusing.

2
0

World eats its 10 millionth Raspberry Pi

Androgynous Cupboard

Re: I thought I'd buy one to try when they first came out..

> If you are doing something that intensive on the USB bus (unfortunately that includes the Ethernet port), the Pi is not for you.

I'm going to give this qualified agreement. But it can be done. I have five hubs and fifteen USB device plugged in right now and working - fortunately there's nothing realtime (I had to drop audio due to packet loss), but otherwise it's long term stable.

0
0

Page:

Forums

Biting the hand that feeds IT © 1998–2017