* Posts by DropBear

4735 publicly visible posts • joined 4 Mar 2013

Just look at Q! Watch out Microsoft, the next Android has a proper desktop PC mode

DropBear
Trollface

Re: pholdables

Heavens no! We must, of course, call them "pholdies"...

Forget that rare-earth element crunch – we can now just extract them from industrial waste

DropBear

Strange. I was under the distinct impression that "rare"-earths are absolutely anything but rare. It's literally the first thing everyone points out any time they are mentioned anywhere.

Never thought we'd ever utter these words, but... can anyone recommend a spin doctor for NASA?

DropBear

Re: Doofuses!

...even simply "concluded" would do...

This is the Send, encrypted end-to-end, this is the Send, my Mozillan friend

DropBear

Re: The article says the key is in the hash part of the URL

Right up until a confused party pastes the received "URL" as-is straight into a browser instead of using the appropriate microsite / app / text box / whatever it is you are supposed to actually do with the link (bonus points if they paste it straight into the Google search box instead of the address bar)...?

Crew Dragon returns to dry land as NASA promises new space station for the Moon

DropBear

Re: Lunar Gateway Questions

...is that some kind of "set someone on fire and he'll be warm for the rest of his life" thing?

Amazon may finally get its hands on .amazon after world's DNS overseer loses patience

DropBear

Re: No internet in the Amazon?

Those interpreting the "no internet" thing as "in not any place close to the Amazon river" would be of course right to point out that's not true - particularly in the larger cities; but I'd still wager the vast majority of the jungle the Amazon goes through has a serious deficit in not only internet-capable hardware but indeed human presence altogether - and wherever else spears and bows are still mostly the norm of local weapons technology, internet cafes are likely still spread awfully thin on the ground.

DropBear
Coat

Re: Can of worms or Pandora's box is about to be opened...

So you're saying this proliferation of TLDs is of some con.cern...? Okay, okay, I'll let myself out...

UK joins growing list of territories to ban Boeing 737 Max flights as firm says patch incoming

DropBear
Trollface

Re: God, the stress involved in writing this stuff...

Not at all. It has been very thoughtfully engineered - when, not if, the worst happens there is even a handily integrated garbage collector to clean up the mess...

DropBear

Re: Let me fix that for them.

...especially not while actively overriding the control input of their pilots.

Is this the way the cookie wall crumbles? Dutch data watchdog says nee to take-it-or-leave-it consent

DropBear
Facepalm

Bastard, the lot of them...

Unfortunately, a vast proportion of sites deals with this in a "we are hereby notifying you that you will be tracked - there's nothing you can do about it" fashion, linking to nothing more than a privacy statement or a list a entities they use to track you, without any options attached; at most, they vaguely handwave in the direction of those, saying "how you may or may not deal with those is not our problem". Do you know what GOG's (who are allegedly the good guys see DRM and all that - well at least the less bad buys...) banner looks like...? Well, prepare to be amazed:

"Not like it changes anything but we are obligated to inform you that we are using cookies - well, we just did. More info on cookies."

Yes, really. Literally. And guess what, there's a comprehensive list of all types of cookies in existence on that page, and not a single checkbox. There is this instead:

"HOW DO I CONTROL COOKIES?

Although most web browsers automatically accept cookies, you may adjust settings on your browser or device to prevent the reception of cookies, or to provide notification whenever a cookie is sent to you. Further information about the procedure to follow in order to disable cookies can be found on your Internet browser provider’s website via your help screen. Also, some of our partners are members of the Networking Advertising Initiative (“NAI”) and/or the Digital Advertising Alliance (“DAA”) – organizations who offer a single location to opt out of receiving tailored ads. If you wish not to have your information used for the purpose of serving you targeted ads, you may opt-out by visiting the DAA's Consumer Choice page and/or the NAI’s Consumer Opt-Out page. Please note this does not opt you out of being served advertising. You will continue to receive generic, or non-targeted, ads."

How in the blazes is this possibly legal?!?

No yoke: 'Bored' Aussie test pilot passes time in the cockpit by drawing massive knobs in the air

DropBear

Re: There's a bunch of these on FlightAware...

My first reaction was "the real reason this exists is because there's a commonly used aviation tool somewhere that facilitates creation of waypoints in a drawing-like fashion - people are simply using it because it's there!". If this is a common thing, I'm even more convinced that I'm not wrong...

Password managers may leave your online crown jewels 'exposed in RAM' to malware – but hey, they're still better than the alternative

DropBear

Re: Could do better but not much better

Must have been a different summary table than the one I've seen.

DropBear

Re: Keystroke logger

What the hell are you talking about? Any TOTP code is by definition valid in unchanged form for 30 seconds (or other suitably chosen but nonetheless practicality-limited interval). It's up to the far side how it handles two distinct login attempts from different IPs in quick succession, but there is no "challenge" element involved in a TOTP code.

DropBear

Re: This is why you need a dedicated hardware-token for things like this.

Trying to redouble efforts to armour plate a carrier pigeon between your password manager and browser are flat out pointless. The solution is not trying to keep a fixed string secret, but to use end-to-end crypto between a separate, physically secure piece of hardware (token) on your side and the web server on the far side; which is exactly what U2F (and partially our much downvoted OP) is trying to promote. Yes, it's not by any means universally used at this point; we can only hope it (or something like it) does become so as soon as possible.

Until then, pending cooperation from the far side, we could still have right now stand-alone hardware password vaults that type the required pass straight into a login field. Yes, they would still have remaining issues such as lack of integration for auto credential selection / inability to work with "on-screen keyboards" with variable layout / passwords lingering in the browser memory, but at least they do assure the criteria pursued by this study: that unused credentials do not get exposed, and that used ones do not linger in the _manager's_ memory once it is re-locked (or ever, considering separate hardware).

All in all, password vaults are awesome against indirect threat (where you and your hardware are not involved in an attempt to compromise an account of yours on a third-party server) but are catastrophically poor against direct threat, where your machine is compromised first either by a remote or a local attacker directly seeking to obtain credentials to exploit - so it's a compromise depending on your threat model. If, like me, your threat model includes the rest of the world... you're unavoidably fucked. Nothing can protect you comprehensively.

U wot, m8? OMG SMS is back from dead

DropBear

Except of course read receipt sending would be one of the first things I'd turn off - and if they won't let me, then the whole RCS process (unrootable phones aren't even considered for purchase). Whether or not I've actually seen something you sent me is none of your concern. If you absolutely must know, you can try to call me - and most likely have me not pick up for that exact reason. Funnily enough, those who aren't trying to spy on me seem to have no problem whatsoever reaching me.

Turn on, tune in, drop out: Apple's whizz-bang T2 security chips hit a bum note for Mac audio

DropBear

Re: Astounding, indeed

Unfortunately "only" having to properly implement anything is exactly one bridge too far in 99.99999999% of cases. USB2 bandwidth may be more than adequate in theory, but it doesn't matter that I get 30FPS on average in a game when I get all of them in one half of a second - and precisely nothing in the other (or, you know, for the next five seconds - hello there SC...). I remember quite vividly having any audio that was playing glitch on my desktop every time any network traffic occurred whatsoever - and that was hardware bolted onto the motherboard southbridge not even attached via USB, and it was not a single-version bug but the state of affairs with the official mobo drivers from a reasonably reputable supplier! I can't even remember exactly what workaround or update solved it, but to this day my drivers are frozen to the version that finally worked reasonably, any further updates be damned*.

Properly prioritised and enforced resource access is simply NOT something anyone pays any attention to in the twenty-first century - everyone just assumes they are either alone on their bus, or the bus is "fast enough anyway" to let them get away with bloody murder. Except it never actually is, and sometimes to the point where you end up like this - getting to hear it quite clearly.

* let me tell you about that one time when the mouse cursor kept randomly turning into corrupted garbage for an infinity number of further versions of the graphic driver for their then-flagship card long after AMD swore they fixed that - guess when I updated THAT driver the last time...

Unearthed emails could be smoking gun in epic GDPR battle: Google, adtech giants 'know they break Euro privacy law'

DropBear
Devil

Re: Death to advertisers!

Wait. How do you know I was looking for a pitchfork...? What do you know about me and who did you learn it from!?!?"

LG folds at prospect of launching bendy phone while Samsung flaunts its upcoming kit on telly

DropBear

Re: WTA*

"I don't even understand the need for a bendy phone."

It's not hard to understand though. 1) I'm not willing to carry a tablet-sized device, ie. one larger than a normal phone. 2) I absolutely need a screen larger than a normal phone has - I do all my book reading on my phone, and the current screen size absolutely makes it suck. Also, any browsing I do on it almost sucks worse than seeing my dentist, because I happen to not give a crap about vertically scrolling cards like Facebook timelines or Twitter tweets or Messenger messages, and anything else* is just miserable to read on a screen that size, both in portrait and landscape mode.

* I have yet to see a website with a "mobile" (or worse: "adaptive") version that isn't definitely worse than seeing my dentist...

DropBear

Oh, no bendy phone? Not interested then. Not until someone (I care exactly *nought* who) comes up with a *cheap* foldable-screen phone (obviously it won't be the upcoming Galaxy)...

Accused hacker Lauri Love loses legal bid to reclaim seized IT gear

DropBear

I do not appreciate the apparent tendency to judge a claim's merit strictly on its merit as it pertains to the case and question being judged alone, as opposed to "this is your fault and you're despicable so we don't really care whether those you accuse are in the wrong or not - you don't deserve to win either way". But that's just the impression I get after reading this - the claim may well be meritless on its own...

Twilight of the sundials: Archaic timepiece dying out and millennials are to blame, reckons boffin

DropBear
Trollface

Getting millennials interested in sundials...? Easy! Just tell them each one comes with its own gnomon. And mumble something unintelligible when they get excited and ask if they come with goblins and trolls to...

DropBear
Trollface

Re: Using a sundial at night

Why would you need a special app for that, silly? You just glance at the time on the smartphone then wave its torch about until it casts the shadow onto just the appropriate gradation...

Dratted hipster UX designers stole my corporate app

DropBear

Re: Windows 8/10 Control panel

Dunno about that. I learned to swear worse than a sailor* when they started to arbitrarily group various bits of the control panel under text links (each of which I had to read and mentally process to navigate them) under equally arbitrary categories in windows 7, compared to the simple grid of named icons I could navigate at a glance** or even mostly just muscle memory** in Windows XP after a bare minimum of familiarity.

* I kid, I kid. That actually happens to all of us once we start driving...

** Which is what makes "recent" or "most used" collections of apps useless - because they're inherently dynamic, there is no muscle memory developing on where to reach stuff so you need to actively identify everything on them all the time, whereas I only needed visual clues on my old XP start menu to fine-correct my cursor movement; which region to reach for was pure memory.

Boss of venerable sect with millions of devoted followers meets boss of venerable sect with... yeah, you get the idea

DropBear
Coffee/keyboard

See icon -->

Roses are red, this is sublime: We fed OpenAI's latest chat bot a classic Reg headline

DropBear

I'm almost certain it just vaguely realised on some level that "what is" tends to be associated with looking for the "definition" of a thing, and "a dog" means the thing is "dog", so just yanked the closest thing it had to a Wikipedia article and quoted it nearly verbatim - mixing it up with some other words just enough to make sure we realize it has no idea what it is doing...

OK, Google? Probably not! EU settles on wording for copyright reform legislation

DropBear
Pirate

Re: Not Copyright Reform.

It's becoming increasingly obvious that (preferably anonymous) peer-to-peer sharing of absolutely everything is the only way forward worth bothering with. And we better start thinking about how we'll bypass their inevitable attempts to block it, when it gets big enough.

DropBear
Facepalm

Re: "This tactic doesn't play well in the EU"

Well of course! Didn't it turn out that all the campaigning against the Pai's FCC was 100% just bots too...? /s

Why does that website take forever to load? Clues: Three syllables, starts with a J, rhymes with crock of sh...

DropBear

Oh really...? So do tell me, does Google still load the invisible little animated thing in the centre of the page every single time - you know, the thing I blocked years ago because it produces a sustained, continuous 50% CPU load on an older machine like mine...? Because I'm basically certain they still do... and after something like that I just don't see them giving any fucks whatsoever to the whole problem.

US counterintelligence agent helped Iran lob cyber-bombs at America, say Uncle Sam's lawyers

DropBear

Re: Yee Gods

Also, if your target accepts your friend request, one would assume that's because there is at least _some_ amount of real-world connection between him and whoever you're spoofing - but if that's so, how do you expect that real-world link to not uncover fairly quickly that your "spofee" never actually friended him...?

A once-in-a-lifetime Opportunity: NASA bids emotional farewell to its cocky, hardworking RC science car on Mars

DropBear

Not like it didn't last long enough, but strictly speaking - seeing as how big of an issue sand can be, is there anything preventing solar rovers being constructed with panels that can be tilted beyond the angle of repose, so sand can't settle on them, then just returning them to optimum angle when the weather is nice...? It could even be constructed as a passive mechanism that pre-stores the energy needed to un-tilt the panels back to horizontal during the stowing phase, so it would only need the tiniest amount of energy to trigger and effect a wake-up...

One click and you're out: UK makes it an offence to view terrorist propaganda even once

DropBear

Re: Hmmm

Don't be silly. How can learning what might put him in the slammer NOT be useful to a terrorist...?

If you want a vision of the future, imagine not a boot stamping on a face, but keystroke logging on govt contractors' PCs

DropBear
Trollface

Re: a good incentive

A nice way to easily triple your productivity... First it blindly counts the bot-injected rubbish characters, then the also bot-injected exactly equal ^H^H^H^H ones, then finally the ones of you doing the actual work! Win-win!

DropBear
Facepalm

Re: What muppet agrees to pay per hour?

I seem to recall Edison The Man Himself having a brush with workplace monitoring during his railway telegraphist days, in the form of having to send a letter each hour just to prove you're not asleep. Which of course he promptly spoofed with a mechanical autokey, nearly causing an rail accident by, ob(li)viously, failing to act on an advisory coming in while he, uh, slept. Moral of the story: don't. Just don't. It will inevitably be spoofed and it will not get you what you hoped to gain from it anyway. No force on Earth or outside it can make people into work-bots, and you don't want them that way anyway - the real world works only because it's lubricated by stuff folks are not supposed to be officially doing yet needs to be done somehow* anyway.

* let's not even get into how any sort of petty business involving another human being behind a counter or a desk can only be done during "business hours", the exact same "business hours" that are supposed to confine you, as employee, strictly behind your OWN desk. To this day it boggles my mind how this is supposed to work even in theory. And this is not stuff you do twice a year, so you could get a day off or something to take care of it - it's near-weekly minor bullshit that just needs taking care of all the bloody time. In the end, the work gets done by when it needs to get done, and that should be good enough for anyone.

US kids apparently talking like Peppa Pig... How about US lawmakers watching Doctor Who?

DropBear

Naaah. My Spirit Animal is still Spanky Ham...

Object-recognition AI – the dumb program's idea of a smart program: How neural nets are really just looking at textures

DropBear

Can we please...

...just puncture the current "AI" bubble already and call it a day...? Yes, it's 2019 and image recognition is a thing. Mostly. Sorta. If you squint at it just the right way, as this study demonstrates. None of it has absolutely anything to do with actual intelligence, as this study also demonstrates. So, world, just quit it already, my neck is on the brink of getting RSI from all the "nu-uh!" head-shaking I need to do every time I try reading all the effusive "AI" tech news these days.

I am just a mapper: Solar drones take to the skies above Blighty

DropBear
Trollface

Re: Just because you're paranoid...

Just wait until they start parachuting in peacekeeping forces too - I reckon 25Kg is enough for a smallish, really young shark with a laser...

DropBear

The 38m is the single number wot makes things make sense - no drone of any kind of more conventional dimensions has enough surface area to gather any meaningful amount of solar energy as far as powered flight is concerned; but yes, once your wingspan is measured in bus lengths, staying up there for quite a while definitely can be done and has been done. Although I'm not sure roads and rivers move around often enough to warrant 24/7 surveillance especially once you already mapped them; but as far as up-to-date "satellite imagery" is concerned, this would definitely help...

Intel SGX 'safe' room easily trashed by white-hat hacking marauders: Enclave malware demo'd

DropBear
WTF?

Re: "performing anti-piracy decryption of protected Hollywood movies"

If all code running on the machine is trusted, a protected enclave is pointless. As soon as we assume there is something on that machine that something else need protection from, your whole premise of running only trusted code is falsified. Which is just as well, as in practice there is no such thing as 100% trustworthy code.

Leaky child-tracking smartwatch maker hits back at bad PR

DropBear
Devil

Re: "regular" people wouldn't be able to do it, and if they did, it didn't really matter.

"Life is a risk ... get used to it."

"...but instead of teaching your kids some responsibility and showing some yourself, why not bravely surveil their ever step with a (ludicrously insecure) GPS watch instead...!" Oh, do go on. It's beer o'clock anyway, we could all use a good laugh...

OK, Google. Music in 2019 isn't what it was, but Play nice, will ya?

DropBear
Unhappy

Re: Out of curiosity ...

Because there's no essential freedom that most people wouldn't gladly give up for a bit of convenience.

Brit Mars bot named while NASA 'nauts must wait a bit longer for a US rocket trip to the ISS

DropBear

Le Sigh...

"NASA reckons that more testing, verification, reviewing and training is needed before any blue touchpaper can be lit."

Anyone still wondering how ideas like "move fast and break things" could have possibly ended up being touted as a Good Thing - now you know. Because of exactly this sort of bollocks.

Apple puts bullet through 'Do Not Track', FaceTime snooping bug and iOS vulnerabilities

DropBear

You easily can. But you probably do need a rooted phone. AdAway works nicely for me.

Reliable system was so reliable, no one noticed its licence had expired... until it was too late

DropBear

Re: I generate the licenses..

Well, that's why I refuse to (personally) use any software that comes with any kind of "fuel"* that needs to be "topped up" periodically even if it insists it's free and will always be available. It's just voluntarily putting on a collar with a leash somebody else is free to tug on** any time.

* actual real-world example.

** you better be a latex-clad dominatrix if you want to try that with me

From Firefox to fired cocks: Look who's out to save you being shafted by insecure Internet of Dingalings – it's Mozilla!

DropBear
Gimp

Re: Surely the whole point of a Bluetooth Sex Toy

Compelling use case, granted. I still think it's kinda missing the matching T-shirt with a QR code on its front and back that would let anyone interested download the appropriate app. How else is anyone interested going to get clued in about when to try what...?

Only plebs use Office 2019 over Office 365, says Microsoft's weird new ad campaign

DropBear
Trollface

Come on, you can't just leave us on a cliffhanger like that - which part of the family has work-related MS compatibility obligations that categorically preclude zero-cost options like LibreOffice - the wife or the kids? Or, wait... was it the butler wot dunnit...?!?

Sure, you can keep Grandpa Windows 7 snug in the old code home – for a price

DropBear

Re: Happily

While I'm not the OP, I fully endorse the sentiment. Linux desktop is absolutely fine for a non-Linux person - assuming they never want to touch anything other than Firefox and LibreOffice and whatever the photo viewer is called these days; one needs zero learning curve for that. For absolutely anything else though, as a non-kernel-developer, you hit a brick wall. And I'm not talking about having to use the CLI, as bas as that already makes things - I could live with that. No. It's just a matter of time until you stumble into something that most definitely doesn't work as it should, it cannot be configured to make it work, and the bug report(s) concerning the problem sit either unanswered for half a decade or straight-up wontfixed. That's assuming there is anyone still in charge of that piece of software at all of course.

Yeah, Mate is nice - so how does one go about having a "systray" indicator of received mails that isn't either Thunderbird running all the time or a Gmail-only thing? Because "Mail Notification" is deader than dead, broken, and nothing else works. I never had that problem under Windows. Or - how does one enable direct feedback from mic in back to the headphones, a thing that used to be trivial in the Windows XP mixer, still fairly easily doable under Win7 if you know what checkbox to tick, and flat-out impossible under any GUI mixer in any version of Linux I've seen (and just barely doable in alsamixer text-mode, in a sort of semi-accidental glitchy way)...? The official stance seems to be "just listen to the sampled input played straight back into the output" conveniently glossing over the horrible line delay that doesn't exist with the hardware-based mixer loopback.

And there are hundreds of these paper cuts - I _am_ trying to use Linux and I'm fighting them far, far more than I am actually getting on with what I came to _do_. Invariably, it turns out that the only way to get them to work would be to learn the ins and outs of the software package in question (and all the frameworks it relies on) and code a fix yourself. If you can't do that for whatever reason from "C++ is incompatible with my brain" to "my entire lifespan wouldn't be enough to get all of this working", tough shit. It just won't work. And these are all problems I never had under Windows,,,

Chrome devs attempt to slip muzzle on resource-guzzling browser beast with 'Never-Slow Mode'

DropBear

As theoretically long deprecated as synchronous http calls may be, to this day I immediately know when any server I touch anywhere slows down by... having the entire browser freeze up indefinitely, across all tabs. Lovely bit of coding, that.

It's 2019, and a PNG file can pwn your Android smartphone or tablet: Patch me if you can

DropBear

Re: Oh well

Fine, make it 7 months then...

Accused hacker Lauri Love to sue National Crime Agency to retrieve confiscated computing kit

DropBear

No idea what you're talking about. My desktop is a lot older than that, and was bought as a "best value for money, not the best there is" proposition at the time, yet to this day the only piece of software I have ever seen it drag its feet with was Star Citizen - and it even plays that one at a usable if not decent level. There was definitely CPU performance increase in the last ten years, but you seem to heavily overestimate how much, especially compared to typical software needs. See also PC OEMs incessant complaints about people showing no inclination to replace their existing PCs - there's a reason for that...

Google: All your leaked passwords are belong to us – here's a Chrome extension to find them

DropBear

The number of forums that forced me to register for a single comment or to view an image every now and then and the number of small online shops I might buy something from once every three years or so are legion. Due to their number there's no way in hell I'll ever use distinct passwords for each, not even through some "schema". Also due to their number it's basically a given that at any particular moment in time whatever password I used with more or less all of them is already compromised. I would not be able to update them all before the new one would leak too from whichever of them is the weakest link - even if I would remember every single one of these places, which I don't come anywhere even close to.

It's a lost battle I'm not in the mood of fighting so no password managers for me - not that anyone would seem to bother posting in my name anywhere (or to they? Is this the real DropBear?!? Dun-dun-dun...) or buying me anything (card numbers are not involved - I only ever buy CoD at these shops, the whole point is that they are country-local). Yes, there are some higher value accounts, less than a dozen, that I do try looking after slightly better - but they are a drop in the ocean compared to the rest, and funnily enough their passwords tend to stay un-compromised. Regardless, most (that allow it) already also use 2FA anyway (TOTP if it's up to me; SMS if it's up to my bank - thanks a lot...)

All in all, a password manager - either online or offline - just sounds like such a catastrophic single point of failure (and such a juicy target to grab for anyone ever driving by - which is 100% a "when" not an "if") that I just can't stomach using one - at least this way my small collection of more precious passwords is only stored in my brain...