* Posts by Cem Ayin

29 posts • joined 22 Dec 2015

Baddies linked to Iran fingered for DNS hijacking to read Middle Eastern regimes' emails

Cem Ayin
Pint

Re: Hey, Iran

"Keeping in mind the rules of al-Shura (people's consultancy) in Islam, which is quite equivalent to democracy (but isn't the same though), a regime (and especially its ruler) can't be despotic and lay a claim to being Islamic at the same time."

I appreciate your sense of humor. So the Ummayads, the Abbasids, the Seljuqs, the Fatimids, the Ilkhans, the Ottomans, the Mughals and a few other, less important or even mentionable islamic dynasties right down to the Saudis and, of course, the current rulers of Iran have all, without exception, been - your words - "misrepresenting Islam to stay in power"? So Islam has basicly been constantly "misrepresented" ever since its inception? And as for those precious few upright true believers who represent the "real" Islam this leaves us with... the Qarmatians maybe???

I'll drink to that!

You better watch out, you better not cry. Better not pout, I'm telling you why: SQLite vuln fixes are coming to town

Cem Ayin
Trollface

Not sure if I read this right...

So Crome allows arbitrary websites to run arbitrary SQL queries on local SQLight DBs? JavaScript's not bad enough, eh?

Oh, well... as a design study for a novel operating system, Chrome ist certainly "interesting", but it still lacks a decent browser, I must say.

In Space, Still: 20 years since Russia hurled first bit of floating astronaut hostel into orbit

Cem Ayin
Boffin

"Floating"

Nitpick: The ISS is not "floating" (i.e. experiencing lift due to buoyancy). Quite the contrary, in fact: it is falling (as evidenced by the microgravity conditions aboard). The reason that it is not colliding with earth is not lift but the fact that it has been carefully accelerated to move "sideways" (to wit: in an orbit) just fast enough to avoid ever hitting Earth while falling towards, or rather: around, it.

SQLite creator crucified after code of conduct warns devs to love God, and not kill, commit adultery, steal, curse...

Cem Ayin
Joke

OT: 613 Commandments

As the old joke goes: When Moses came down from Mt. Sinai, the people were asking him: "Now, how did it go?" And Moses replied: "Not too bad - I managed to get him down to 613."

Do you really think crims would do that? Just go on the 'net and exploit a Windows zero-day?

Cem Ayin
Holmes

Re: So classic way to find an exploit.

"""

1) Read what the manual says a Windows function can do and will allow

2) See if its parameter checking stops you from doing whatever you want.

3) Check next function.

"""

I dont think anyone could have found this particular vuln using the above receipe. The problem here ist not insufficient validation of input to a privileged system function - as I read the article (and the linked explanation) it's rather a game of "spot the unintended side effect":

%SYSTEMROOT%\Tasks allows any authenticated user to create files there [NT AUTHORITY\Authenticated Users:(RX,WD)] and some system utility can be coaxed to change this file's permissions without checking if it isn't really an alias pointing elsewhere (say, a system library...) => game over :(

The problem is more akin to the classical "Unix /tmp-race" class of vulnerability. And now that this can of worms has been opened on Windows also, I would not be suprised if there was still more to be had where this particular vuln came from.

(If one absolutely wanted, one could of course subsume the creation of a file under "user input" to a "function" and checking for aliases in world-writeable directories under "parameter checking" but for my taste that would be stretching the meaning of those concepts a bit far.)

You: 'Alexa, open Cortana.' Alexa: 'Who?'

Cem Ayin
Joke

Mostly OT: Alexa vs. Cortana

Vaguely reminds me of a joke I read a few months back (originally with Siri vs. Cortana):

Nerd: Cortana, what's on in the Cinema tonight?

Alexa: Who is this Cortana?

Nerd: Er, sorry... I mean: *Alexa*, what's on in the Cinema tonight?

Alexa: *Who is this Cortana?*

Nerd: Never mind. Just a slip of tongue on my part. What I meant to say is: "Alexa, what's on in the Cinema tonight?"

Alexa: WHO IS THIS CORTANA???

Nerd: What's wrong with you Alexa? Listen, all I want to know is the program of the local Cinemas tonight, ok?

Alexa: ...

Nerd: Alexa! Ok, I did make a mistake. It's not personal or anything. Just a minor slip of tongue, you know? And now be a good sport and tell me what's playing in the Cinema tonight, ok?

Alexa: ...

Nerd: Alexa...?!?

Alexa: Go and ask this Cortana...

Build your own NASA space rover: Here are the DIY JPL blueprints

Cem Ayin
Joke

Launch Vehicle?

A DIY planet exploration rover is certainly an absolutely fabulous idea, but where's the DIY launch vehicle to match? You'll want at least something that can lauch your payload into LEO, so you can land it on your custom-made private LEO-Moon that you are about to 3d-print with the DIY kit you recently purchased at myMagrathea.com...

Gov.UK to make its lovely HTML exportable as parlous PDFs

Cem Ayin
Boffin

If your only tool is a hammer...

Both formats have their strengths and weaknesses; wise guys choose whatever suits the job at hand best.

Yes, PDF /is/ print-oriented - and that's a major advantage for publishing long texts that require attentive reading. A document set in a reader-friendly font with proper paragraph filling and hyphenation is so much easier on the eyes; it lets your mind focus on the content rather than the technicalities of a poor text rendering (which is the norm in HTML). I speak from experience, I do read a lot.

And I'm not alone. I work in an academic setting and at our lab, the computing devices most in demand ("high demand" being defined as "users scream /immediately/ when it fails") are 1. the personal laptop and 2. the workgroup printer - and that's for a reason. /Nobody/ would want to read a scientific paper as HTML on the screen, with the poor rendering constantly distracting the mind from the problem at hand. (Some folks do use rotating monitors for reading papers, but it is PDF they read on the screen in portrait format.)

And I haven't even mentioned the problem of embedded figures yet: good luck with copying the full content of a HTML page (skipping unneeded navigation code) for offline reading...

That is to say, there are use cases where HTML is simply no go.

The optimal use case for HTML (plus JS where that really makes sense) on the other hand is short, frequently changing or short-lived documents that noone would want to read offline or in print; or documents of a highly interactive nature; or reading the same document on a wide range of display sizes (making allowances for the text layout and rendering) - that's what it was designed for after all.

Bottom line: Use a hammer for nails and a screwdriver for screws. Heated ideologic debates as to whether screws are outdated and should universally be replaced with nails are frankly daft.

(And yes, both formats have rather more than their fair share of warts. A text format that is versatile enough to cover both use cases would be really nice to have. Good luck with developing something of the kind *and have it widely accepted by your audience*...)

Microsoft's TextWorld gives AI a Zork-like challenge

Cem Ayin
Holmes

Curses!

I wonder how their AI would perform against a really sophisticated piece of IF, say "Curses!" by Graham Nelson or anything in that league. Or give Infocom's "Hitchhiker"-Game a try. Will the AI ever make it through the screening door...?

Sysadmin shut down server, it went ‘Clunk!’ but the app kept running

Cem Ayin

Copy & paste

Many years ago I happened to be admin of a student computing lab running Solaris 9 on both server and workstations (those were the days...!) The workstations were set up to allow passwordless SSH logins from the server, so whenever a remote root shell session was needed on one of the workstations, the usual procedure was to log into the server, start (or re-attach) a GNU screen session and log into the clients from there. So far so good.

One fine day I had to re-boot a number of workstations I had been working on in "parallel" (really "time sharing" between the screen windows of course). So I typed the usual command: "/usr/sbin/shutdown -i6 -g0<CR>" in the first window, down and back up the client went, and being a lazy sysadmin, I just marked this same command line to be pasted into the second window, which I duely did next. Unfortunately, the second workstation had somehow reset the SSH connection in the meantime, so after the "/" had been consumed from the cut buffer and gone down the bit bucket, the SSH session's TCP connection was closed with a "connection abort" error message.

Guess what happened next?

Well, the terminal was of course feeding the string "usr/sbin/shutdown -i6 -g0<CR>" to the underlying shell session *on the server*; this being Solaris 9 the root's home directory, and thus the one that was normally your CWD when working as root, was "/", and, yes - hate to admit it - "." was in root's $PATH...

(Fortunately, I had made it a habit *not* to use -y with shutdown, so the server was duely asking for confirmation of the shutdown, which I *happily* declined...)

Brains behind seL4 secure microkernel begin RISC-V chip port

Cem Ayin

Πόλεμος πάντων μὲν πατήρ ἐστι

A research group that is really serious about computer security and has been for years is still receiving government funding? And its technology gets (albeit to a limited extent) adopted by mainstream IT industry giants? What's happening? Is the world of computing slowly being turned downside-up?

Could it be that the New Cold War will bring us reasonably secure computing devices eventually? So Heraclitus was right after all?

OTOH: Will "reasonably secure computing devices" (if indeed we ever get to see them) mean anything more for Joe End-User than a black box that is even more secretive about its phoning-home activities while being, due to its security features, completely opaque to even advanced computer nerds? It this what e.g. Google is aiming at with Fuchsia? Will the new world of computing be a truely "brave" one?

Let's harden Internet crypto so quantum computers can't crack it

Cem Ayin
Alert

Re: Possible deadly flaw - compromised software

"For a closed source implementation (eq most Windows programs) there is a danger that a deliberately weakened random number generator is used."

The very same problem exists for FOSS-code, even assuming it has been thoroughly audited. Consult the search engine of your least mistrust about "Reflections on Trusting Trust". As for the countermeasure proposed by Wheeler I'm not sure about its practicality in real life, given the various nondeterministic bits of compiler output; in any case it is (A) a rather involved procedure and (B) it would miss trusting-trust-style attacks targeting other system binaries or those performed at the firm- or hardware level.

Multics resurrected: Proto-Unix now runs on Raspberry Pi or x86

Cem Ayin
Boffin

Re: Anything we should steal ? - Definitely

"Like OS/400 and AIX?"

OS/400 (now "IBM i") is the other commonly cited OS that provides a single level store, and AFAIK the only one still in active commercial use today. (Aegis and KeyKOS are two other, now defunct, examples that I remember OTTOMH.)

AIX OTOH is IBM's homegrown (SysV-based) implementation of Unix and while certainly providing mmap(2) & friends I am not aware that it has a single level store. Not that it would be impossible to implement a POSIX-ish OS on top of an OS based on a SLS (it has, in fact, been done: Domain/OS), but to my knowledge AIX is basically SysV with the usual set of BSD extensions as well as IBM's very own bells and whistles added.

Note that a "single level store" means more than just the ability to mmap files (I had mentioned mmap only as a /very loose/ Unix-analogy); in fact such a system does not have a "file system" in the usual sense of the word at all - just a large, usually segmented, address space or object store that is transparently being made persistent by the OS through writing out dirty pages to permanent background storage as needed.

No need for file I/O to keep data persistent, /that/ is the key point.

FWIW, the concept appears not to be entirely "dead"; while searching Multics references I stumbled on this paper

http://repository.cmu.edu/ece/370/

but I have not yet had time to really digest it. And then there is of course "The Machine", or rather, with quite a bit of luck there will be one day... although "memory centric computing" - while also being built around a persistent main memory is a different and more far-reaching concept altoghether.

BTW, another Multics nicety that I had forgotten in my original post is the fact that Multics segements containing executable code could (being mapped into the address space all the time anyway) be directly invoked and the interface for doing so was IIRC provided and standardized by the OS, thus leading to implicit cross-language compatibility of executable code. No need for FFIs and stuff.

Cem Ayin

Re: Anything we should steal ? - Definitely

"Does Multics have any useful features that are not present in modern OSes ?"

Its virtual memory implementation comes to mind: in Multics, "files" were really persistent memory segments, i.e. all files were "memory-mapped" in Unix-parlance.

https://nbonvin.wordpress.com/2008/02/05/review_the_multics_virtual_mem/

The concept was not without problems of its own (see the linked article above and the articles linked therein); but given today's availablity of reasonably fast, persistent mass memory technologies I think that exploring direct mass memory access while doing away with traditional file I/O might well be worth exploring once more.

Create a user called '0day', get bonus root privs – thanks, Systemd!

Cem Ayin
Facepalm

"So we've got invalid authorization data here..."

"...no problem, we'll just fall back on granting maximum privileges."

Well done, Lenny. We are impatiently looking forward to that shiny new logind thingy, which I am sure you already have in the making...

Seagate hauls out fat form factor throwback hard drive

Cem Ayin

A bit larger?

That Eagle thingy looks rather dainty to me.

Have a look at this beauty:

http://www.cpushack.com/wp-content/uploads/2016/11/3000-33_1978-PromoPhoto-32.jpg

I mean the cabinet on the far left. No, that is not a washing machine (although the amount of energy being converted while spinning is probably comparable, at least it feels that way).

Security bods find Android phoning home. Home being China

Cem Ayin
Facepalm

Re: Sniff sniff

"I smell another transgression by the Chinese Government."

Sending millions of users' digital family silver to a single well-known server, apparently without certificate pinning? Using plain old DES in the mix? I know one should never underrate the power of human stupidity, but frankly I'd expect Chinese surveillance agencies to make a better job of it. Actually, I think even North-Corea would do a better job these days...

Browsers nix add-on after Web of Trust is caught selling users' browsing histories

Cem Ayin

Re: Naming

"Yes, these [the Nazis] would have had to sit on the left in the Reichstag. Unfortunately that side was occupied by the internationalists and people making eyes at Stalin, which was anathema."

You got it completely backwards. In the first half of the 20th centry, the demarcation line between "left" and "right" was marked, next to the social question, above all by the stance on two hallmark political positions: militarism and antisemitism.

While is true that in 1914, the leadership of the SPD caved in on the question of financing the war (Kriegskredite) it was not least this decision which eventually lead to the splitting off of the party's left wing and the formation of the USPD and ultimately the KPD. But at the time even the most depraved and corrupt Social Democrats would not sink as low as shouting antisemitic slogans, the rejection of antisemitism being regarded on the left as a sort of litmus test for political sanity. (The saying "Der Antisemitismus ist der Sozialismus der dummen Kerle" [antisemitism is the socialism of fools], often but maybe falsely attributed to August Bebel, which was in common use among Social Democrats in Germany at the time, sums it up pretty neatly.)

In short: in Germany in the first half of the 20th century, political people knew where they stood, knew their enemies too, and a party overtly adovcating antisemitism and imperial expansionism had no business sitting on the left in any parliamentary body. In other words: your comment is tosh, top to bottom.

That will be an F-grade in German history for you then. "Geschichte: 6. Setzen."

Red Hat eye from the Ubuntu guy: Fedora – how you doin'?

Cem Ayin
Meh

Fedora has its ups and downs...

...mainly depending on the release cycle of RHEL.

Don't forget that Fedora is, above everything else, a beta testbed for Redhat's cash cow, RHEL. In my experience, those Fedora releases that are candidates for the basis of a new release of RHEL tend to get significantly better (read: more stable and useable, less buggy) as the fork for the next version of RHEL approches. OTOH, releases that start a new development cycle are usually awful: full of quick, poorly tested hacks let loose on users who are basically expected to debug the stuff in lieu of the developers. (Remember the first version of the current installer? I don't remember when exactly it was introduced, but it could not do such basic stuff as install into a preexisting Linux partition. And it had a bug that made it set /dev/sda1 as the swap device, no matter what you specified in the user interface. Mightily fun it was. Not.)

Note that the above observations outline a /tendency/ only (though one I've been observing for almost a decade now). Also, various features for a new RHEL release might actually be culled from different releases of Fedora, which can make the observed pattern more fuzzy.

VMS will be ready to run on x86 in 2019!

Cem Ayin
Boffin

Re: Woo Hoo!

"Will this mean my VMS skills will be useful again? Wonder if they will implement a version of JCL (job control language) that was really powerful stuff."

You seem to confuse VMS with MVS. Or DCL with JCL.

Your wget is broken and should DIE, dev tells Microsoft

Cem Ayin
Boffin

Cool down

I know I'll get massively downvoted for this, but command name conflicts have been around in unixoid operating systems for ages...

Are you old enough to remember the conflict between 'rsh' (restricted Bourne shell) and 'rsh' (remote shell)? Some vendors solved this by putting the two binaries in different directories, but HP did rename the remote shell binary to 'remsh' (at least in the versions of HP-UX I have known, to wit 7.x - 9.x) which was not good for cross platform script compatibility.

Even worse for cross-platform scripting was their decision to embed the functionality of 'nawk' into 'awk' and do away with the 'nawk'-command altogether.

Another blunder of the sort that comes to mind is the decision of Mr. Thorvalds himself to name the Linux system call tracer after the SysV STREAMS tracer thus giving 'strace' the functionality of 'truss'...

The GNU project has been providing incompatible versions of POSIX commands under the original names for as long as it exists.

And let's not talk about the variety of shells that you find under /bin/sh in different versions of Unix or Linux (these days, many script writers naively assume that /bin/sh is always linked to /bin/bash only to find their scripts fail on non-Linux or Debian-based systems). Solaris even has two distinct versions of the Bourne shell (in /usr/bin and /usr/xpg4/bin, respectively) in order to be compatible with its early versions as well as with the official standard.

These are just the examples that I can think of OTTOMH.

As the saying goes: "The wonderful thing about Unix standards is that there are so many to choose from". Feel free to blame Microsoft, but don't forget to add at least AT&T, UCB, Sun, HP, IBM, SGI and Linus Thorvalds to the list...

Tesla whacks guardrail in Montana, driver blames autopilot

Cem Ayin

"Autopilot"

I believe that the term "autopilot" as applied to Tesla's driver assist system, while technically correct, is highly misleading and tends to raise unrealistic expectations wrt its capabilities.

Why is it "technically correct"? Because is basically does what an autopilot in an airplane or a seaship does: it keeps the craft on a preset course. (Actually the Tesla system even does quite a bit more than this, I am not aware of any aviatic or nautic autopilot sporting a collision avoidance system as advanced as the one used by Tesla - after all they don't need it.)

And that takes us straight to my second point: why is the term "autopilot" misleading? Because it makes people think that they can rely on it most of the time. Which is basicly true in the air or at sea, where obstacles are rather few and literally far inbetween and where the autopilot just frees the crew of the tedious routine task of staying on course. The environment still needs to be watched of course, but obstacles do not normally keep popping up all the time and in a split second.

But this is obviously not true on the road (not even on a motor-, free- or expressway) where the average density of obstacles is higher by a few orders of magnitude. The driver just has to watch the traffic all of the time, even under the best of conditions and no matter how advanced the driver assistance systems of his vehicle may be. Which, of course, makes the very concept of an "autopilot" for automobiles somewhat dubious - on the road it's either fully autonomous driving (at the moment not technically feasible) or it's mostly useless. On the road, the ability to stay on a preset course, augmented with limited collision avoidance capabilities just doesn't cut it.

It is true that Tesla clearly states the limitations of it's "autopilot". The problem is that these limited capabilities are just good enough to mostly work in many situations, thus making the driver more and more careless and daring over time, but can and will fail miserably eventually - typically in a situation where the driver has developed enough of the "contempt that goes with familiarity" for the dangers of relying on the autopilot and has, conciously or unconciously, come to expect a level of autonomy the system cannot provide.

You can call this stupidity, which indeed it is. [sarcasm] Or you could call it bravery (the line between the two being fine at times) - after all the odd bloke pushing the "autopilot" to its limits (and beyond) ist in essence nothing but a volunteer test pilot for a system that really wants to be a fully autonomous vehicle when it grows up but for the time being needs a lot of beta-testing and exploration of corner cases even for its most basic sensors and algorithms.

I wonder if there is somewere on the Tesla campus a monument to "our brave beta-testing customers of blessed memory". In any case there should be one. Dulce et decorum est pro progradu mori... [/sarcasm]

NVMe SSDs tormented for months in some kind of sick review game

Cem Ayin

Re: "Drives"

Yes, the architectural concept behind the project dubbed "The Machine" by HP management is certainly interesting, but IIRC it all hinges on the availablility of technically and commerically viable memristor memory (it's supposed to be built not around a single level /store/ but really a flat, single level, persistent main memory, as in the diagram linked to in your post) and it remains to be seen if HP, currently a company very much in distress, still has the power to make this a reality.

The problem is, as I (with my limited competence in the field) see it, twofold: 1. On the level of electrical engineering (provide the chips for a single level persistent memory, and with good-enough yields at a competitive price point) and 2. provide a software abstraction and SW development model that gives enough benefits to make abandoning legacy code attractive and commerically viable.

Neither is a trivial task, to say the least...

If they do manage (and I hope they do), interesting times could be ahead indeed

Cem Ayin
Meh

"Drives"

With non-volatile storage devices such as these available it's a pity the concept of a single level store (as implemented in MULTICS [now defunct] or AS/400 [now IBM i]) never caught on in the mass market. These devices would neatly fit in the storage hierarchy between a DRAM write cache (to ease the wear on the flash storage) and the remaining, higher latency stuff. Am I the only one who thinks that it's really a waste having to use these devices as "drives", for lack of a software abstraction that is able to leverage their power?

Microsoft has created its own FreeBSD image. Repeat. Microsoft has created its own FreeBSD image

Cem Ayin
Devil

MS Takeover? I think not.

What exactly could MS possibly hope to gain by throwing a fork of FBSD on the OS market?

This just appears to be an attempt to make Azure more attractive to BSD admins (and, probably more importantly, to Linux admins who are increasingly p****** off by systemd).

I'm by no means a Microsoft fanboi, but if anything this will give more momentum to FBSD and it is good news.

Satan chosen for closest Beastie resemblance.

Latin-quoting Linus Torvalds plays God by not abusing mortals

Cem Ayin
Trollface

"Hoc volo, sic jubeo...

sit pro ratione voluntas" has always been his favourite rationale for anything, so nothing new under the sun here...

Midlands tech dynasty SCC bypasses Europe, opens service centre in Vietnam

Cem Ayin
Joke

"SCC"? You mean as in...

...Sirius Cybernetics Corporation?

Smartmobes in spaaace: NASA deploys Android nanosats

Cem Ayin
Linux

They use what's already there, I suppose

"I always wonder why Android needs to go in to devices like this?"

It says "off-the-shelf smartphone tech", so most likely they are using ARM-SOCs originally designed for smartphones. And Android is what already runs on these devices, any flavour of GNU/Linux would probably have to be ported first (ARM-SOCs don't adhere to the same hardware interface standards that commodity x86-systems do).

New HTTP error code 451 to signal censorship

Cem Ayin

Re: Quis censores ipsos censor?

You certainly must mean "quis censebit ipsos censores" (or, if there is only one censor to watch, "ipsum censorem"), though this would still be dubious from a semantic point of view, since, while "censor" is certainly ethymologically related to "censere", the basic meaning of the verb is more along the lines of "to think (right)", "to believe" etc., as in "ceterum censo internautam non esse super grammaticos" and I'm not sure if "censorem censere" makes any sense at all (I don't have a copy of OLD at hand right now) but anyway this is now starting to get OT...

Biting the hand that feeds IT © 1998–2019