Posts by The Other Steve

Cyber Sec victim blaming ? Plus ça change ...

"Meanwhile, the rest of the world will be blaming whoever left all of this stuff on poorly-secured internet-facing servers. And we will be pointing and laughing."

Yeah, Sony were wearing a short skirt, so obviously they were asking for it. And anyway, they deserve it.

Indeed, and here is some more information on that

http://www.comtrend.com/cgi-bin/db-search.cgi?template=News&dbname=product&key2=17&action=searchdbdisplay

"A soon to be released version of the PowerGrid DH-10PF Ethernet Adapter will also enable one of the main requirements of IPTV operators: a TR-069-compliant powerline adapter. These devices will allow operators to remotely manage every node installed in the network, perform firmware upgrades and access logged data among many other features. "Our service provider customers want to manage every node in the home network without modifying the home gateway or broadband router in any way. Every change made to a gateway or router could delay a deployment by several months, especially if the equipment has to be re-certified.", Harold Fitch stated. "

(That's from 2008)

And it was the DH-10P and DH-10PF models that were recalled. So at some point, these units have phoned into a Comtrend auto config server on BT's network, as described here :

http://www.slideshare.net/mickaelboubala/comtrendacsdspdf

So it isn't necesarily the hub that's peeking into your LAN, but the comtrend PLT's that are phoning out.

Then again, as the above poster says, most likely the hub is also TR069 compliant.

Something that isn't mentioned in the wikipedia article on TR069 ( http://en.wikipedia.org/wiki/TR-069 ), but is mentioned in the linked Comtrend document is the following :

"At any time, CT-ACS can request that a CPE initiate a connection to the CT-ACS using the Connection Request notification mechanism. By using the Connection Request, Comtrend ACS can ask the CPE to reboot or restore CPE settings to the factory defaults. Comtrend ACS can also send Grouping Connection Requests to all of the CPEs that belong to a certain CPE Group."

This is how BT update your HH firmware for example.

Can it do other stuff ? Oh hell yeah.

" For example, it can ask the CPE to ping an IP address or hostname and report the result of the ping test."

And so on.

So fuck yes, it's an issue, fuck yes, BT could be doing anything in your network that the the TR-069/CWMP setup allows them to do, and fuck yeah, we should be concerned.

However, this is a general issue regarding TR-069 management, not just specifically BT. Although they are asshats.

Any device that uses TR-069/CWMP does not belong to you unless you can switch it off. Any network you install such a device on, well, join the dots.

HTH

PS. Note particularly in the above quote "Our service provider customers want to manage every node in the home network without modifying the home gateway or broadband router in any way"

So just swapping out the hub is not going to solve the problem that your PLTs are ratting on you. I have never yet plugged my PLTs in. But I most certainly will be doing so now, into a machine with a network analyser running on it.

Oh, and this could all be wrong, could be some other mechanism. Glad to hear from anyone who knows better.

Yes

An ugly, ginger, middle child. Now stop whining.

What ?

"Many of us welcome a world where interoperability is not really an issue if everyone can cheaply use much higher level software than Sun/Oracle want to sell. "

And what, pray tell, is the name of this utopia ?

Nope

"What is really needed is to layout a 10 year ,20 year or even longer term plan"

It is quite literally impossible to make a realistic economic plan of that range, simply because things change. Take for instance growth forecasts which are now different than they were six months ago.

Had we made a 20 year plan based on the information we had just six months ago, it would now be broken.

Well, yes quite

"but I may require usage agreements and define permissions to access it"

I avoided the [D]RM issue as I didn't have my asbestos pants handy, but yes, absolutely.

Let's explore that a bit. Say I sell someone some rows from my dataset. Do they now own them ? Can they show them to others ? Use them in a profit generating capacity ? If they profit from it, do I want some of it ? I can hear the freetards cracking their knuckles ready to type flamage, but these are important questions.

How do I price access, essentially. For many large datasets the value is not in the individual data but in the aggregation, which allows you to perform ad-hoc queries and derive some result. Arguably if I have a gert big dataset and you want to run queries over it, you should be paying for the whole set, or at least each row you touch, rather than for the four rows of results you get at the end.

And what have you just paid for ? To own the results ? To have a licence to them under certain terms ?

One of the reasons that "information wants to be free" is so wrong headed is that while it is exceptionally easy to put a lower bound (0) on some piece of information, it is very hard to find an upper bound. The number of people who drive VW beetles, wear wellies and like orange juice may look like a piece of trivia to most people, but to someone it could be the key piece of information for a multi million pound business venture.

Hence much information actually tends towards expensive - at least in volumes large enough to be useful - rather than free.

So while "we demand free access to data" is a nice rallying call - and there are many, many datasets that we ought to be able to get at, especially ones we already paid for, and ones that benefit the data providers by their existence (bus timetables, transport geo info, etc) - it will take a bit more than just having a suitable technical framework in place to get the data out of Berners Lee's "silos".

They aren't inaccessible by accident, but by design.

All the girls I know have Android phones

And she's very happy with it.

If you re-use them

Then they aren't ONE TIME pads anymore

Oh so they aren't just thieves

They are unabashed thieves.

+1 for clue, well done that chap

*Applause* Look, other commentards, see how much smarter people seem when they actually have a fucking clue what they're talking about because they took time to click the links or read something of the story before spewing their brain farts into the interwebs ?

Look upon the above comment and aspire to it.

YANAL

You are wrong in all your assertions, until you understand construction of contract you need to stop making assertions predicated upon your ignorance.

No no, stenography

Simply replace the whole IP infrastructure with a load of dolly birds managed by Sid James-esque foremen doing typewriter samizdat of knob gags and posting them on to everyone. It will be practically indistinguishable from the real thing.

On a more serious note, all censorship is oppression and not to be tolerated. anyone who believes otherwise, who believes that can be "good" censorship for "good" reasons is lucky enough never to have had the immense misfortune of spending quality time with any of it's more vociferous proponents such as the late and very much unlamented cakky fingered old witch Whitehouse or any of her contemporaries, or any of their modern reincarnations.

There is, quite simply, nothing - and I mean nothing - that more inimical to mankind than allowing these motherfuckers even the merest illusion that they are in control. The day I met Whitehousse, as a small child, the very category of being she was supposedly sworn to protect, was the day

I knew for certain that evil exists in the world.

No doubt someone will be along in a minute to tell me that kidpron is worse. It isn't. It is horrendously bad, but in the hierarchy of things which are evil to humanity, not just humans,there are things which trump it.

Flame on, bitches.

Well, duh.

"Oh, I expect there are girl geeks like this, but I never met one. I don't say 'he' because I'm a misogynist."

No, you say that because you haven't met enough girls.

"And they seem to be crawling out of the woodwork this week!"

You have to be shitting me, you've literally only just noticed that everyone in the internets is indistinguishable from from a semi-retarded sociopath with all the happy social skills of Jack the Ripper ?

Where the fuck have you been ?

Pointless arguing with ignorant anons

So I will merely refer you to the following article, the title of which is "SHA 1 Broken"

http://www.schneier.com/blog/archives/2005/02/sha1_broken.html

Keep on failtruckin.

Fixed fixed ?

Any sufficiently sophisticated economic statement is indistinguishable from utter cockwaffle, unless you have a thorough grounding in the relevant economic theory, at which point it becomes obvious.

Oh just say Nazi and get on with it.

"Suffice it to say that your trick of repeatedly casting the enemy as stupid and evil has historical precedent."

Yes, it does, I've seen Monbiot's columns. Oh, and LOVING the irony - not to say hypocrisy and circular logic - of you using up all that text to call someone ignorant because they don't agree with you and then ending it all by suggesting they're a nazi, as though that were some kind of crushing QED.

Priceless. This issue really does bring out the worst in all of us.