Posts by Phil

@Kenny Swan - It's Likely ...

that some recipients will have recently booked flights which goes some way to excusing them opening the zip (but not then running an executable!).

Recursion - So Why This Focus on 'Your' DNS Servers?

Whether or not 'my' DNS server is patched, if it queries an unpatched server for the IP of an unknown domain and the unpatched server has been poisoned for this domain then surely 'my' DNS cache becomes poisoned too.

@K L

The bad guy sits between you and the banking site and can relay all communication in both directions. Any authentication exchange can also be relayed. Once you've said OK to the message that warns you that the SSL certificate doesn't match the banking site that you think your using or isn't signed by a trusted 3rd party then your doomed!

Why Not Scan?

Here's how I see it working:

- I go to the polling station, identify myself and am handed my voting slip.

- I place my voting slip into the e-voting machine and it prints a unique (and random), human readable identifier onto the slip and issues a receipt with the same identifier (which I compare).

- I mark my X or Xs as appropriate.

- I place my voting slip into the e-voting machine.

- The machine scans the slip and registers the vote.

- The voting slip is retained should manual counting be required.

- I go home and go on-line to the e-voting web site where I am prompted to enter, for example, the 3rd, 7th and 12th character of my identifier.

- The web site shows a list of the (n) matching identifiers, sorted by identifier, and their associated vote and I confirm that my vote is correct.

- Following the election results being ratified the full set of identifiers and votes is made available. The physical voting slips are all collected, without reference to their original location, sorted by identifier and filed.

There are things that might cause concern:

1. Is the slip marked in some way to link it to the identified voter?

2. Can the generated identifier be linked back to the voter in some way?

1. is already possible with manual paper ballots and 2. should be addressable.

Have I missed anything?

@call me scruffy and AC Friday 9th May 2008 20:50

Let me guess - you're the kind of people who call help lines and then hold the person on the other end of the phone personally responsible for whatever your problem happens to be.

By the way the article is about the DWP not HMRC.

What's The Problem?

If companies publish their caps and their fair use policies then it's fair enough to impose them. Would the Comcast users who say they'll leave if the 250GB cap is imposed be happier if, instead, Comcast just terminated the contract of anyone who exceeded some unspecified amount of traffic?

I don't like the idea of caps per se but I think that offering a cheap, low cap service, a medium priced, high cap service and an appropriately priced uncapped service is the way to go. All services should also provide facilities to see what you're using.

@AC 16:01

You're right, 4 weeks is 2419200 seconds but on an 8Mb/s line this equates to 2419200 MB not 19353600 (that figure is megabits not megabytes). That said, that's equivalent to 2362.5 GB which is a lot more than 250GB.

Things I don't Understand ...

1. why there is a distinct signature for passwords in memory.

2. why passwords aren't wiped from memory when I lock the machine.

3. why el Reg comments don't provide a 'refer to previous comment' option.

4. why my local supermarket doesn't have fresh bread on Mondays.

Is UPnP The Issue?

From what I can see the problem isn't with UPnP but with the home gateway router manufacturers' implementation of it.

Take a look at "Understanding UPnP™: A White Paper" at http://www.upnp.org/resources/whitepapers.asp. Once you get past the Windows ME logo and the 'future tech' verbiage it comes down to an appliance advertising the services it offers.

Now look at consumer internet gateway routers (IGR) and ask why a consumer IGR needs to allow its internet connection settings or password to be changed via UPnP.

I can see why an IGR would allow UPnP to configure port forwarding (external to internal) - this replaces the process that I would otherwise need to undertake manually – but why an IGR should offer any other service is beyond me.

If the only UPnP request that my IGR recognises is one that opens an external port then I’m happy – that’s what I thought it did and my internal application firewall (ZoneAlarm) will let me decide whether a specific application is allowed to listen for incoming internet requests.

@Sean 'T-shirt' Purdy and amanfromMars

and for the drinkers... "I read it in wikipedia. So it must be. True."

@Usually spelled...

106,000 English pages (30 pp) for strip-o-gram

Why Only Fast Ethernet (100mbps)?

This is a question I've been asking ever since wireless pre-N products hit the market.

The Asus WL-500W (draft N) even mentions on the blurb page that it 'achieves speeds higher than 100Mbps' and yet it only offers fast ethernet on the wired side. USB 2.0 hard drive transfer rates easily exceed 100Mbit/s - the LaCie Mobile Drive, for example, claims from 25MB/s (200Mbps) up to 30MB/s (240Mbps). Most motherboards and home PCs these days come with gigabit ethernet as standard. A gigabit switch can be purchased for around £30 (retail). So why only fast ethernet on this type of device (USB network server)?

Products I'd like to see:

- ADSL2+ modem/router with SPI firewall, GbE 4 port switch, wireless-N

- ADSL2+ modem/router with SPI firewall, GbE 4 port switch, wireless-N, USB print & storage server

- ADSL2+ modem/router with SPI firewall, GbE 4 port switch, wireless-N, USB print & storage server & all the other frills

What's New?

Unsecured connections are insecure - why is this news?

If you are using a session cookie outside of a secure connection then include an encrypted timestamp and nonce. If you get the same timestamp and nonce more than once for the same session ID then reject it. If the timestamp is outside an X minute window then reject it.

Strictly speaking, if the clock resolution is fine enough then the nonce isn't needed but it does make it harder to crack the encryption.

Or am I missing something?