MichaelGG

Look at HTTP. How many implementations correctly and interoperably handle line folding? Comments in headers? Different line endings? Stick to a small subset and you're fine. Actually use the spec as written and it is hopeless. These crazy semi-freeform text protocols are a curse. They do not make implementation easier. They trick people into thinking they made it easier.

Practically, it is not possible to implement the spec in an interoperable way. Existing implementations are mutually incompatible. Hence the need for config flags per "trunk". What one system requires, another will reject. Sad but true.

The protocol problems are due to the text-based format and a bizarre desire to make said text format "human friendly". It inherits the stupidity from HTTP (line folding, comments in headers) and adds its own fun. The authors actually suggest that the "intent" of the message be followed in case of errors. It's terrible. The packet issues are due to the strange use of UDP with mandatory TCP switching. Needless complexity.

Oh and these aren't theoretical. Two big, widely deployed implementations cannot even agree on how headers end, and will read the same message differently. This can be exploited when a network does header processing. Imagine adding a "x-accountid" header, and removing any existing ones - if interpretation differ on what constitutes a header, an attacker can slip fake headers in. Not entirely dissimilar to browser exploits that let script include a header with a newline in the value, letting scripts maliciously set headers they shouldn't be allowed to.

I've seen PBX people find religion once they wake up Monday morning to a weekend of hacked calls to Africa. Though sometimes that religion is in the form of yelling at upstream providers to please give them refunds.

And because of these insecure systems, the more serious issues (all this SIP software is tons of C, and I've found exploits in just 1000 line utilities, let alone protocol level hackery and other fun) get ignored. I found a simple redirect bug in a VoIP platform. Ignored. Later some guy used it to the tune of $90K.

I don't want to become a criminal outright but I've gone from a "friendly disclosure offline and let you lie about fixing issues" to "Sit on 'em and sell 'em one day" model because everyone's so obtuse.

I'm not saying you're wrong, but you're saying XP collected lists of installed apps? And had no way to disable? Citation? This is more than DrWatson/crash reporting.

How is it better than ever as far as choice? I can't turn it off!

Trust is not binary. I trust Microsoft not to, say, deliberately weaken Bitlocker. I trust them to generally keep me safe and not turn on my webcam and watch me at night.

It does not mean I trust them building up a profile on me. Someone in this thread said Cortana pops up coupon offers when visiting Dell.com? I do not trust this to not be abused.

It is also about the overton window and shifting people's acceptance of spying, even in innocent forms like crash metrics. I've defended telemetry and used to turn it on for most machines, because it was optional. Making it mandatory is the wrong policy.

Really? Sounds like Windows 10 cannot turn of this telemetry stuff. And sends my installed apps. But not allowing turning it off is not excusable. All it does is piss people off and encourage the public to accept phoning home as a fact of life and nothing to see.

Whoa wtf. Is that Edge only?

Is each cert chained to the previous somehow? Like a field from one hashed into the next, so that you can detect gaps in the issuance? That way they can't even issue a secret cert for a one time national security op without breaking the chain.

If 2 people buy a new MacBook and run a WebGL or Canvas fingerprint, why would they have different results?

I do not believe it is unique at all. It will be unique for a hardware-OS-driver-browser combo. And if you are not doing anything strange, those numbers will be pretty common (most users just use whatever OS/driver package ships, and the browser gets upgraded like everyone else).

Probably to keep up the illusion of the story that people think it's worth paying for Windows upgrades.

Microsoft has established support timelines. They will have to backport fixes and carryout whatever level of support they do regardless of how many people upgrade, because it will never be 100%. More users on Win10 just means a better pitch to app developers about using the latest Store-enabled APIs.

But you're right they want to show improving numbers and then mine users for ads. MS absolutely hates how they let online/mobile/advertising slip out of their grasp due to terrible management. So they're poorly trying to implement the Google model to compensate.

Thing is, they are sucking at it. Let people turn off telemetry, little to lose - unless they want to condition people all they are doing is fomenting anger towards MS. And if you're going to go all in, then have some taste. Fix the store. Stop spamming shit in the start menu. But take a look at XBox with its ad-covered dashboard and we can see MS just does not get it and is doomed to poorly trying to ape others and doing it with zero class.

But hey at least we are getting nicer dev stories from them! I love that enterprises enjoy paying crazy prices for Azure "solutions" as it subsidizes MS investing in dev tech.

Generally noise never works to defeat timing or fingerprinting attacks. It just makes it slightly harder.

Is that for FF or your specific user agent? I always thought Panopticlick wasn't being fair there. Browsers update all the time, so your agent is changing every 6 weeks. If they are comparing your UA of today against UAs from their entire project, it won't be remotely accurate.

How can that be? If 100 users buy a specific MacBook or ThinkPad they have identical hardware. Or do different revisions of the same chip have different rendering? Windows and browsers force updates at about the same schedule on everyone.

I'd expect it to narrow you down to hardware/OS, perhaps driver (though most users use whatever Windows or the OEM throws at them). How can it do more?

OpenVPN protocol is sorta weird (I wrote a clean room client and server impl). But IPSec stuff is such a pain to deal with that it is not worth it despite it having better OS integration.

So when they purposefully dismiss F# and say it's just useful for scientific and engineering (with a touch of finance) they find they don't get much adoption from general business developers?

F#, even if used as a better C#, is still a win. C# has improved a ton since F# appeared, but it's still clunky. Microsoft should have had a push, F# for everyone, but this is the company that had to be dragged into generics (by the F# people) so I don't know what we'd expect.

All F# needs is real committment to level tooling. Instead it's an afterthought. It's enough to give even me pause when starting a project.

If it was a big deal, no doubt the price would rise.

As a proponent of nationalism, I'm very pleased with this move. Now only if Canada, Japan and Europe could get in on it, so each major area would have its own social media. It's obvious that Twitter isn't going to block agents of the US Government for similar "offences".

So despite how pathetic and partisan this is, hopefully it'll have great long term secondary effects by siloing countries. Or at least a small step in that direction.

Wonder if they'll ever get around to making AIPAC do so. Until they do it makes it obviously political posing.

Many WiFi networks record MAC addresses to help associate devices with IP/users.

Exactly. I played DnD, asynchronously, over the phone. Hours at a time with the DM, rarely a die rolled.

If the input parsed is supposed to be well formed or isn't in a high performance area it's totally fine to use parse rather than the sorta ugly TryParse (which require using out params you just said were bad).

Especially if all they're going to do is throw.

I started using C# during the preview. I've never used CreateCommand.

On my Android phone, the system says Uber is 190MB plus 3MB of data.

Yeah Lyft was nice in the US, but in Guatemala I can't go back to life before Uber. I hope Lyft brings in a higher class service though like Uber Black.

Pascal assumes one true God or not. For all he could prove, maybe the afterlife punishes people for choosing that God.

All that aside, there's zero evidence to believe in an afterlife. With cryonics we in theory understand it, if the brain is just its atoms, then it's quite conceivable that the information might be able to be reconstructed.

I don't see how they are comparable.

If the quality is there, I welcome it. I'd love to spend over 2000 on an X series ThinkPad that doesn't burn my skin and has a real screen (3:2 or better).

This is really cool! I rarely send faxes but it's always a pain when I do and all the sites feel like they're from the 90s.

Do you have your J2 situation sorted out yet? They're suit-happy.