News for hackers. Stuff that matters.

giovannicarruba

Re:Just one QUIC bit on Wednesday March 28, 2018 @03:12AM (#16696020)
IMO the article completely fails to describe the actual issue.

- "Then there is the NAT function, where the 5-tuple of protocol, source and destination addresses and the source and destination port numbers is used as a lookup vector into a translation table, and both the IP and the inner transport packet headers are altered by the NAT before passing the packet onward."

Nice try, but if the outer layer is UDP, then NAT alters the UDP packet headers. The QUIC payload is never touched.

- "Many network operators use the IP and transport packet headers to perform traffic engineering functions, packet interception and forced proxy caching. Various forms of middleware may reach into the TCP control fields and manipulate these values to modify session flow rates. All of these activities are commonplace, and some network operators see this as an essential part of their service."

I don't see why the people tasked with standardizing Internet protocols now have to make provisions for the jerks who literally break the Internet.

- "This bit, the “spin bit” is intended to be used by passive observers on the network path to expose the round trip time of the connection. The management of the bit’s value is simple: the server simply echoes the last seen value of the bit in all packets sent in this connection. The client echoes the complement of the last seen bit when sending packets to the server. The result is that when there is a continuous sequence of packets in each direction this spin bit is flipped between 0 and 1 in time intervals of one Round Trip Time (RTT). Not only is this RTT time signature visible at each end, but it is visible to any on-path observer as well."

I have literally no idea why a protocol should actively leak unnecessary information to a passive observer, and I have no idea what passive observers would do with the information they can deduce from this "spin bit". The payload is still encrypted, so you still can't do all the "traffic engineering, packet interception and forced proxy caching". As a passive observer you sit somewhere in the middle of the whole stream, and if you can even fish out the necessary packets (they might take different routes in each direction), you still don't know how far you are from the other end. Not even talking about the random processing delays at the server end. You're measuring garbage. How is this bit even useful for anything?

Re:Open Source Color Management Is Broken on Sunday February 25, 2018 @03:43AM (#16457907)
I have yet to see an Android desktop.
Re:Open Source Color Management Is Broken on Saturday February 24, 2018 @12:42PM (#16454322)
Which two are those?
Re:Open Source Color Management Is Broken on Saturday February 24, 2018 @12:41PM (#16454316)
Did you just assume my color space preferences?
Re:Open Source Color Management Is Broken on Saturday February 24, 2018 @12:38PM (#16454303)
After reading this Linux rant and seeing how Apple is systematically marginalising its Pro customers, I'm actually inclined to believe you. Windows might be a pain for John Doe sometimes, but Microsoft also makes sure an insane amount of obscure professional features (like color management) keep working.
Re:Open Source Color Management Is Broken on Saturday February 24, 2018 @12:14PM (#16454180)
It's not. An Eizo EX3 sells for 85 bucks here, a Spyder 5 for 95. A ColorHug2 amounts to 115. Since the ColorHug2 doesn't include the actual calibration software, it is equal to the EX3. Paying 35% more just for the "Open Hardware" label and then not being able to reap the expected benefits (better support etc.) doesn't sound like a good deal.
Re:Open Source Color Management Is Broken on Saturday February 24, 2018 @11:57AM (#16454097)
It appears that KDE could do much better without any actual effort. Just merge the existing code into the base packages like GNOME did, don't make it optional.
Re:Open Source Color Management Is Broken on Saturday February 24, 2018 @11:46AM (#16454044)
What attitude? Paying for something and then expecting it to actually work?
Re:You Can't Have Denmark Without Danes on Saturday February 24, 2018 @11:03AM (#16453801)
I wonder why five islamic terrorist attacks didn't seem to have any impact on Denmark, while France and Germany have escalated their police states to incredible levels. Is it also because of all the trust? Do people in Denmark maybe trust that the police will catch the perpetrators, while we in Germany know that the Police no longer even tries to catch petty thieves and could never be trusted to avoid a terrorist plot?
Re:Open Source Color Management Is Broken on Saturday February 24, 2018 @10:54AM (#16453759)
...which is just how the whole clusterfuck begins. At the end we know that hardly anything in the whole stack works as expected.
TL;DR: Because most programmers are still so bad that FizzBuzz is still a good indicator.
Everything else is already contagious and rots my brain too. If anything rots our brains, then overused clickbait headlines.