Category: Uncategorized

Spoke to a friend who manages a big technology group and is working on end of year evaluations. HR has set him up with a system where there are fixed percentages in each bucket e.g. %5 underperforming, 20% fair, %40 good, %20 excellent, %15 promotable or something like that. What’s remarkable is that people who come up with evaluation schemes like that are not immediately fired. Obviously, a well run group may have nobody in the 5% bucket and a bad (ordinary?) group may have everyone in that. And maybe a really good group could contribute a bunch of higher level managers and technical people? While a bad group should get no promotions at all?

This is a great example of corporate procedures that are designed to minimize work and risk for internal managers.

Most of the diplomatic messages released by Wikileaks have been traced to a US defence department network, known as Siprnet, used for the exchange of classified information, media reports say.

[..]

It is thought about 2.5 million US military and civilian personnel have access to the network.

However, Siprnet is not recommended for distribution of top-secret information.

Siprnet uses the same technology as the internet, but has dedicated and encrypted lines that are separate from all other communications systems, according to a defence department users’ guide.

The system is protected by a series of security measures, the guide adds:

• All users must be approved and registered
• Passwords are complex, and must be changed every 150 days
• Only accessible from specially enabled computers in secure location
• Computers must not be left unattended
• No linking to civilian internet without prior approval
• Media storage devices become classified at secret level once connected to Siprnet-enabled computers
• Audit trail of all users, including identity of all persons accessing Siprnet

However, the guide says that technological advances in storage devices have made it easier to remove classified information from secure areas […]

It is alleged that an online security system to detect suspicious use of Siprnet was switched off on computers used by the US military in Iraq following complaints that it was inconvenient, the UK’s Guardian newspaper reports.

. http://www.bbc.co.uk/news/world-us-canada-11863618

So you release data to 2,500,000 human beings scattered around the world and are surprised when your (expensive and annoying) security measures don’t work.

Oh.

Two Microsoft related sites discussing something similar from very different perspectives

Only about one-quarter of households living in developing countries have any form of financial savings with formal banking institutions. Even in countries that have experienced substantial development over the last decade or two, this statistic remains stuck stubbornly at a level that would not be acceptable for any other measure of socio-economic development: 10% in Kenya, 20% in Macedonia, 25% in Mexico, 32% in Bangladesh.

Access to financial services –whether in the form of savings, credit or insurance— is a fundamental tool for managing a family’s well-being and productive capacity: to smooth expenditure when inflows are erratic (occasional work, seasonality of crops), to be able to build up purchasing power when expenditures are lumpy (school fees, buying seeds), or to protect against emergencies (natural disasters, death in the family).

But in the same way as access to clean water is more than being able to buy a bottle of water, access to finance is more than being able to get the occasional loan. Much like the national grid, access to finance really involves being connected to a national payments system. Once I have a transactional account in a “payment grid”, I can receive and repay loans, save up and withdraw from a savings account, and use the proceeds to pay for what I need. This transactional account gives me a financial history, and is the basis from which I can manage my financial life.

— Ignacio Mas

But imagine for a moment if the world’s biggest retailer put the pricing squeeze on one of the world’s more profitable businesses: financial services. Who would pay the price? Perhaps:

• Mortgage lenders who surprise their borrowers with last-minute junk fees.
• Banks that nickel and dime their small account holders to death.
• Auto lenders who add discriminatory surcharges on loans to black and Hispanic buyers.
• Credit card companies that use every excuse to jack up rates.
• Check cashers and payday lenders that levy usurious charges on their customers.

Wal-Mart’s relentless push for ever-lower prices has revolutionized retailing and is sometimes even credited for helping to keep U.S. inflation low. It’s not hard to make the leap into imagining the retailer bringing similar price discipline to an industry grown fat on escalating rates and fees. (Fee income now comprises half of banks’ total income, according to investment banker R.K. Hammer.)

— Liz Weston at MSM money

and

They also offer M-PESA services. There is already a queue outside. A group of about twenty villagers are crowding the entrance. “It is always like this,” the shop-keeper complains while pointing to the crowd. “Since we have become M-PESA agents we have no time to rest. This thing has even over-run our other business”. He then holds up a packet of sugar. “We have not sold any sugar in months. They only want M-PESA”. Not just the Bukura agent has seen a great demand for M-PESA services. Since its introduction in March of 2007, the M-PESA application has had great success all over Kenya. There are currently over 2.3 million registered users. Over 18 Billion Ksh had been moved through the system, via person-to-person transfers.

— from Jim Rosenberg at CGAP

New Consultant: “Cort assured me there was a slide deck we could do a deep dive from. Then we can birdcage the low hanging fruit.”

Deep dive from the slide deck, indeed.

int cpu_features[4];

for (int i = 0; i < 100000; i++) {

cpu_features[get_cur_cpu_number()] = cpuid_get_features();

usleep(100);

}

for (int j = 0; j < 4; j++)

printf("CPU %d features: %xn", j, cpu_features[j]);

http://www.pagetable.com/?p=372

The other crazy thing about the mobile phone market is that it’s not the only one. Windell said he found another market just as big but with a greater focus on finished phones, and then just today I walked into what looked like the New York Stock Exchange of mobile phones. This last find was really fascinating; there is a spot in the heart of the market where you have chain smoking traders sitting in booths piled high with finished mobile phones in plastic sleeves ready for sale on the gray market. It’s so packed and frenzied that from across the building when I looked over in that area I thought maybe a small disaster had occurred and people were gathering around to watch it. Each trading booth had a price list sitting in front; it’s the only place in China where I’ve seen a written price for a phone (but presumably you haggled over prices anyways). People were scampering around the the exchange, carrying sleeves of five, ten, twenty mobile phones. I probably saw at least a few hundred phones move through the exchange in the few minutes that it took me to walk a corner of it; I imagine thousands, if not tens of thousands, of phones move through that exchange in one day. Near that area are dozens of booths selling batteries for these phones … and the best part about these battery booths is that there is a girl sitting in each with raw lithium ion batteries and a pile of Nokia stickers, and she is literally building the fake batteries right before your eyes. She even has the holographic Nokia authenticity stamp; the finished batteries look exactly like the real thing. I asked one of them to sell me a sheet of the holo-stamps, but she wanted 1 USD per stamp because “they were of a high grade” or “the real thing” (I couldn’t quite understand the chinese words she used). I was trying to argue her down on price and apparently if I didn’t want to pay her price I could find a lower grade of stamp in other booths for less but she would not carry such shoddy merchandise in her booth. Ironic.

http://www.bunniestudios.com/blog/?cat=7&paged=2

Ask me if I’m sympathetic to Nokia. No. Why? Because a guy at a big mobile phone company which will remain unnamed once said to me something like this: we know about your work, we like it, it’s useful, but your patent makes it awkward for us.  Well, I said, pay a license fee and it’s yours to use. We don’t do that.

The summary of this error.

According to a report, the problem occurs because the 32-bit call emulation layer does not check whether the call is truly in the Syscall table. Ben Hawkes, who discovered the problem, says the vulnerability can be exploited to execute arbitrary code with kernel rights. An exploit (direct download of source code) is already in circulation; in a test conducted by The H’s associates at heise Security on 64-bit Ubuntu 10.04, it opened a shell with root rights.source

and the technical description tells us that it involves a missing register clear operation that was fixed once and then reintroduced.

All well and good, but this bug was patched in 2.6.22.7. They fixed the bug by reloading (and thus zero-extending) the original value of eax from the stack. But… strangely enough, in the LOAD_ARGS32 macro that was responsible for this reloading, I couldn’t actually see a specific reloading of eax anymore:
[…]
I showed this to my friend Robert Swiecki who had written an exploit for the original bug in 2007, and he immediately said something along the lines of “well this is interesting”. We pulled up his old exploit from 2007, and with a few minor modifications to the privilege escalation code, we had a root shell. So what happened to the patch for CVE-2007-4573? Unfortunately in early 2008 there was a regression that removed eax reloading from LOAD_ARGS32:

here

and then we look at the change that caused the problem to re-appear and we see two things.

This unifies and cleans up the syscall tracing code on i386 and x86_64.

Using a single function for entry and exit tracing on 32-bit made the
do_syscall_trace() into some terrible spaghetti. The logic is clear and
simple using separate syscall_trace_enter() and syscall_trace_leave()
functions as on 64-bit.
here

First, there is no regression testing. Sad. Second working code is changed to “clean it up”.