Buggy Linux USB Stack

[yogi]

Microsoft did try to get into the mobile phone market. They failed miserably. Twice. So, they decided if they can't compete with Google and Apple, and since the desktop/laptop market is headed toward extinction, the only thing left would be the cloud. No need to play with servers there, and guess where all those Linux machines are storing their data. LOL

As I pointed out several times in the past it's an apples vs oranges comparison when you are talking servers and the underlying OS. Windows never was intended for server duty while Linux couldn't succeed anywhere other than in an environment where it's required to have a college degree behind you in order to run their software. Looking out that single cell window works very well for the masses. Can't say that about the other guys. But, I give Linux developers credit for trying to dominate the market Micorsoft has abandoned. Leftovers is better than nothing.

[Kellemora]

The CLOUD is already DOMINATED by LINUX!
AWS is the largest and runs LINUX, is miles ahead of Azure!
Followed by Google, also running LINUX.
Followed by AZURE, running mainly LINUX with some WINDOWS servers.

AZURE is currently underselling AWS to get a better foothold in the Cloud market.

[yogi]

Microsoft has a market value of $1359 B which makes them #2 after some Saudi oil company. I'd say they are doing something right.

And for reference, the market value of Alphabet (Google's parent company) is $919B while Apple comes in at $1285 B. Amazon is valued at $1233 B but as you know AWS is only a small part of what they do. Of course none of this has anything to do with how the products are developed or perform. Market value is a perceived number based on what investors think an equity is worth. I'd say it's a feather in Microsoft's hat to be on top of that list.

[Kellemora]

The amount of equity does help with garnering a larger market share overall.
But it has nothing to do with individual products they offer or don't offer.
Or the usage value of those products.

One of the largest pharmaceutical companies for aquaria products dumped thousands of dollars into a product they claimed did what my product does. It didn't take long for aquarists to discover their product was nothing but snake oil and did none of the things it claimed to do. The only thing it did do was fool the test kits.

Their fake product put a bad taste in the mouth of all aquarists over products like mine, so my sales dropped considerably for a couple of years.

They dropped their product, and mine has now been trusted and sold worldwide for over 25 years.

THEY had the MONEY to FOOL the PUBLIC, and probably made a profit from their SCAM.
They of course are richer than I am, but I'm the only one with a product that works and does what I claim it will do!

Money is not the deciding factor for a good product or a bad product.

[yogi]

Money is not the deciding factor for a good product or a bad product.

A good observation. But market value of a company is a solid indicator of the value investors place on what the company does. Your aquatic product experience proves the old saying to be valid and true, "You can't fool all the people all the time." Microsoft, it can be safely said, enjoys the confidence of a majority of the people. The list I got the valuations from was not specifically for high tech companies. It's for all companies on a global basis.

[Kellemora]

Have a serious question here:
I received an e-mail yesterday that has caused me great concern.

The page had some kind of code on it.
But the thing is the Subject Line contained the password I use at my bank and a couple of other financial places.

I have several passwords I use, but the ones for financial places is more complex than all the rest.
I also just changed it about 3 months ago to one even more complex, and the one shown in the Subject Line.

I'm going to spend a good part of today going around changing my passwords again, but how do I know if they've already done something?

[yogi]

Woahhh. That would scare the hell out of me too. I'm sorry to learn you have been hacked.

The first and quickest check for activity on your account is so look at all of them to see if you can determine whether or not any unauthorized changes have been made. This would not only include account balances but other things like profile information. If those accounts involve beneficiary information, check that too. Look at ALL of them. If there is no obvious evidence of intrusion, then you have some breathing room. The next step would be to contact the financial institutions, preferably their security or IT group, and explain to them what happened. They should be able to check their server logs to see when and if your accounts were accessed and, most importantly, from what IP address. It's probably a bogus IP address if it's not yours, but it will give an indication that somebody somewhere logged in and at the very least looked at your account.

The next step might involve some expense. There are monitoring services that will scan the dark web for whatever you want them to check, such as your e-mail address, your login name, your phone number, you and your wife's SS# and anything else you don't want to appear in a database breach. The idea behind this service is that they will notify you if any sensitive information of yours shows up in a database that has been hacked and unbeknown to you. That would give you some warning that your information has been exposed and from where.

And that brings up the question of from where did your password get stolen. Was it from a break in at one of those financial institutions, or was your home system compromised? Could be either or both. The financial people may not publish anything about a breach right away, but if you talk to their security people they will know and help you. If, on the other hand, you have reason to believe your own equipment has been compromised then changing your passwords might not be enough. The typical intercept method is a Man In The Middle attack, meaning that somebody between your LAN and the financial institution is reading your data stream and then passing it on to it's destination. Using end-to-end encryption to change your login credentials should fix that problem. I'm thinking Tor browser or a Linux OS called Tails. You don't need to use those things all the time, but do at a minimum use something like them to change your credentials. The only other way I can imagine your computers being compromised is via a keylogger and a Trojan. This might not be easy to find and it may just as well be on one of your Linux boxes as on a misbehaved Windows box. Taking your machines off line one at a time and scrubbing them is the solution to that problem. And, of course, the most obvious of all is that somebody fell for a phishing attack. Not much you can do to prevent that other than be aware of what to look for and be careful.

And, you probably heard this advice before but apparently never heeded it; use different passwords for each account. No exceptions. This will limit the damage. Also, generally known but unheeded, particularly on all your financial accounts, enable 2-factor authentication. They will give you the option to have a security code e-mailed or sent to your phone. The phone is a much more secure method. And, last but not least of the obvious precautions, switch over to a VPN. This could be costly and there are a lot of stories going around about them not being as secure as advertised. But, there are some very good ones to choose from.

If there is something else I can think of I'll let you know. Don't hesitate to ask more if you think I can help further.

[Kellemora]

Well, I could breath a little easier last night.
I only found two instances of that password in use, but both of them had more info behind that part when I updated my passwords.
The bank told me they cannot see what my password is, and they e-mailed me a list of my connects or other connects and all of them were valid. They did have me change my password, by hitting the reset button and mailing me a weird password to use, from which I could change it.

If you recall, a few months ago I mentioned changing all of my passwords for everywhere.
I did this because I knew these forums could be read, and my little trick would be obvious.
I was using the same password everywhere, but with something else behind it, from their website name.
I went through and changed everything so I have a different password that includes, caps and lower case letters, numbers, and special characters. Plus it is totally different for every website, bank, or whatever now.

All of my passwords are stored on an old PalmONE PDA, and that file is printed out on paper just in case the PDA dies. After all, it is probably close to 15 or 20 years old now if not older, hi hi. Come to think of it, it might be older than 20 years too.

FWIW: I replied to that e-mail, but NOT by hitting the Reply Button.
I opened up my e-mail program and opened a new page and typed in the e-mail address shown on the original e-mail.
So far they have not responded back. I didn't much expect them too either, hi hi.
I never actually opened that e-mail just in case it had a hidden code in it.
But I could view it on the screen without opening it. Don't know if it matters or not, but it seems I read once eons ago that although it appears open, it was done as read only, and I think it is like sandboxed to give you a chance to delete it instead of opening it.
I never open attachments if I don't know who sent them or why, hi hi.

One other thing, I used that particular password over 20 years ago nearly everywhere. Places that no longer exist or if they do all my data with them was changed and my new password was used at the same time.
Looks like no harm done anywhere that I have found yet.

After going through my password lists, and also looking up old places I've not been to in years, the couple of places I did use it have turned off my account. I tried to log-in and they said I'm not found on their system. I did think that was strange since it is one place I had selling my books for a short time. But that was under my pen name and a different type of password I used with that name back then.

Looks like I'm OK as far as my computers go. Whoever it was was probably phishing and only had part of my password from days of yore. Even so, it scared the bejesus out of me when I saw it, hi hi.

[yogi]

I'm very happy to learn that you have not suffered any loss that you can detect. It appears as if you did the right thing to control any potential damage, but preventing the possibility of disaster is always the preferred method.

I have quite a list of passwords from places I do or have frequented in the past. There are literally hundreds on a spreadsheet that is password protected and encrypted. I list the common name of the site, the URL, login name, the current password, the previous password, and comments about when the password was last reset. Additionally, a few times a year I print out the entire list and store it in the fireproof safe down in the basement. Only about three or four of those sites are more or less important, and I'm just being paranoid about security. Sometimes I do things just because I can. LOL

Suspect e-mails can generally be read in Thunderbird more or less in a safe mode. It allows you to prevent any downloads of images or other content from the foreign e-mail server prior to your actual reading of the full content. While that sounds spiffy, I don't trust anybody's software to be bulletproof. When I want to securely examine a suspect e-mail I do it in a virtual machine. Any code released therein will stay there and not infect my primary system. Also, the first thing I do is read the source code for the particular e-mail which also has the header information. Headers have become unbelievably complex, but you can still pick out the sender's information and IP address. There are also websites that will decode it all for you if you want to do that in a VM as well. Once I identify the sender I try to find out what Google has to say about them. Frequently it's a dead end, but sometimes you can find out quite a bit if the sender isn't too smart about hiding their identity. I never reply to suspect e-mail. That's exactly what they want in most cases; simply to verify your e-mail addy is alive and well. Then you get added to their lists of verified e-mail addresses which they sell on the Dark Web.

As far as passwords go, there are sites and software that will manage them for you. Some will generate strong random passwords, store them, and fill in the login forms for you. You never have to know what the passwords are in that case. However, you do have to trust the program to be doing the right thing. Like yourself I rely on a formula to make my passwords easier to remember. While that's convenient, it's not the best approach. If you can remember it, then it's very likely easy to crack. Passwords should be replaced by passphrases if you want something easy to regenerate in your mind, and those phrases must be in excess of 24 characters and contain all those characters we are constantly told to include. The only reason to include them is because a lot of websites look for them and will reject your password if you don't follow their formula. That's stupid. It's the length that is more important than the type of characters you use. Then, there are sites that limit the length as well. If possible make all your passwords 32 characters, which seems to be the limit in most places. And, of course, the password itself is vulnerable on somebody else's server. That's where the beauty of 32 characters comes into play. Even if the hashed password is stolen, it would take forever to decipher a 32 bit password even at today's break neck speed of parallel processors.

While I'm guilty of not using two factor authentication in all the right places, it is a critical part of the security. Use it whenever possible. And, as I mentioned before, have the security code verified via SMS or voice over a phone number and not via e-mail. As for phishing ... don't take the bait. I can't advise much more than that. Learn what to look for and avoid it.

[Kellemora]

All Excellent Advice Yogi!

On Thunderbird you can send an e-mail to Junk and mark it Junk, or you can send it straight to Trash.
Marking it Junk and sending it to the Junk Folder does not necessarily remove the attachments.
But moving it to Trash does, and when you empty the Trash, the attachments are gone too.
I learned this when I found the Attachments folder and saw a few I knew contained viruses still in the folder.
To be safe I deleted them, but often wondered how many I may have missed by using the send to Junk button.

My late sister had a different password for every website or location she needed one.
But the entire family knew how she came up with it and could guess all of them without a problem.
And they were LONG, really long. But at the same time very simple.
If she had a password for your website, it would have been:
NoItAm9876#$%&nOiTaM#$%&9876Ninder
If a website limited the number of characters, it didn't change how she did it, it auto-truncated.
Places where she had financial transactions she added something in the front of the password, but I won't say what it was here, but we all knew what it was.
This long password started right after she got married, mainly because her husband was a total paranoid about the Internet. He would not let her save any log-in data on the computer itself, like many of us use.
I imagine it is pretty easy for a hacker to get to your log-in page, which you can easily set to show passwords.

Personally, I do use the log-in memory function except for anything to do with financial information.
My wife only uses it for a couple of sites she's at every day, but all the rest she has to manually type in her passwords.

[yogi]

One typical scenario is for the hacker to steal the password file. It almost doesn't matter to whom the password belongs. They are interested in the hashed password phrase only. There are a few methods to employ in an attempt to decode the hash, and frankly not all the passwords in a major break in can be decoded. However, the idea is to come up with a table of hashed passwords and their corresponding human readable counterpart. This list is then sold or just given away on the Dark Web. Once you have a few of those lists, it's easy peasy to take any given password you find and see if it's in the list. If it is, your job is done. If not, you might want to try your own tricks to decode it.

Brute force decoding was popular at one time but now and days passwords have become complex in themselves. That is why a long password is a good idea. It would take a very long time to guess a 32 bit phrase. I've also read where there are methods to decode only part of the hash. This partial decryption can be used to shorten the time to hack away at particularly difficult passwords. Some of this might take weeks to accomplish, but it could be worth it if you are trying to hack into the Pentagon for example. LOL Hacking guys like you and I are hardly worth the effort.

I see a pattern in that password, by the way, but did not spend a lot of time trying to determine how it all was generated. It certainly would not be on any Rainbow Table but once the generation algorithm is determined, your sister will not be safe. LOL The only thing you really need to be concerned about at this point is how that password was leaked. You need to plug that hole so that it can't happen again.

[Kellemora]

The password mentioned in the subject line of the e-mail was one I used nearly everywhere over 20 years ago.
When I checked my list of current passwords, I only found two instances where it was used, and it was slightly different, and longer. So they never had a whole password.
Even so when I first saw it, I figured there must be a website out there that still used it, somewhere.
If so, I've not figured out which it was, but did change all places with passwords that had even a part of those letters in it.

I thought you would see how simple, while being long, my late sisters password was.
The first six letters of the website name before the dot com in reverse.
She alternates caps and lower case starting with caps the first time, then starting with lower case the second time.
The 9876 is obviously sequential in reverse.
She avoids using @ or ^ so the #$%& is repeated twice.
Ninder was her family nickname, nobody else ever used it.
Her name was Linda, but we all called her NinderPooh, hi hi.
After she passed away, her husband went and either closed websites or changed the password to something he uses.

I always thought her way of doing her passwords was pretty neat, but longer than I liked to use at the time.

[yogi]

It would seem counter productive to create passwords that are easy to remember. You would think that if it's easy for you to remember, it would be a piece of cake for some hacker to figure out. I already explained some of the ways passwords are decrypted, and there isn't a password in existence that cannot be decoded given enough time. That time it takes to be successful is the key to coming up with a great password. One of the more popular password generation techniques is DiceWare, which can be easily read and understood at https://theworld.com/~reinhold/diceware.html The heart of the system is a list of simple and short words; 7776 of them in fact. Rolling a die several times will produce a random number sequence that can be used to pick words out of the diceware table. Just string these simple words together, with spaces, and you end up with a secure passphrase. No capitals, no numbers, and no special characters are required other than the space. That table of words is known to every serious hacker, of course, but the combination of words you would use in your passphrase cannot be guessed. As I've been saying all along, the length of the phrase is where the security of it rests. No need to get fancy.

The problem these days is that webmasters seem to be unaware of what constitutes a secure password/passphrase. They will insist that you include all the special and unneeded characters to make the password look impossible to decode. Believe me, it only looks that way to the untrained eye. If you decide to use the DiceWare system you might have to modify it to add what some crazed website designer thinks is secure. But, for the most part you can generate a long and secure passphrase that is easy to remember when you use the DiceWare method.

[Kellemora]

Drat, Just lost everything I wrote again.
Basically what I said was websites are silly asking for caps, lower, numbers, and symbols.
They are all Unicode Codepoint numbers between 0000 and 007F.
Can't use 0080 to 00FF on most password entry boxes. I know, I've tried.

When I tried to enter a special character here as an example, it sent me to somewhere and lost my post.
I'll try it again after I post this to see what combinations did it.

[Kellemora]

Test of character to see if it works on here:



Nope, just an empty box.

[yogi]

I'm guessing there are some key bindings that are causing you to lose your posts. I don't know of any such things for our text editor, but I don't know a lot of things about how this software is supposed to work. I think you, or I, or both of us, have the option to change the character coding, but I left it at the default (whatever that was) when I saw it. Now that I think about it, the problem you see might actually be your browser and not our website. Apparently you are executing some kind of navigation command and the software for Brainformation has no control over that unless you are going to another part of this site. In that case I'm sure I know nothing about how to do it. You could look over the settings in your browser to see if you can set the key bindings in some way. Perhaps you will see something useful, or not. I'm sorry that I can't be more helpful.

[Kellemora]

The odd thing is though, I can perform the exact same keystrokes again, and it doesn't do it.
Most of the time, if manage to move myself off the page I'm typing in, I can move back and haven't lost anything.
Other times it may even log me out.

I did track one problem down a long time ago and learned not to run the paper shredder with my keyboard drawer open. Static from it causes problems, hi hi. OK as long as the keyboard drawer is closed.
Had that same problem a few years back when I had an electric pencil sharpener on my desk.
I tossed it in the trash and went back to using my old gold plated pencil sharpener.

I do often wonder though why a lot of websites recognize most Unicode Codepoint numbers and others only recognize a few characters.
Almost all of them recognize Basic Latin (the keyboard symbols), and a majority of them recognize the Latin One Supplement, then it goes downhill fast. Not so many recognize Latin Extended A or B.
But then they fool you and many do recognize Latin Extended Additional, Arrows, Wingdings, and a few others.

I wouldn't expect them to be able to recognize the entire Unicode Codepoint set of numbers, as it is a rather long and lengthy list from several languages. But a lot of them are common use characters that many sites don't recognize at all.

[yogi]

The tip off is that they give you a choice in some cases, and that tells me there is no standard. There are some customary settings and generally agreed upon procedures, but standards? Nahh. This all started out as a competition and the major players didn't feel a need to be cooperating with each other. It wasn't until the Internet became a common carrier so to speak that people were looking for standardization. Fortunately, the network does have a model everybody sticks to even if the data apparently is random. That means we can all talk to each other even if we can't read what the other guy is saying. LOL

[Kellemora]

Unfortunately Standards come and go, and sometimes quite fast too!
This is true in almost any industry as well.
Some standards remain the same for a long time, like pipe sizes, but they change a little too.
Plus the wall thicknesses on pipes are different for different purposes.
As far as things that do change that we think is fairly standard. Try to find the right flush valve size for your toilet.
At one time they were standard, now most are proprietary sizes.
This is especially true regarding faucets. Not even the old washer type valves were the same.
But now, nearly every faucet uses all proprietary parts.

The computer industry is always growing, faster, more memory, more features, etc.
So older software no longer works on newer hardware, not even with emulators, because things are just different now.

Speaking language, namely English, and not necessarily complete slang.
I picked up a small book at the library one day.
It showed our main language changes from the 1800s to 2000s.
How we wrote sentences or used the language.
Many folks would not understand, even though the words are plain English, if we used them constructed that way today.

For example: A store may post an ad. Rogers Emporium was Removed to 918 Elm Avenue.
Today it would probably read Rogers Emporium has Relocated to 918 Elm Avenue.
Or more simply Rogers Emporium has Moved to 918 Elm Avenue.

One I loved was: As I Retire for the day, I'll first visit the Tonsorial Parlor, the arrive back here.
Today they might say, I'm stopping by the Barber on the way home after work.

I didn't get them exactly right, but it is phun to read the old way things used to be worded.

Even phunnier as you get up into the more current generations which sometimes change for decade to decade.

I fall into that later class, I still call the refrigerator an Ice Box to this day, hi hi.
My kids just called it a Fridge. What's in the Fridge dad?

[yogi]

I have clear memories of the ice box in our kitchen that got replaced by a Refrigerator. That was the brand name of the ice box replacement and I have no doubt that is how we got to calling it what we do today. Ice box makes sense. You know what it's doing by it's name. But, what the heck is being re-fridgerated? When was it fridgerated in the first place? LOL

Standards are a tricky thing because requirements and technology change so quickly. I never did understand plumbing. It seems that every time I work on it nothing fits anymore. It's not a matter of being around for a long time. I could replace that American Standard flush valve tomorrow. Next month, should I want to replace it again, they no longer do it that way. It's insane. Computer technology is very fast moving so that changes in the standards can be expected often. But toilets?

Language is an interesting study. It's about as complicated as plumbing, I'd say. I've read about some of those old time expressions and they are amazing. I've also read, and am sure you have too, some foreign language native trying to say something in English for advertising purposes. Some of those bastardizations of words are hilarious. I don't get why these language variations are localized to the extent they are. The most popular one I can think of has to do with soda, pop, and Coke. It's all the same stuff but called something different depending on what part of this country you live it. Why is THAT necessary?