Spies in the Cloud

The big spy news in America must have put a spell on some people. At least that is how I would like to account for the comment on The Register story

Maybe these findings were written by an American, for Americans have little to fear. It’s the rest us the world that stands to lose.

The comment centers around the idea that a UK company that hosts in the cloud may have their data end up in the US and that will expose it to the risk of spying.

World+kitten knows damn well that the EU->US bank account data suck has sod all to do with terrorism, and rather more to do with keeping an eye on the competition. It is also public knowledge that various British agencies were involved in snooping on Airbus, with the info gleaned being passed right on to Boeing. The American government is using tactics from spying to bullying to downright theft to prop up its ailing businesses.

Boeing is American. The British spied on Airbus for an American company? I don’t follow the logic but then again this is just a short comment on a story called “The cloud’s impact on security?”. I also don’t follow why the title of the story has a question mark. It could have been “The cloud’s impact on security.”

Anyway, while there is likely to be an international component to the risk of cloud it really is not at all different for companies like Airbus or Boeing. They already have data moving between nations and handled by third-parties and are well aware of the dangers of competition and spies. Take for example that Airbus has a page called “A truly global network” where they boast about their global reach for production and support facilities.

I Love You Phillip Morris

A movie that tells the true story about an American con man has not yet been released in America. No, not Abignale. This is a different spin artist.

Like Abignale this man starts out losing his parents. Instead of running away, however, he is adopted. The search for his real parents leads him to master the use of law enforcement databases. Things go downhill quickly as his life becomes a game of breaking identity and trust systems.

At one point after being arrested he managed to assume the role of his own judge and orders his own bond reduced. Another time in jail he signed up for art classes and then slowly acquired green ink to dye his clothes to look like medical staff, at which point he simply walks away without detection.

The plot is definitely good security material

I Love You Phillip Morris is a 2009 comedy-drama film based on the real life events of con artist, impostor, and multiple prison escapee Steven Jay Russell played by Jim Carrey. While incarcerated, Russell falls in love with his cell mate, Phillip Morris (Ewan McGregor). After Morris is released from prison, Russell escapes from prison four times in order to be reunited with Morris. The film was adapted from I Love You Phillip Morris: A True Story of Life, Love, and Prison Breaks by Steve McVicker.

Wikipedia says a release in America may happen this October. It has a great cast and good reviews from Europe and Taiwain. Watch it if you can.

Signal Bars are Meaningless

The iPhone 4 signal issue is thoroughly dissected by fscked.co.uk

The tl;dr version of this is: the signal strength bars are almost meaningless and should not be relied on.

Incidentally, this also explains what’s going on when you have a strong signal, attempt to make a call, and can’t connect. The bars only indicate how well your phone can listen to the cell tower. They don’t tell you anything about how well the tower can receive your phone, but that’s a pretty important part of making a call. Similarly, the phone doesn’t know anything about what’s going on in the cell provider’s network past the tower; if you’re on a really busy cell it might not have any spare outgoing circuits to direct your call to, so even if the radio is working fine, you might still not be able to get through. If you’re on AT&T it’s probably all of the above at the same time of course.

In conclusion, version 4 of the iPhone continues to have serious data integrity and availability issues.

Taking my Objective Scientist Dude hat off now, I’d say that iPhone 4 is a fantastic device but a lousy phone.

Updated to add: I had no idea Apple would made this announcement today:

Upon investigation, we were stunned to find that the formula we use to calculate how many bars of signal strength to display is totally wrong.

[…]

Apple is promising a patch fix “within a few weeks”. Users may also choose to get a full refund within 30 days of purchase, the firm has said.

Qubes Alpha 2 Released

Taking virtual machines to the application level seems to be the goal of Qubes, which is yet another hypervisor based on Linux. Perhaps the name YAH was not appealing?

It uses the phrases “lightweight virtual machine”, “work virtual machine” and “Disposable VMs” as well as “AppVMs” in the documentation. It is an interesting concept, along the lines of sandboxes, applets, chroots, LPARs, LVMs, etc. and similar trusted computing architectures that have been around for ages. In the Qubes model each application is meant to run in a virtual machine space so attacks find harder to escape. You can run a financial VM and a gaming VM, for example, that would be isolated in the same way as running a financial computer and a gaming computer.

I have run a similar setup for years. Not sure what would make anyone want to switch to a Qube. AFAIK no one has every accused Joanna Rutkowska of understatement in her marketing.

With that being said, her Invisible Things Lab’s blog announced today Qubes Alpha 2 released!

The Alpha 2 is out!
New screenshots are here :)

Exclamation! Exclamation! Can you believe that this virtually hyped sandbox will be any different than the many open source ones already available such as Nizza and the Nova microhypervisor?