„Wir müssen die Planungsprozesse deutlich beschleunigen.“
Im Berlin Playbook Podcast erläutert Bauministerin #Geywitz, wie durch einfachere #Standards, serielle Bauweise, #Digitalisierung und Planungsbeschleunigung die #Baukosten gesenkt werden können.
https://www.politico.eu/podcast/berlin-playbook-podcast/
blog! “How to prevent Payment Pointer fraud”
There's a new Web Standard in town! Meet WebMonetization - it aims to be a low effort way to help users passively pay website owners.
The pitch is simple. A website owner places a single new line in their HTML's <head> - something like this:
<link rel="monetization"…
Read more: https://shkspr.mobi/blog/2025/03/how-to-prevent-payment-pointer-fraud/
⸻
#CyberSecurity #dns #HTML #standards #WebMonitization
heise+ | Was Smart Meter leisten, was sie kosten und wie man sie bekommt
Verbraucher haben erstmals ein Anrecht auf einen Smart Meter – also einen vernetzten Stromzähler. Wir erklären, wie man an ihn herankommt und was er bringt.
Looking at the class action lawsuit by academic peer reviewers claiming publishers constitute an illegal cartel that is misappropriating funding to their research, I am wondering whether #standards professionals could mount a similar action against ISO et al for diverting payment for their work exclusively to standards publishing.
https://fingfx.thomsonreuters.com/gfx/legaldocs/lbpglkzeyvq/Uddin%20v%20ELSEVIER%2020240912.pdf
iX-Workshop IT-Grundschutz-Praktiker mit Zertifikat
Erhalten Sie einen umfassenden Einblick in die Praxis der IT-Grundschutz-Methodik des BSI. Mit anschließender Prüfung und Zertifizierung.
Eyo, that #Euro #Latin connect needs to get up and going.
The #EU should definetely be reaching out to #LatinAmerica, and Latin America should definetely be reaching out to the EU - as well as the #baltics, the #nordics, etc.
Trade must be done, but quality must be kept. Increasing the living and production #standards so that #Europe is happy (by synchronizing those friggin #regulations) means that we can open up the #trade valves.
Let the yankies eat pink slime.
No offence, @georgetakei .
The latest FOSS Academic post is "Standards War?":
https://fossacademic.tech/2025/03/05/standardsWar.html
In which I contrast the fact that @iftas is shutting down some of its services against the advent of "Free Our Feeds," and I speculate that maybe we're seeing an ATProto/ActivityPub standards war.
@flod @emanuele It's so sad, and revolting.
What are the alternatives? Of course there are decent #chromium alternatives, but as good as they can be, spreading usage of #chromium is IMHO killing the open web #standards ...
“Buy standards-compliant websites”:
Just loved running into @dontcallmeDOM’s 2002 and @karlcow’s 2006 articles of that name, https://www.w3.org/QA/2002/07/WebAgency-Requirements and https://www.w3.org/blog/2006/buy-standards-compliant-web-si/.
They represent a spirit that has been missing for years—staying close to the standards by not only using new features but ensuring one used them right.
(I collect these and more articles on @frontenddogma, as in the conformance archives: https://frontenddogma.com/topics/conformance/!)
@ramin
Are you at all concerned that you might need multiple #patent licenses to implement those #standards even though you gained easy access to them?
https://opensource.org/blog/standards-and-the-presumption-of-conformity
Liebe #Bibliotheksbubble,
Wie sieht es bei Forschungsdatenbanken mit Standardschnittstellen für den Im- und Export aus?
Hintergrund ist die Datenmigration von zwei Datenbanken in ein gemeinsames System. Wie stellt man die Datensätze dann am besten für die Zukunft auf? Ich kenne z.B. SRU im Bibbereich, bin aber Frischling bei Forschungsdaten.
Hinweise gerne.
#Forschungsdaten #Austauschformate #Schnittstellen #Standards
The ISO/IEC lawsuit against the @EUCommission to undo the finding that we have a right to know all of the law that binds us is a threat to digital human rights. #Standards should serve humanity, not enrich private corporations.
https://circleid.com/posts/a-threat-to-europeas-digital-human-rights-stewardship
/cc @carlmalamud
blog! “The least secure TOTP code possible”
If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP).
As I've moaned about before, TOTP has never been properly standardised. It's a mish-mash of half-finished…
Read more: https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/
⸻
#CyberSecurity #rant #security #standards #totp
The least secure TOTP code possible
https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/
If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP0).
As I've moaned about before, TOTP has never been properly standardised. It's a mish-mash of half-finished proposals with no active development, no test suite, and no-one looking after it. Which is exactly what you want from a security specification, right?!
So let's try to find some edge-cases and see where things break down.
One Punch Man
This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.
What makes it so crap? There are three things which protect you when using TOTP.
abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.If you were thick enough to use this1, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.
Can modern TOTP apps add this code? I crowdsourced the answers.
Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.
A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.
But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.
Do The Right Thing
What is the right thing to do in this case? The code is outside the (very loosely defined) specification. Postel's Law tells us that we should try our best to interpret malformed data - which is what Aegis and BitWarden do.
But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?
What is absolutely daft2 is ignoring the bits of the code you don't like and substituting your own data! Luckily, in a normal TOTP enrolment, the user has to enter a code to prove they've saved it correctly. Entering in a 6 digit code where only 1 is expected is likely to fail.
We're Only Human
A one-digit code is ridiculous. But what about the other extreme? Would a 128-digit code be acceptable? For a human, no; it would be impossible to type in correctly. For a machine with a shared secret, it possibly makes sesne.
On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.
But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.
What's Next?
There's an draft proposal to tighten up to TOTP spec which has expired.
It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.
So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.
How do we fix it?
Yes! Just like Top of The Pops! The famous British TV show! Wow! I bet you're the first person in history to make that joke! Have a biscuit. ↩︎
Please don't! ↩︎
I wanted to use the words "utterly fucking stupid" but I felt it was unprofessional. ↩︎
‘Misleading’: Gina Rinehart’s mining firm breached environmental code with ‘clean gas’ job ad, panel rules https://www.theguardian.com/media/2025/feb/21/gina-rinehart-hancock-prospecting-breached-environmental-code-with-clean-gas-job-ad-panel-rules-ntwnfb #greenwashing #advertising #standards #auspol #auslaw
Händler auf #Temu, #Shein, #AliExpress, #Amazon und andere Marktplatzbetreiber nutzen aus, dass das Behördensystem noch auf Container-Logistik eingestellt ist.
Das ist real gefährlich, weil Verbraucher sich auf nicht eingehaltene #Standards verlassen. Blei in der Zahnbürste? Gift im Kinderschuh?
RE: https://bsky.app/profile/did:plc:zv657bpskxtjkvbdd5wymjam/post/3libojwudqs2w
iX-Workshop IT-Grundschutz-Praktiker mit Zertifikat
Erhalten Sie einen umfassenden Einblick in die Praxis der IT-Grundschutz-Methodik des BSI. Mit anschließender Prüfung und Zertifizierung.
The patent-telecoms-complex has been granted its wish and the move by the EU to regulate #patents embedded in #standards (#SEPs) has been killed. SEP holders prefer expensive, obscure, anti-competitive litigation and were afraid the transparency would harm them so lobbied Council into submission.
https://www.juve-patent.com/legal-commentary/eu-commission-withdraws-sep-regulation/
This doesn't mean action is not required however. SEPs embedded in the standards we have to obey to comply with the law have got to go. https://opensource.org/blog/standards-and-the-presumption-of-conformity
Extra-quotable statement by ISO:
"In the interests of our respective members, IEC and ISO have taken measures to protect international standards from unauthorized disclosure."
Because of course it is important for #standards to remain secret to all but the Inner Circle.
(via https://official.resource.org/@carlmalamud/113982575910790081)
#Europe has been for too long mandating the use of closed #standards, and in 2018 there was an attempt to get them #open by demanding free access to them using #FOIA.
The @EUCommission said "no", those asking for them sued, then appealed, and in the now called " @carlmalamud judgement" the comission was told to grant access.
Who didn't like this? Standards bodies - entities that should be working for a goal and the common good, but instead see their work as a business. In December, #ISO and #IEC sued. Let's see how this evolves...
A better and less summarized description here:
https://www.globalnorm.de/en/news-product-compliance/details/new-development-on-the-malamud-case-and-free-provision-of-standards/
