Posts by [e-mail]

Swiss e-voting pilot can't count 2,048 ballots after USB keys fail to decrypt them

Re: Digital technology is too efficient for elections

There are ample opportunities to manipulate "analog" elections:

Pre-stuffiing ballot boxes

Letting ballot boxes with too much "wrong" votes disappear

Gerrymandering

Voter exclusion

Marketing 'genius' destroyed a printer by trying to fix a paper jam

My wife worked at the engineering department of a big oil company where they had one of these solid wax printers.

One day, a user complained about smearing and wrong colours.

To ensure that the wax blocks were inserted in the proper shaft, they all had a different shape: round, square, triangular, etc.

It turned out, that one of the highly qualified mechanical engineers had jammed the blocks in the wrong shafts, a task that can usually be done properly by a 3 year old.

She swore that she would never set a foot on the company's oil platforms ever!

London boroughs limping back online months after cyberattack

Re: No excuse for them not having a back up.

Paper is not very resilient. In WW2, the resistance burnt several municipal registration offices to make it harder for the Nazis to know where Jewish people lived.

You'll never guess what the most common passwords are. Oh, wait, yes you will

Re: Where are they getting the passwords from?

Another reason to limit password length is to prevent buffer overflow attacks. Some system let you in with any string over xx charecters.

Techie found an error message so rude the CEO of IBM apologized for it

Linux suggested as part of an error message about a stuck MySQL server: ".... or kill children"

A friend demonstrated a piece of software inadvertedly compiled with DEBUG defined.

When showing a little used feature a message popped up: "Malloc first, you di*khead!"

The customer (who had an IT background) took it with a laugh.

UK police caught slacking off by jamming their keyboards while working from home

Re: Meanwhile

Also useful against corporate over-aggressive screen-locks.

Hardware inspector fired for spotting an error he wasn't trained to find

Not allowed to read your own report.

I worked for an agency that evaluated cryptograpic products.

As the computer guy, I was asked to look at the implementation details of a product, and lo and behold, I found the classical "reuse of the keystream" mistake.

I neatly reported this, but afterward I had no access to the report because I did not have the clearance to know about cryptographic weaknesses.

I started losing my digital privacy in 1974, aged 11

Re: Why would you ever delete patient data?

A utility bill is still the pinnacle of identity in Ireland.

Call center staffers explain to researchers how their AI assistants aren't very helpful

My organisation is using it on Google meet, and the results are remarkably good, give or take a few often humorous misunderstandings.

Re: Scream...

Some support interactions are already so scripted, that even with a speach processor made of flesh, the customer still gets the feeling to interact with a computer.

90-second Newark blackout exposes parlous state of US air traffic control

A Swiss air traffic controler was murdered by the father of a girl that died in a plane collision that he caused.

The air traffic controller wanted to apologize to the families of the victims, but the legal department forbade him to do so.

New SSL/TLS certs to each live no longer than 47 days by 2029

Re: hoping this is only external certs

The problem with internal certtificates is that you must install the root certificates on all machines yourself. The CA browserforum certificates are pre packaged in software and/or OS updates.

Re: Are compromised certs really a thing?

The bigger compromise problems were with code signing certificates. These have a longer lifetime and are more versatile than a TLS certificate.

2 in 5 techies quit over inflexible workplace policies

Ofiice time

I fled the office before the pandemic.

Trying to concentrate in an open plan office, with 4 people around you loudly speaking on the telephone is futile. I learned the full medical history of several co-workers and their family. To add to the distraction, the adjacent building was demolished in a noisy way.

But, I think in person contacts are very useful.

With new projects we tried to get the team together physically at least once, and everybody found this a real benefit.

Discussing poorly specified difficult problems with all the participants in one room with some white-boards worked much better than an online meeting.

In my experience, on average one day a week in the office was enough.

Google begs owners of crippled Chromecasts not to hit factory reset

Re: Don't do themselves any favours

I had Tomtom GPS that offered "life long" map updates. Unfortunately, Tomtom's definition of "life" is: as long as we decide to provide updates. Hurray, another piece of e-waste created.

Re: The two achilles of current encryption

A company can set up its own PKI without problems, but to have the root certificate included by default in the common browsers, the PKI must conform to the rules of the "CA Browser forum", which requires short lived certificates.

I set up own PKIs at my previous employer. Some of the products are IoT gateways, and paying 100 £ for a server certificate with a very limited life time is an absolute no-no.

Previously, I tried to use commercial CAs, but my RfP: "I want to buy a million sever certificates for less than 1£ each" led nowhere.Only one CA understood the question, and offered that we could run an issuing CA unter their root CA (with the appropriate security audits and licence fees).

Availability

Some professional IoT devices are delivered with certificates that never expire.

The customer would be very upset if he loses the connection to his process controllers or smart meters because he forgot to renew the certificates.

More adventurous users still can replace the certificates with something short lived.

Pornhub lockdown and fact-free Zuckbots – welcome to 2025

Re: It's an easy go to

Freedom of speech makes only sense if there is a level playing field: if one party is yelling trough a battery of megaphones, it is well possible that other speech cannot be heard anymore, although you are free to utter it.

Put your usernames and passwords in your will, advises Japan's government

Re: deathbox

What happens when both of you die at the same time, in an accident for example?

Data is the new uranium – incredibly powerful and amazingly dangerous

Re: Data is worthless

Long time ago, I had a manager that required extremely detailed project breakdown reports.

I knew that this data was not used afterwards, so I wrote a spreadsheet generation these randomly, with the total amount of hours spent and the weight of the individual items.

Everybody loved it, but the manager was a bit miffed when I told the story at my goodbye party.

Huawei's farewell to Android isn't a marketing move, it's chess

Re: Time to slow down and think...

Because the apps become more bloated and resource hungry every year. I had to upgrade my 4 year old phone because beyond the Google suite there was only space left for about 20 apps. The Revolut app was already struggling and there was no space left for updates.

Cards Against Humanity campaigns to encourage voting, expose personal data abuse

Re: A Different Kind of Question

May democracies have a system where one chamber is based on the popular vote and a second chamber where each state/provice/canton has the same number of representatives.

Now Dell salespeople must be onsite five days a week

Re: How can large companies engender trust when they behave like playground bullies

Large companies are not here to engender trust. Paying huge boni for the manglement is the first priority, and create some short-term shareholder benefit with the leftover money. /sarcasm

Green recycling goals? Pending EU directive could hammer used mobile market

Is the charger the only problem for reuse?

Except for the charger, there are other problems with blocking reuse:

1. lack of updates (varies by brand)

2. apps getting more bloated every year.

Starlink's new satellites emit 30x more radio interference than before, drowning cosmic signals

Re: How come there's no regulation?

FCC Spectrum Enforcement Division:

<qoute>Investigates and resolves unlicensed operation/operating without a license or outside the scope of a license (generally non-broadcast spectrum issues).</quote>

Other regulators like BAKOM in Germany have the power to seize or shutdown misbehaving equipment (and issue substation fines).

CISA boss: Makers of insecure software must stop enabling today's cyber villains

Re: Easy to say

There have been security standards for software since the 1990s, and these are regularly updated and expanded. For example Common Criteria and all its derivatives.

Also, security was added to other standards such as ISA-IEC62443 for industrial control.

And there is a whole raft of industry specific standards, such as PCI (payment), HIPAA (healthcare)

Torvalds weighs in on 'nasty' Rust vs C for Linux debate

Re: vi vs emacs?

That sounds a bit exaggerated. The 5% of the vi functionality needed to make small configurations changes should be no major hurdle.

And, often some vi variant is the only thing available in Busybox.

But I prefer nano or joe if I have a choice.

Unusual syntax

What puts me off with Rust is that parts of the syntax is in reverse order than most other languages.

Example: why put the parameter type after the name, and the function return type after the function name?

Not something that makes porting from any other language easy.

Bargain-hunting boss saw his bonus go up in a puff of self-inflicted smoke

The company I worked for used data aquisition system where half of the components used 110 volts and the other half 230 volts. Inside the rack, there were usually a few leads with C13 connectors floating around.

One day, I installed a new disk drive, and after powering up, I thought the fan was quite noisy. 10 seconds later, the capacitors on the primary side of the powere supply exploded with a loud bang.

Fortunately, the capacitor casing had burst on the foreseen weak point (no ribbons of wet aluminium foil flying around).

After everything had cooled down I sealed the capacitors with hot melt glue and the PSU worked fine (with the correct input voltage) till I received a replacement.

Firefox's Mozilla follows Google in losing trust in Entrust's TLS certificates

Re: a spelling mistake a forgot reference..... validity of CABF ?

The reasoning might be: if your prodedures do not work well enough for format errors, why would we assume that they would work for security errors?

The list of complaints is the handling of a dozen or so format errors over several years.

Google cuts ties with Entrust in Chrome over trust issues

When I look at the issue list, I do not see any insecure situation, but mainly format errors and missed deadlines.

Most of the issues are more than 4 years old and put on a "compliance whiteboard" recently.

Entrust has some QA problems, but how much better are the other CAs?

Truck-to-truck worm could infect – and disrupt – entire US commercial fleet

Security certification

The EU requires a quite rigorous security certification (Common Criterial EAL4+) of tachographs since 2019. The main concern is data integrity, to prevent fraud with the driver's work- and rest times.

Raspberry Pi Pico cracks BitLocker in under a minute

Re: A brilliant testament to analysis

There are methods of securing the communication to a secure device. One of them is the PACE key agreement protocol. One of the uses is in electronic passports, where an attacker can listen to the wireless communication. A more exotic application is between the security module and the processor in German smart meter gateways.

Chinese Coathanger malware hung out to dry by Dutch defense department

Re: Timezone?

Most state employed attackers work during normal office hours.

Double trouble for Fortinet as it issues critical FortiSIEM vulns

The Dutch experienced an attack on the MoDs Fortigate appliances using CVE-2022-42475. The malware is named "coathanger" after one of the strings in the program.

Guess the company: Takes your DNA, blames you when criminals steal it, can’t spot a cyberattack for 5 months

The headline "Takes your DNA" is a bit inaccurate. The DNA was given voluntatily to 23andme, the the donors even paid for it.

UK water giant admits attackers broke into system as gang holds it to ransom

I would not consider this as an attack on a utility.

An IT system that was used by the water works was attacked, but this is not different from an attack on the IT system of a supermarket or a garage.

Very few of such attacks impacted the distribution of services (exceptions: Stuxnet, Dark Energy and a few more).

The attack on the "Capital" pipeline: the petrol kept flowing (technically), but if you cannot bill for it, there is a serious busines problem.

Re: Wait a minute...

Often, passport data of visitors is also demanded. But, this should not be retained forever.

DPD chatbot blasts courier company, swears, and dabbles in awful poetry

Re: The solution

And all interactions with customer service must beging with the text: "we are only allowed to follow the scripts, so there is nothing what we can do what you cannot do online."

National Grid latest UK org to zap Chinese kit from critical infrastructure

Re: Oh dear

The smart meters in the UK are manufactured in Europe (Greece in case of the L+G electricity meters and Manchester for the L+G gas meters)

All smart meters in the UK are certified by NCSC for security

These aspects must be part of the selection criteria: if your product has hard coded password, or does not accept our firewall policies when calling home, we do not buy it.

Cloud engineer wreaks havoc on bank network after getting fired

The company laptop was not well secured either. I worked for a big financial organisation. The firewall rules would not permit access to porn (and lots of other things), the whole PC was full of corporate spyware, and USB ports were disabled. Often difficult to get work done, but the organisation never has been in the news for IT mishaps.

Resilience is overrated when it's not advertised

More fail over lore.

A military lab was surrounded by a moat. For resilience, it was powered by 2 electricity cables, crossing the moat at different locations, with automatic failover.

One day the moat had to be dredged out. The dredger cut one of the cables, the failover worked perfectly and nobody noticed. The dredger processed its work, till it also cut the second cable....

Typo watch: 'Millions of emails' for US military sent to .ml addresses in error

Re: Beware, Johannes Zuurbier!

The Netherlands does not extradite its citizens.

Google toys with internet air-gap for some staff PCs

It is a common setup in companies and organisations that handle highly classified information to have 2 separate networks.

UK smart meter rollout years late and less than two thirds complete

A smart meter can give a consumer immediate and detailed information about his consumption. This enables him to adjust this by switching things off "I did not know that was using so much" or moving consumption to cheaper hours. That is where the 5%reduction comes from. After a few months of optimizing the new consumption stays the same.

Roses are red, algorithms are blue, here's a poem I made a machine write for you

Remember Stanislaw Lem's "electronic bard". Who was so good that it threatens to put all poets out of a job. To quell an uprising among the poets, the machine was evicted to a galaxy far far away.

Founder of cybersecurity firm Acronis is afraid of his own vacuum cleaner

Or switch the tumbler on when you have excess PV electricity.

Smart homes are hackable homes if not equipped with updated, supported tech

Lifetime update

I had a TomTom GPS that promised lifetime update. Unfortunately, "life" is defined by TomTom as "the period that we decide to provide updates".