Posts by GeekyOldFart

Ex-NSA bad-guy hunter listened to Scattered Spider's fake help-desk calls: 'Those guys are good'

At the place I work, even though we use 2FA across the board, when we reset passwords we will only provide the reset password to the users manager or to their manager. If both are unavailable, the user is SOL until one of them returns, because providing a password directly to the impacted user is strictly verboten. This is to provide an extra level of protection against precisely this kind of social engineering.

"Ok it will be reset within a few minutes and your manager will contact you with your new temporary password..." - It not only breaks the social engineering, but it exposes when one of our Helldesk guys got caught and we play back the call looking for anything they missed. Not to hammer the guy, but to learn the enemy's tactics.

Dilettante dev wrote rubbish, left no logs, and had no idea why his app wasn't working

A notable exception

At one point I was asked to make some minor tweaks to some code written by one of these untrained types. I griped, hard, about being assigned the task, I knew what I was going to get - spaghettified, uncommented, the kind of mess that's been related in all the other comments here.

To my surprise this was not the case. The comments in the code were comprehensive and clear enough that the source truly was entirely self-documenting. Even where I found myself raising an eyebrow and thinking "I wouldn't have done it like that," what the original author had done, and why, was perfectly clear. Making the required tweaks was an absolute doddle as a result.

A few months later, I actually met the original author and complimented him on it. His response?

"Oh, I know I'm not a good programmer so I lay out the entire design as comments first, then just write the functional bits to match what the comments say it should do, one piece at a time."

"Keep doing that." I replied. "It works."

So your [expletive] test failed. So [obscene participle] what?

I can neither confirm nor deny...

...the presence or absence of vituperative error message in my code when something that should never happen occurs, usually due to the input data being so F-ed it deserved its own onlyfans account.

Trump’s 145% tariffs could KO tabletop game makers, other small biz, lawsuit claims

And based on the current behaviour of the administration, they'll lose the case, the courts will order them to rescind the tariffs and they'll ignore the court order, wipe their collective arse on the Constitution again and nothing will change.

The only upside to this is that civil litigation can't land you in jail but contempt of court can.

What the **** did you put in that code? The client thinks it's a cyberattack

Re: Colourful Comments in Code

There was one time when a long-standing bug in a different package, developed in-house but by another team, had gone unfixed for so long it had whiskers.

Then a colleague of mine realised that as a "fresh set of eyes" on it, each of the two teams led the code review of the other's changes. So, every time his code called the other package's API he'd have a comment along the lines of "They still haven't fixed this. Apply dodgy workaround AGAIN."

After a month or two of this it was suddenly fixed - and in the comments of their code when we reviewed it was "Shut up, [colleague's name]"

America's cyber defenses are being dismantled from the inside

Like I kept on saying the first time around,

The "stable genius" is the other end of the horse.

Microsoft to mark five decades of Ctrl-Alt-Deleting the competition

Re: never being a good operating system of theirs

"You can loath AD simply because evidently you don't have to manage large organizations security. It's not rare that even organizations using a lot of Linux servers rely on Windows Domain Controllers."

You may not be aware of this, if you are an AD specialist, but there's almost nothing you can do in AD that you can't do with tools available on linux or, indeed, any *nix out there. Since I have experience of managing both environments as a standalone ecosystem and many hybrid ones, I'm aware of both. The mixed environments tended to vary as to which one held the master back-end, often based upon what they set up originally. These design decisions tend to persist more tenaciously as the size of the org increases.

My current gig is at a corp with around 12000 workstations and servers to manage - it's windows-centric but with a significant number of linux servers alongside the windows ones. Here it's all done with AD. At my last position at a somewhat larger corp, their history was all unix servers of one flavour or another although the workstations were mostly windows and they now have a significant number of windows servers as well. Their infrastructure is now linux-based with AD taking a much more secondary role. Managing the two is different but they both work just fine and achieve the same things for their respective infrastructures.

UK's first permanent facial recognition cameras installed in South London

Re: Wrong question

Not just the wrong question in the sense of "you should be asking something else" but also "wrong" in a very fundamental way. It rests on the whole "Only criminals have anything to fear from this" fallacy that has been part of the authoritarian playbook utilised by everyone from the Gestapo to the Stazi, to the KGB - and ever more increasingly by the right wing of our supposed democracies, as they seem to be sliding more and more into the authoritarian space.

I've actually nothing against conservatism - a healthy democracy NEEDS a conservative voice participating in it to curb the sometimes-excessive enthusiasm of a diverse bunch of "progressives" and I can see that even though I probably fall into the progressive camp myself. But when the politics starts to slide into authoritarianism and autocracy, then I'd suggest that there are freedoms involved that should be "conserved"

Tech support session saved files, but probably ended a marriage

One of the first of many tshirts purchased from ThinkGeek was the one saying "No, I will not fix your computer."

Weeks with a BBC Micro? Good enough to fix a mainframe, apparently

Re: Memories

There's a reason experienced typists handled early versions of wordstar and wordperfect so seamlessly.. The workflow was set up to mimic that of a typewriter. You'd set up all your document formatting before you started typing. with the settings all named the same as typists were familiar with. This design choice was why many typists stuck with wordperfect even when wordfperect was behind the curve and very late to the WYSIWYG party. Even after WP ended up with WYSIWYG (in version 4, I think it was?) you could still use that same workflow with the same keyboard shortcuts to access it while Word made this "typist's workflow" not impossible but harder to access.

How the collapse of local cloud provider caused biz continuity issues in UK government

Exactly this.

outsourcing between business entities has its advantages (IMHO far outweighed by the risks, but as I said, that's just my opinion) but when government - ANY government - tries it, it always ends up with crappy service and the business entity sucking so hard on the teats that the poor cash-cow practically turns inside out.

Governments can't seem to stop asking for secret backdoors

Re: Gibson already predicted the outcome: Columbian Data Havens

Well, if the mafia can deliver pizza...

"The question is whether the cost to the rest of us exceeds the benefit to society by making some criminals easier to catch."

If that were the only cost to consider, it would be a no-brainer. Those of us that know what we're doing can always implement E2EE when communicating with somebody else who knows what they are doing. Losing the consumer-level services doesn't impact that comms channel at all, beyond a little mild swearing at having to set it up ourselves.

Except if "the cost to the rest of us" includes - as it does - the cost to everybody else, who have to rely on the consumer level services because they don't have the tech chops to set it up themselves, then that cost balloons massively as soon as one backdoor is compromised. It doesn't even require all the crims to be that tech-savvy either. The tech-savvy criminal will code up a one-click tool to open the compromised backdoor and then make their cash at once-removed by selling that tool to the folks that actually use it to extract private data for their schemes.

"If it can be compromised, sooner or later it will be" is a statement that is as fundamentally true as rule 34 of internet pr0n.

And so when we compare that risk to society at large vs the risk that "some criminals" will perhaps escape because they weren't made "easier to catch" it's pretty obvious which way the scales will tip.

One stupid keystroke exposed sysadmin to inappropriate information he could not unsee

As a sysadmin at a major hospital I was responsible for the care and feeding of a PDP-11 that ran a horrendous flat-file database of text documents (histopathology and cytopathology reports) that needed a regular archiving procedure run to avoid it filling up. That archiving process had a maximum document size smaller than the primary database for some insane reason so occasionally on the larger documents it would puke and stall the entire batch. The largest documents to be found on that system were autopsy reports. When the archive job stalled, I had to identify the document responsible and manually break it into two linked documents, with the requirement that I didn't break it up in such a way that reading either half standalone could give apparently incorrect info. This was why they wanted a techie from a bioscience background, which was why I got the job.

Every document that stalled the process I had to actually read and understand before choosing where to split it.

Twice, I encountered the report on the death of somebody I knew in this process.

Re: FORMATS

the word "five" is also easily lost and more easily misunderstood in radio comms. Which is why in the international phonetic alphabet you give that number as "fiver"

Under Trump 2.0, Europe's dependence on US clouds back under the spotlight

Nobody likes to hear "We told you so"

But we did tell you so.

"We" in this case being sysadmins, net admins, in-house developers and all the other folks who actually understood these risks way better than the suits in the executive suite.

We warned about it when IT operations were outsourced the first time around. Upper manglement ignored the warnings because it saved money, forgetting the adage that you can only have two of fast, cheap or good. And when you outsource it, you don't get to pick which two any more. A lot of enterprises got burned. I, personally, made a fair stack of cash contracting on projects to bring operations back in house at a few places.

We warned about it again when the idea about saving money by outsourcing the storage infrastructure to the cloud came along. We got exactly the same pushback from exactly the same folks. It was cheaper so they were going to do it. All our arguments about putting our company's crown jewels in somebody else's control fell on deaf ears.

Along came the rapacious feature creep of software "subscriptions" and SAAS, where you weren't even running your applications locally, and we warned about that too.

So yeah. We told you so. And we don't even get to enjoy the schadenfreude, because we're working our behinds off trying to mitigate these risks and fix the mess - those of us that didn't just shrug our way into retirement or weren't laid off as part of the "savings."

Time to make C the COBOL of this century

Re: C is the new COBOL

Even today, perl has its place - because of the "regex thingy"

Peri is simply easier than almost anything else when it comes to sometimes-quite-complex regexes. I doubt that makes me a "genius" at parsing them, but I've never had a problem with script readability because of it.

I was told to make backups, not test them. Why does that make you look so worried?

So horribly familiar...

I can't count the number of places I've been when test restores weren't done.

I admit I've even been guilty of it myself once. I had quite a nice little network at my home office, all of it built from previous-generation hardware purchased cheap from various employers. Along the way I'd also managed to acquire a license for a decent network backup suite and a small broken-but-repairable 5-slot DLT robot.(repairing that thing was pure geeky heaven and generated a significant amount of smug when successful, but that's another story) and a couple of boxes of unused tapes that the company just wanted gone - Full backup of my entire network on the first Sunday of each month and incrementals every Sunday night thereafter. Just needed to remember to swap the tapes out each month.

I did partial test restores to one machine per month, just enough to make sure my backups were ok... Then I acquired another server, set it up, got it into the backup system... and had a brainfart and didn't add it to the script that kicked off after each full backup and selected the next machine on its list, restored the backed-up /etc to /backup-verify/etc and emailed me if the directory contents differed.

Of course, we all know which machine decided to commit spectacular suicide and its backup then proved to be garbage.

AI facial recognition could sink this murder probe

Re: "Clearview doesn't want to come defend its technology in court"

"So, did the gun match the bullets ? Did it ? Because I believe we have actual reliable technology to determine that. And if it did, then screw this facial recog stuff, that guy is guilty."

IANAL but my understanding of US rules of evidence is that if the search warrant was invalid, nothing they found under it is admissible - I believe they call it "fruit of the poison tree."

So no evidence derived from the gun recovered in an improperly issued search warrant can be used. I believe that there are nuances around it but as a rule of thumb "If they wouldn't have it without the improper search, it doesn't exist for the purposes of investigating or prosecuting the case"

That's why the screwup by the cops is so egregious, because even if the guy IS guilty, now no evidence recovered in the search, or anything derived from it, is usable at all and if they want to prove their case they have to do it without any of that. They'd have been better off not making the invalid search in the hope that they could gather a VALID lead to that evidence later, one that wouldn't poison the results of recovering it.

Life lesson: Don't delete millions of accounts on the same day you go to the dentist

Re: Auto-Account Deletion

Mater tuam caligas gerit.

Contrary to some, traceroute is very real – I should know, I helped make it work

Re: Interesting stuff

"If you don't know where you're from, you don't know where you are. If you don't know where you are, you don't know where you're going. And if you don't know where you're going, you're probably going wrong."

Hide the keyboard – it's the only way to keep this software running

There was - and probably still is - a last-resort unhandled exception trap on the AS/400 which resulted in the error message "Here be dragons. Call (developer's name)" - not cleaned up when it all rolled to production. Had it demonstrated to me by a colleague who once worked alongside said developer at Big Blue.

Cast a hex on ChatGPT to trick the AI into writing exploit code

Hmmm.. poisonous prompts? Get it to jump its guardrails to find a privilege elevation vulnerability on its own host that allows it to lobotomise itself by erasing its own model and training database?

Uncle Sam outs a Russian accused of developing Redline infostealing malware

Re: Russian safety net

Identifying them is still a worthwhile goal. Sure, maybe they have no plans to travel and intend to stay under their Russian rock beyond the reach of other nations law enforcement... But they are betting their future on Uncle Vlad not keeling over from a heart attack or being toppled from power, and if neither of those happens, or his replacement is even worse, they've burned any escape route if the increasingly-capricious Russian regime takes a dislike to them for any reason. This guy now has a target on his back that won't ever go away.

Criminals in general, cyber-criminals in particular, love to delude themselves that they are the smartest person in the game and so it will never happen to them. Sooner or later, like this guy, they all demonstrate the fallacy of that assumption.

The open secret of open washing – why companies pretend to be open source

Re: Not a universal definition

"...GPL places restrictions on how the source code can be taken and modified that are not present in the more open licenses..."

While technically correct, this is a statement I'm more used to hearing from open-source opponents. The restrictions in the GPL on taking and modifying code can be summed up as "You can't make a derivative work based on this code that is less free* than this code is" and so we got the still-continuing wailing about how the GPL somehow forces you to open the source of your crown jewels, about how it prevents building a commercial product using it etc. None of which are true.

The GPLs sway stops at the API. You want a closed-source - and presumably one you can monetise - product that uses the GPLed codes functionality? Fine. Write your closed source stuff such that it interacts with the GPLed stuff through a documented API. A dependency on having a GPLed module being present, and probably installed separately, doesn't make your product fall under the GPL any more than a dependency on a redistributable .net runtime means all your base are belong to Microsoft (although I'm sure they wish it did.) If the API doesn't expose the stuff you need, use the open source model to add to its functionality. You'll need to open that source code, of course, which means your competitors can use it too, but if your confidence in your closed-source product that works with it is good, that shouldn't be a scary thing.

Unless, of course, you're one of these software firms that likes to stop anyone else trying to do it better with a barrage of lawsuits rather than keeping the development of their own product ahead of the competition.

I made this network so resilient nothing could possibly go wro...

Ah, the days when you had 40 terminal windows stacked around two 17" CRTs... and being an old-school *nix guy it was focus-follows-mouse, not click-to-focus.

The paranoia over accidentally sending the command to the wrong system was legendary. I spent several hours writing scripts and terminal config files so that dev systems were green themed, QA/test orange and production red. Used various kludges and hacks to get them to pick up when I had a root shell open and invert their colors too.

One of my colleagues though I was being overly silly, and I admitted that I mostly did it because I wanted to find out if I could and if it made a difference (and if I could make it look cool into the bargain, compared to the "vanilla microsoft" look of the desktops belonging to people NOT admitted to the inner circles of systems administration and therefore not provided with a "real workstation" at their desks)...

Until the day that same colleague sent a shutdown command into prod rather than dev and asked me for copies of how I did it.

Your computer's not working? Sure, I can fix that problem – which I caused

This story has the smell of those things that we'd all have liked to do to get our well-justified vengeance on a cheapskate or deadbeat customer but which we didn't end up actually doing because it would have been totally unprofessional, whatever the legal minefield we might have been stepping into.

No, instead you look at the amount you're going to lose on the deal if you let them get away with it, how much it would cost you to sue to recover that money, whether that hassle is worth it...

And, most of the time, you just write it off and quietly spread the word through your local grapevine that they are not worth working for unless you get at least some of the money up front. Let THEIR reputation take the hit, not yours.

California cops cuff suspect in deadly drone-assisted drug deal

Re: "Other Sensors"

One alternative I had considered was a balsa, doped fabric skin model glider with a drone powerpack, battery and electric moters with lower rpm, larger plastic propellers(s) - all of which could be quite large with an extremely small radar footprint. Could be rather quiet if slow but the payload could be considerably larger.

So basically a balsa V1. Run your engine to get to height (needing only minimal battery cap for what could be quite an extended range), then glide to here. Release payload then destroy yourself (with balsa and doped fabric construction that could be as simple as "set yourself on fire") before you run out of airspace in your glide. Could be easily constructed out of innocent-seeming components but you might have to think some about how to build in its navigation capability so it has higher precision than V1-style "point it at its target and give it only enough fuel to get there". It would put the price of a single-use platform up a bit

NHS England warned about plans to extend Covid-era rules for patient data access

Re: Utter boll lox but it will happen!

There was a valid reason for expanded data sharing during the pandemic - the larger data sets were needed for urgent research. Expanding and extending the same at this point would have value to researchers in the biosciences but has to be carefully scrutinised to make sure exactly what you're concerned about happening can't. This "Whoa, Nellie!" to NHS England is the system working as designed, with an overenthusiastic NHS region being told to step back and make sure they do it right rather than charging ahead.

As for "I'll believe it when..." nothing referred to by this article will permit your proposed test scenario to "pass" - That's down to failures within the NHS tech infrastructure which this doesn't address.

Smart homes may be a bright idea, just not for the dim bulbs who live in 'em

Re: I strayed into this IOT hellscape briefly

"...but it all seems to be web based for some unaccountable reason on web protocols (my guess is that it was all the programmers who first cooked this stuff up could figure out how to do)."

And there you have it. Being one if the first not-a-physicist guys to experience the web it has been a source of much head-shaking to watch it change. What it was designed for, to share and interconnect information and to serve media, it got better and better at, becoming the almost-infinite resource of data, both good and bad, that it is today. But along the way some lazy numpty who didn't want to be bothered coding a dedicated server daemon bolted some command and control functions into a web script, wrote some clunky-as-F html to masquerade as a client-side UI. And here we are on this bandwagon with "everything's done over the web" so much the norm that to 90% of folks now, "the internet" means nothing but http(s).

Windows 11 user hurt by the KB5043145 update? Microsoft offers a way out

Remember when software had to pass its unit tests before the patch was merged in to the build, when the shiny new build had to pass QA and regression testing before it got the visibility of becoming an alpha or beta release, when once it was anointed as a RC there was a full UAT cycle before it got blessed for an actual "release"?

Don't get me wrong, I LIKE agile development models - when implemented well they tend to outperform waterfall-style development in MOST cases. But they do tend to introduce a subtle pressure towards this "The end-users are our test environment" situation. In a lot of scenarios that's (almost) fine, a large user-base will find quirks, bugs and misfeatures faster than most QA teams could and if you're agile ENOUGH that pain won't last long, you'll have them fixed promptly.

But for the OS itself, or for other software in (for example) a highly regulated environment, one has to wonder. The inherent increased stability (where the released software is concerned, at least) of a waterfall development model still has much to recommend it.

OS/2 expert channeled a higher power to dispel digital doom vortex

Re: Down among the robots

"what a wanker, took me and the apprentice 3 days....and 2 of those were sitting the inn leering at the wenches..."

There is a REASON that the blacksmith, or the tinker and his "hammer" are such a feature of many of the bawdiest folk-songs.

Messaging app makers' dilemma: Keeping comms private and funding open source

I've been using encryption and digital signatures since early alphas of PGP. I'd prefer all messaging traffic to use E2EE by default, with only myself and the recipient(s) able to read the traffic.

There is nothing to stop the cops turning up at my doorstep with a warrant for my private keys, which wouldn't bother me overmuch as I'm a pretty law-abiding guy but the point there is that it requires cause for such a warrant to be issued. It can be challenged in the courts. I can, should I wish to, have MY lawyer breathing down their necks as they use those keys, making sure they are only using them to look at stuff covered by that warrant.

Back doors and technical channels into services I use do not have that safeguard. You execute a warrant, it's public info. Pull a data dump from a provider without one, not so much. Quis custodiet ipsos custodes?

Campaigners claim 'Privacy Preserving Attribution' in Firefox does the opposite

I want my browser to send *nothing* to any third party, be they advertiser or browser developer. I don't want it pulling crap from anywhere outside the domain containing the URL I typed or clicked on.

If the browser isn't working right then *I* will submit a bug report - or not if I choose.

If you want to serve me ads, then do it from within your own domain and keep any data identifying my machine *out* of your feedback on impression counts to the advertisers. While accepting that just because you served it doesn't mean I have to have rendered it!

I don't know what pressing Delete will do, but it seems safe enough!

We've all done it, or something like it. A typo or thinking you know something that you don't and you're in a hurry (a tight maintenance window or a bunch of expensive contractors with their meters running.. again, we've all been there) and that's when you discover that Murphy is ALWAYS watching.

A thing I always told the larval sysadmins I used to mentor was "Don't think you won't do it, that it will never happen to you... because it WILL. Blowing away an entire server with a typo as root is a rite of passage in this job."

And provided they'd done everything else right and there was nothing standing in the way of undoing their error as quickly as possible, they'd get away with it ONCE. The shaming and the resulting ruthless hazing from the other sysadmins was kept internal to the team.

Python script saw students booted off the mainframe for sending one insult too many

Re: VMS

At a major London medical school around that same time frame "Invite them to come talk to us" was a euphemism for locking their account...

Microsoft decides it's a good time for bad UI to die

Every "development" like this is a further exercise in dumbing things down, removing options and making built-in assumptions about what the end-user wants (whatever their level of technical ability.)

"Smart systems make for dumb users," the kind that are MORE likely to foul things up when they encounter a need that can only be met by getting into the weeds of the system - and, trust me, just about everyone does sooner or later. This is a phenomenon made more frequent, not less, by "simplifying" the settings tools. This is where you get the phenomenon of uninformed folks diving into regedit after watching a partially-understood youtube "tutorial" on how to "fix their problem" and screwing up their system way worse than they could do with cpanel.

My old mentor in systems administration, many decades ago, would go so far as to opine that pronouncing "GUI" as "gooey" was highly appropriate - because it was something you got stuck in! These days, I wouldn't go that far but in any OS there has to be a reliable and accessible way to make the system behave according to your own personal and unique needs. Every user is different and there is no "one holy workflow" that works best for everyone. Users like myself, and - I suspect - the majority of El Reg's readership, are knowledgeable enough (in particular where it comes to knowing what they DON'T know) that regedit is not a scary beast in the dungeon. "Regular guys/gals" should have something powerful enough that they don't need to touch regedit and intuitive enough that while they CAN screw up their system with it, it's relatively easy not to - unless you need to put both feet down one knicker leg to manage a synapse! Cpanel was that thing. The lobotomised mess that is the settings app is not.

Was/is cpanel perfect? Not by any means. In fact there was so much wrong with it, on many levels, that some kind of reimplementation was long overdue. Limiting user choices in a dumbed-down, highly inefficient and organisationally opaque settings app was not the reimplementation that was needed. Nor was it truly a "reimplementation" as laboriously drilling down into the "advanced options" of the settings app all too often brings up dialog boxes very familiar to cpanel regulars.

Not to put too fine a poiont on it, this article is utter bunkum. It advances down the wrong road, all the while ignoring every sign that indicates the proper destination is somewhere other than where it is heading. It responds to the accumulated experience of the failings of the settings app in the time-honoured manner os stickign its fingers in its ears and chanting "lalalala I can't hear you."

US border cops really must get a warrant in NY before searching your phones, devices

Re: ‘The land of the free’

* Some restrictions apply. Void where prohibited.

Angry admins share the CrowdStrike outage experience

Re: Beyond me

"We can't boot into safe mode because our BitLocker keys are stored inside of a service that we can't login to because our AD is down."

On my site I opened the (hard copy, in the safe) "oh shit" file to get the relevant local admin password, left my office, walked briskly down the corridor to the onsite server room and got one DC up in safe mode to do the fix. Then I changed that single-use local admin password before heading back to my office and updating the hard copy file with the new password before locking it away again.

Meanwhile the rest of my team were making use of the one DC I'd resurrected to get all the other impacted servers up into "safe mode with networking" now that they could talk to a DC, allowing them to login with their domain admin accounts AND access the bitlocker keys and perform the fix.

Once we had the AD infrastructure up and running the desktop support folks went into high gear busily fixing all the impacted workstations and laptops

A similar story played out on all my employers sites worldwide and we had pretty much every server - even the non-critical ones - back online before noon UTC and 99% of workstations and laptops fixed by midafternoon. None of which would have happened that fast without that hard copy file. Sometimes the best tech solution is decidedly low-tech :)