Posts by Dr Who

Attacker gets into France's database listing all bank accounts, makes off with 1.2 million records

Fnarr fnarr ...

ISS stint ends early as NASA aborts Crew-11 over crew illness

Panspermia is unstoppable. Let's hope it's benign.

Faith in the internet is fading among young Brits

Re: 6 hours 20 minutes...

That's the line that stood out for me too. This is a pandemic of addiction the likes of which the world has never seen.

Half of exposed React servers remain unpatched amid active exploitation

Re: The web stack - let's see . . .

"the wild obsession with pulling in massive frameworks to do something which could be achieved in 5 lines of code"

Which in turn is a major contributor to global warming. A one page website delivered as static HTML uses a barely measurable amount of server resource. The same page delivered via WordPress needs a couple of processors and 4GB of memory to perform acceptably, but people do this all the time. And as for Laravel ....

UK moves to strengthen undersea cable defenses as Russian snooping ramps up

£24 million Atlantic Net initiative ...

I can feel Putin quaking in his boots.

Irish Excel whiz sheets all over the competition in Vegas showdown

Congratulations Diarmuid

But you have to think that if his Excel skills are represented by mount Everest, then the average Excel power user's skills would be a small molehill and the average office worker's skills a grain of sand.

In the right hands and for the right use case, a great tool. For the vast majority of use cases, a dangerous weapon in the hands of a small child.

Another open source project dies of neglect, leaving thousands scrambling

"... which could lead to complete cluster takeover."

Clusterfucked

Cloudflare coughs, half the internet catches a cold

Single point of failure

Routing traffic to your site via Cloudflare has always seemed odd to me. What's the fallback option? Is it easy to switch back to routing requests directly to your service when Cloudflare is glitching or unavailable? If it's as simple as changing an entry or two in your DNS zone then I suppose it's not too much of a problem. Busy sites though may not be able to support the load of doing that if they were using Cloudflare's content distribution.

Azure's bad night fuels fresh calls for cloud diversification in Europe

Re: "Successive outages on this scale show" . .

I take your point, but we take a hybrid approach.

- We develop our systems so that they are completely independent of the proprietary dev tools of the big 3 (Azure, AWS, and Google Cloud). They are therefore completely provider independent and portable.

- We have VMs spread across multiple service providers in multiple geographic locations.

- We mirror systems across multiple service providers and locations

We don't have to build our own redundant hardware infrastructure, but we get all the benefits of being in total control of our systems. No per transaction charges so costs are predictable and considerably less than on prem. Scaling up or down is easy. You don't have to be able to touch metal to have control.

The reason that people use the proprietary dev tools of the big 3 is that it's very quick and very cheap to build a lot of functionality. But you're then completely locked in and over the barrel with your trousers around your ankles. But hey ... nobody ever got fired for using Microsoft (or Google, or AWS).

The perfect AWS storm has blown over, but the climate is only getting worse

Re: it's not the internet....

Fair comment. Replace "internet" with "cloud" or whatever term you want to use to describe the internet and everything that is connected to, and depends on, it and the point still stands.

When a butterfly flaps its wings ...

The internet as a thing could be compared to the weather, or the climate. Chaos reigns and there are tipping points everywhere. And to those who insist on saying "that's the cloud for you - on prem only for me", you may as well say the same of the electricity grid, or the road network. Whether we like it or, it is woven into our lives in a myriad of ways.

AI is the flying car of the mind: An irresistible idea nobody knows how to land or manage

Re: ok, but what do you mean by “artificial intelligence”?

"one has to know just what TO ASK". Hence one of the higher paid IT jobs these days is prompt engineering. "Claude, write me a recursive python function to enumerate a directory tree" is not something your average non-coder would know how to prompt for. Snakes? Trees? What on earth are you on about? And who the hell is Claude?

Brit scientists over the Moon after growing tea in lunar soil

Re: And this

(Very) High Tea

Microsoft thinks cloud PCs might be overkill, starts streaming just apps under Windows 365

Re: Promoting Ignorance and Helplessness

"Bulkshit" - possibly a typo but rather effective and I've added it to my vocabulary. Suggested definition for when it gets into the dictionaries "Noun. An inordinately large volume of bullshit". (US spelling : TRUMP).

Jaguar Land Rover supply chain workers must get Covid-style support, says union

Re: Layoffs have begun

Very nicely said. For the government to indemnify businesses against cyber risk would create a significant moral hazard. If large financial institutions had not felt they were too big to be allowed to fail, they never would have take the risks that led to the financial crisis. Risk is part of business and it is not for the government to absorb that risk using taxpayer money. Even for small suppliers, although they may in reality have little choice, being reliant on one massive customer is a known risk which they enter into voluntarily.

Support for laid off employees is a different matter and there is much room for improvement there.

Flu jab email mishap exposes hundreds of students' personal data

"[We] will put measures in place to ensure this doesn't happen again"

Once again, and as the MOD has demonstrated in spectacular and devastating fashion, not using a spreadsheet as a database of sensitive data would be a start.

UK's Ministry of Defence pins hopes on AI to stop the next massive email blunder

To really really screw up, keep your hypersensitive contact details on an unencrypted Excel spreadsheet. Maybe get the absolute basics right before applying Bayesian snake oil to the wound.

NHS disability equipment provider on brink of collapse a year after cyberattack

Cyber Essentials Plus

Worth nothing that the British Library, which suffered a comprehensive cyberattack that took a huge amount of time and effort to recover from, were certified to Cyber Essentials Plus level.

To their credit they published a comprehensive post mortem of what happened, how they dealt with it, and the lessons they learned and want to pass on to others. It's a model of how organisations should respond in the event of a cyber incident. Anyone who takes this stuff seriously could do worse than than to read and inwardly digest the document.

https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf

Capgemini wins £107M HMRC extension – no competition needed

Re: Two tier

I hear you, and I've been there - the minnow swimming with sharks.

But hey, like the Guinness, we're not bitter eh?

'Major compromise' at NHS temping arm exposed gaping security holes

Who polices the police?

With the increasing popularity of supply chain attacks (and why not, when you can kill hundreds of birds with one stone), your endpoint detection and response system could well end up being the attack vector. Automated solutions, whilst useful, often lead to complacency and a false sense of security.

HMRC: Crooks broke into 100k accounts, stole £43M from British taxpayer in late 2024

Re: No financial loss?

That can't be right if this was indeed a credential stuffing attack (and cyberattack it was, whatever HMRC may claim) which depends on a user setting the same password on at least two different systems - so the accounts must have been activated by the users.

Wanted: IT manager for UK government agency – £60k

Not sure if I agree on all your points, but I can definitely say that definately is a misspelling.

Elon Musk's xAI pays $300M to born-in-Russia messaging app Telegram to push Grok

I hate his habit of tapping the best sci-fi for ship/product names (although he hasn't gone as far as using Meat Fucker yet as far as I know). It sullies the original. Heinlein and Banks will be turning in their graves.

Greater Manchester says its NHS analytics stack is years ahead of Palantir wares

Re: Wait...

It could have been done along the lines of the GP data analytics offering from https://www.opensafely.org/ which is "publicly funded, built by researchers and software developers at the University of Oxford, all IP is shared openly, and the Data Controller is NHS England."

But I do think it's best to stick with one of the big four consultancies plus a software as a service supplier well known to be a serial data abuser run by an extreme right wing nut job. Time and again it's been shown how this delivery model provides quality solutions on time, on budget and with unrivalled levels of end user satisfaction.

After leaving citizens on hold for 798 years, UK tax authority has £1B for CRM upgrade

Scrap HMRC

HMRC is rapidly approaching the point where it costs more to run than the nation raises in taxes. This house proposes that HMRC be eliminated in a massive DOGE win. Those in favour say aye!

Why SAP may be mulling 2030 end of maintenance for legacy ERP

Re: Somebody else's computer

(There is no cloud) [really]

.... as a matter of fact, it's all cloud

NHS major 'cyber incident' forces hospitals to use pen and paper

Total Barstewards

Those that do this, to hospitals, schools, and other organisations that are a soft target but provide critical services, are a bunch of handjob artists who deserve to have their tackle removed with a pair of pruning shears, fried in butter and served to them on toast. Defenders must block every hole, the attacker needs to find just one. At the same time, with systems as numerous and complex as those in healthcare and with no money available, it's not possible to establish meaningful contingency options (other than paper an pen).

Now think of all the state actors who've planted their digital "sleepers" in the systems of every one of our critical services, just waiting to press the big red botton ... like the Israelis did with the pagers (albeit they added a gruesome and unnecessary physical payload).

Northern Ireland schools ditch £485M Fujitsu deal after less than a year

Re: Sometimes technology is the problem, not the solution.

"spend all that cash on educational resources instead"

Agree entirely with your overall post. That said, IT is an educational resource too - and not just for kids at school. I haven't broken out my old O'Reilly Javascript reference book for quite a few years now ;-)

Musk, Bezos need just 90 minutes to match your lifetime carbon footprint, says Oxfam

Re: It's the other eight billion you need to worry about...

Grass fed beef is primarily good for animal welfare. It has a much higher environmental impact than lot reared cattle, albeit the welfare of the latter is considerably lower.

Grass fed beef (which I also buy incidentally) is a rich world hobby. As a means of supplying protein and calories to the world's population at a price they can afford it's a non-starter.

It also takes up a lot of land which could be put to more effective use for carbon capture, for example as woodland.

Finally, (almost) all grass fed animals are "finished" on high protein feed made from soya grown on cleared rainforest.

Re: It's the other eight billion you need to worry about...

Couldn't agree more.

I would add that although eliminating the ultra-rich (be they industrialists or celebrities) won't have any significant impact on global carbon emissions, it's the example they set that's the problem, because that's what determines the aspirations of the masses and defines what society considers to be success. Most people will never be ultra-rich, but many will get to the point where they have disposable income. As people get more of that they buy a bigger house, a bigger car, another car, more clothes they don't need, eat more meat (especially beef, that brown coal of the food industry), fly somewhere distant and exotic to go on holiday where they stay in a resort that likely has very dubious eco credentials.

In an ideal world, we'd redefine what success looks like. Unfortunately, we don't live in an ideal world.

Delta officially launches lawyers at $500M CrowdStrike problem

Thumb up for the reference. "Fargin' iceholes!"

Verizon outages across US as hurricane recovery continues

If Trump was President none of this would have happened. Poseidon is a personal friend of his and they have a very very very great relationship. Diverting the storm would have been NO PROBLEM.

NHS drops another billion on tech in the hope of finally going digital

9 months late?

We're 40 odd years on from the widespread use of mini computers and private networks in the NHS to deliver patient administration systems at a regional level, yet our new prime minister still has to say "We've got to have fully digital patient records." A national electronic patient record is more like 30 years late. The magic IT wand to fix the NHS is waved around with gay abandon by each new government, deliberately avoiding the real problem which is that the NHS is too big and too complex to fix. The way to tackle a hugely complex problem is to break it up into smaller chunks, which can each be solved separately.

Key aspects of Palantir's Federated Data Platform lack legal basis, lawyers tell NHS England

Re: Grease

Is the word

Re: Internal

The internal development is done :

https://www.opensafely.org/

It's all about the lobbying, as we call it when we're being polite.

Admins wonder if the cloud was such a good idea after all

Re: It's not really a cloud specific issue

Couldn't agree more. Subscribing to the proprietary features of one of the cloud platforms can let you build a lot of functionality very quickly, but the vendor then has you well and truly over a barrel. It also takes disaster recovery completely out of your control. We run our cloud infrastructure across multiple cloud vendors and have designed it in such a way that failing over from one cloud to another is straight forward (proved by both testing and recovery from actual failures).

Black horse down: Lloyds online banking services go dark

Re: A realisation of what they are

To be fair that's exactly what all sorts of brands do. Coca Cola doesn't make Coke. McDonalds doesn't make burgers.

Starliner's not-so-grand finale is a thump in the desert next week

Whatever you make of Elon, and I think he's a monumental fucking nut job, you can't help but be impressed by SpaceX.

B2B ISP Fastnet staggers back to feet after VMware incident

DNS

"I think it goes to show how important but overlooked DNS is in the underpinnings of the internet," the source told us.

This "source" should not be in charge of anybody's IT systems. Bit like when Dominic Raab (then Brexit secretary) said he "hadn't quite understood" how reliant UK trade in goods is on the Dover-Calais crossing.

Elon Musk claims live Trump interview on X derailed by DDoS

Re: Shelf life

x -> Threads switchers is something I've noticed too. But .... are they all real? There seem to be too many almost identical "Threads is so friendly and nice. I had 100000 followers on X now I've switched to here and look forward to meeting you all and getting lots of followers.". That message is taking unfair advantage of Threads users' laudable but naïve urge to prove that the platform works as a nice X alternative. Classic click bait technique.

Need to move 1.2 exabytes across the world every day? Just Effingo

Titter ye not

It's like car model names. Whatever name you choose, there's a country somewhere where people will titter.

SAP system gives UK tax collector a £750B headache as clock ticks on support

Scrap tax

As the cost of HMRC IT infrastructure approaches the total tax take, the cheapest option may be to scrap taxation.

Capgemini wins deal with UK tax collector worth up to £574M

New initialism

WCPGW?

Guesses in the comments.

Cold comfort to teachers who got paid late, but ERP software rollout had 'unrealistic' timeline

The bar is low

When a mitigating factor for huge time and cost overruns is that the project "... has culminated in the delivery of a functioning ERP system".

Boeing's Starliner set for extended stay at the ISS as engineers on Earth try to recreate thruster issues

I think it's a squeaky bum cheek issue

When even astronauts are saying "if it's Boeing I'm not going", the writing's on the wall.

Users rage as Microsoft announces retirement of Office 365 connectors within Teams

Re: "Office 365 connectors within Teams will be cut"

Everything is fine. Until it isn't.

This, Azure functions, Google workflows etc... make it very quick to deliver some functionality. Messy, flaky, undocumented, but quick. That's why in house devs keep using it. They can provide a quick and dirty solution to someone's problem. By the time it inevitably fails, the devs will probably have moved on long ago, leaving others to pick up the pieces.

Doing something really nice, with vendor agnostic technologies that don't lock you into one of the big vendor proprietary stacks, is harder. It has ever been thus and IT developments tend to follow the path of least resistance. There are of course durable, reliable, supportable, portable workflow solutions out there, but none of them were delivered by an in house IT team.

UK education department awards contract uplift to Horizon scandal-plagued Fujitsu

Nothing like nailing down the deliverables

This extra work will not fall foul of the usual gotchas because they've gone to the effort of properly scoping the work. Specifics such as "Agile Core Services" and "a value uplift" will leave Fujitsu no wriggle room when it comes to a dispute.

London hospitals left in critical condition after ransomware attack

Re: "our IT arrangements are as safe as they possibly can be"

Good analogy. Especially because vaults still get robbed.

Whatever you do and whatever you spend, there will be a sufficiently skilled, well resourced and determined adversary who could defeat you (if you have something that's worth nicking). There is always some limit to the countermeasures you can afford to put in place, so you must always make your plans on the basis of when, not if, you will be compromised. Excellent preparation for a breach is the sign of a well managed business.

Also, not all data has/have equal value. As such, different databases should be secured to different levels.

Miscreants claim they've snatched 560M people's info from Ticketmaster

To regain credibility, Ticketmaster should be transparent about the breach, its impact, and the steps to prevent future incidents ...

Whoa! Just saw some pigs fly past my window.

The British Library have set the gold standard in actually doing this with their recent and catastrophic breach. https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf

Ransomware negotiator weighs in on the extortion payment debate with El Reg

Re: It is better to avoid a problem than have to fix it.

Even with the biggest budgets and the best security brains, you must still operate on the "When not If" basis. Defend yourself yes, but you can never be certain. Therefore, it's the quality of planning for what to do when the breach happens that is the mark of an organisation that is on top of its cyber-security.