Posts by Dr Who

AWS rakes in half a billion pounds from UK Home Office

Yes minister that's correct. Their CTO is based in Monaco and their Head of legal in Geneva. You'll need to visit them regularly if we sign this deal, so it's a bloody handy coincidence that you love F1 and skiing.

Rackspace runs short of Cloud Files storage in LON region

Re: Guy I used to work with...

Upvote for clattering bell end

Google Drive misplaces months' worth of customer files

The cloud is not entirely the issue here (trust me as one Doctor to another).

The problem is confusing file sync with file backup whether you're syncing to a cloud drive or to a NAS device in the same room as you which you can see and touch and administrate.

Any user who doesn't know the difference between sync and backup (and there are many) will lose data, however much they value those data, irrespective of whether it's in the cloud or directly attached to their own network.

Palantir bags £330M NHS data bonanza despite privacy fears

Already done.

Home grown, open source, privacy driven, fraction of the cost but without the massive lobbying budget and capability.

https://www.opensafely.org/

Clorox CISO flushes self after multimillion-dollar cyberattack

When not if

In the face of a highly determined, skilled, patient and well resourced adversary it is impossible to defend a complex and distributed IT infrastructure. The notion of "locking down the network" no longer has any meaning. We can't defend against all the known threats, let alone the unknown.

We must therefore do what we can within the resources available to defend against the most common threats, whilst at the same time investing heavily in an effective and rapid alarm and recovery process for when the inevitable breach does happen.

The potential cost of cyber security is limitless in as much as you can never achieve perfection. Given that no organisation has unlimited resources to throw at the problem, choices must always be made between risk and cost.

Pharma boffins sharpen hunt for target molecules using graph DB

Refreshing

With every Tom Dick and Harry labelling everything upwards from and Excel spreadsheet with a formula in it "AI", here's a company that's called its database technology ... a database. Shocker. Their marketing team missed a trick with that one.

Cloudflare dashboard, API service feeling poorly due to datacenter power snafu

Who polices the policeman

Cloudflare provides reliability and continuity services to a *lot* of customers. There is nobody providing those same services to Cloudflare.

As well as these latest incidents, their distributed DNS name services (which are used as the default in a lot of data centre environments, in the same way as Google's name servers are set as defaults in may places) went tits up on the 2nd of October with intermittent fails for the same lookups. Again that was due to a reconfiguration / upgrade snafu.

SolarWinds charged after SEC says biz knew IT was leaky ahead of SUNBURST attack

Brace yourselves for impact ...

The only difference between SolarWinds and the others is that they got compromised and then got caught. We can be certain that there are many, many more supply chain vulnerabilities out there, which the developer has buried their head in the sand about, just waiting to be found and exploited by the bad guys. MOVEit alone was pretty bad.

Microsoft creates a new kind of credential: the 'Applied Skill'

Re: Not certified

I kind of like the idea, especially relating to Excel. You can make them specific, for example =VLOOKUP(), and targeted, for example at Welsh NHS recruitment staff.

CIA exposed to potential intelligence interception due to X's URL bug

Re: Ridiculous!

The Reg article is misleading. Why would you need an X profile impersonating the CIA? All that was needed was for the adversary to set up the Telegram profile that was linked to by the incorrectly shortened URL on the *real* CIA Twitter/X profile. That's why this was so dangerous until the white hat grabbed that Telegram handle and made it clear that it was not the CIA Telegram account.

If you set up a fake CIA X account you could put whatever Telegram handle you wanted in. The whole URL shortening issue would be neither here nor there.

What did the VisiCalc fairy bring you for Spreadsheet Day?

If you could have hung around to gawk at it, it was a Mac or more probably UNIX

Generative AI slashes cloud migration hassles, says McKinsey partner

Re: The use of generative AI

Maybe this is a test by El Reg? Can the readers spot the AI generated articles? If so, I'm calling this one - definitely AI.

However, she recommended not skimping on an API gateway between an organization and the outside world in order to surface some of the "real-time alerts" if developers are accessing non-proprietary models or data they shouldn't be touching.

In no instance of the multiverse does this mean anything to anyone.

CDW data to be leaked next week after negotiations with LockBit break down

Ironically if you search for CDW ransomware attack, along with headlines such as this Reg article, you get a bunch of results from CDW's own blog such as :

- How to Increase Your Ransomware Recovery Capability - Work with an expert partner to learn how your organization can better prepare to recover from a ransomware attack

- Fend Off Ransomware with a Cybersecurity Recovery Program

- The Anatomy of a Ransomware Attack: 7 Steps to Prepare ...

If nothing else, this incident will somewhat dent their credentials as a trusted cyber security partner I would think. In a similar fashion to the way the house robots dent the amateur entries in robot wars ...

NASA taking its time unboxing asteroid sample because it grabbed too much stuff

Too much material my ar*e. In a moment of almost infinite improbability, the cannister turned out to contain an alien time capsule revealing the secrets of an engine enabling instantaneous space travel over any distance. They're just trying to think of a name for it.

Decades-old Home Office asylum system misses EOL deadline, no new timetable in place

Case study

CID “started as a database containing basic details about asylum seekers and was initially expected to be an interim solution."

This is what they should teach Comp Sci and MBA students. How IT happens in the real world.

Cumbrian Police accidentally publish all officers' details online

Good job

EXCELlent work everyone.

Brit healthcare body rapped for WhatsApp chat sharing patient data

Re: Something not quite right here

It's not the app that's the problem. It's the mechanism (or lack of it) for controlling access rights. Who decides who will be a member of the WhatsApp or Signal group? Who decides what each of those members can see or do with the data? There are no mechanisms in place on messaging apps whereby an organisation can maintain control of and audit who accesses what information.

Artificial General Intelligence remains a distant dream despite LLM boom

Effectively saying that something must be true if you can't disprove it. A very theological argument. It doesn't work for all powerful beings or all powerful technology.

TCS bags £234M Teachers' Pensions deal as Capita set to end 29-year run

Alternatively ...

FUBAR-ready, SNAFU enabled, omnishambles platform

Google Cloud's watery Parisian outage enters third week, with no end in sight

A fire incident has occurred

No it hasn't. You're just trying to sound official or technical or something. What has occurred is a fire, not a "fire incident". Just like it's not a "flood event" it's a flood. And when did we move from having a storm to having a "severe weather event"? Anyway, gotta go, I had a curry last night and can feel a catastrophic evacuation event coming on.

Quantum computing: Hype or reality? OVH says businesses would be better off prepared

For most businesses, planning for quantum computing will I suspect be more of a cybersecurity issue. At some point in the not too distant future it will be economically viable to start brute force decrypting what is currently strongly encrypted data using quantum techniques. Crucially it will be possible to do so within a useful timeframe - for example where the target is still in business / alive in order to blackmail or prosecute them.

Crooks and spooks are right now hoovering up encrypted traffic in anticipation of being able to decrypt it quickly whilst it is still useful to them.

Nobody is giving a date for when quantum computing will be able to deliver this, but it is definitely a case of when, not if, and it could be in the next few years. When it happens it will be sudden, and I imagine catastrophic.

Capita IT breach gets worse as Black Basta claims it's now selling off stolen data

So ....

The crap 'it a fan

Curl, the URL fetcher that can, marks 25 years of transfers

Different things

wget and axel are file downloaders.

curl is a way of interacting with a URL in much more complex ways. How are you going to test an API call that requires a POST request, a json encoded payload and basic auth username with wget?

Super Bock says 'cyber' nasty 'disrupting computer services'

Amazing this AI stuff

"The situation causes major restrictions in its supply chain operation to the market of some of its products in the different marketing channels" reported ChatGPT in a translation that is barely distinguishable from one that would be made by any 1st year GCSE Portugese language student.

WAN router IP address change blamed for global Microsoft 365 outage

We all depend on the cloud, whether we like it or not.

The very term cloud software stems from the cloud symbol used from way back when in network diagrams, originally to depict a large private WAN.

These days, practically nobody runs a private network to every geographic location that needs access to central systems, and that applies whether those central systems are on prem, in colo or on some sort of SaaS or PaaS offering.

The cloud in the diagram now depicts the internet, itself a network of many networks, owned and run by many different organisations, any of whom can mess up the world's routing tables. And let's not even mention the DNS root servers.

Whether you like it or not, you depend utterly on the cloud, wherever your mission critical software is running.

Rackspace confirms ransomware attack behind days-long email meltdown

Re: So...

Most small and many medium sized businesses employ service providers for things like accountancy, legal and payroll/HR. They couldn't possibly do it in house, so the problem is identical. You need to find someone you can trust, and until fairly recently Rackspace had a good record. There's nothing to say that the accountancy practice you use won't go bust, or mess up - in fact they often do.

Re: So...

As many have said before, that's all very well if you have an in house IT team and your own geo-redundant hardware infrastructure. Reading various articles about this disaster, most of the hosted Exchange customers are small businesses with 20 or 30 users. They haven't got a cat's chance of running their own mail systems (especially Exchange based). They have no choice but to trust someone else.

We've used Rackspace, amongst others, for dedicated servers and VMs (not email) for a couple of decades and they really were fanatical and technically excellent with their support and services back in the day. Recently we've been steadily reducing what we have with them. The aforementioned job cuts and service centre offshoring have reduced Rackspace to a budget operation of the 1&1 (now Ionos) ilk.

For the average small business, it's very hard to know who to trust with their mission critical stuff. They don't even know what questions to ask of a supplier, let alone what the right answers would be.

Low code is no replacement for software development, say German-speaking SAP users

Low code in essence is just another level of abstraction from machine code - a very high level language if you like.

The art of programming though is a way of thinking, a mental approach more than a particular language. Ask a business person to define the process or problem they need solving or automating, and inevitably you'll get a vague, poorly specified, ill thought through answer. Your next step is to tease of them what they're actually after, and make them aware of the knock on effects of what they're asking for. It's the classic beginners exercise of writing down how to make a cup of tea. Most non-programmers miss several of the crucial steps.

No matter how high level the language, you still need to think like a programmer to make the machines do useful stuff. Putting amateurs and hobbyists in charge will inevitably lead to a mess of a system and most likely the loss or corruption of valuable data.

Automating Excel tasks to come to Windows and Mac

People will die

Indeed. Why use a database management system when you can frig a piece of software, which wasn't designed to manage data, to try and do the same job in a much more complicated and error prone way that can literally kill people. Think losing thousands of safety critical Covid data records whilst using Excel to share the data.

China discovers unknown mineral on the moon, names it Changesite-(Y)

Re: The Genie's out of the Lamp and Exploring the Delights of Pandora's Open Box

amanfrommars never has, and never will, pass the Turing Test. Which is odd for someone whom I believe to be an actual human. Always fun to read though.

Concerns that £360m data platform for NHS England is being set up to fail

Misunderstanding the NHS

The NHS is an umbrella for a myriad different organisations and a million odd staff. Some of these are private (think GP practices, dentists and pharmacists for example) and some public (largely emergency, acute care and chronic care). If the NHS stands for one thing it's that for its users healthcare is free at the point of delivery. In this context, delivering a monolithic national software stack is a complete nonsense.

Each organisation in the NHS should be free to choose from best of breed solutions for their particular area of operation. The national framework should aim instead to set standards for data interchange such as xml schemas for patient records plus possibly some kind of middleware service to ease the integration of systems via their APIs. A central data repository for healthcare analytics requires only anonymised data, the aggregation of which can be automated using the aforementioned schema definitions and APIs.

In this way a competitive software ecosystem is established ensuring best value for money for the tax payer, avoiding a supplier monopoly, denying the government another unjustified opportunity of harvesting personally identifiable data and finally denying politicians and civil servants the opportunity of a lucrative non-exec role in the private sector. These are also the reasons why the NHS always fails to get sensible technology solutions.

OVH blames hour-long global outage on human error during 'routine' network reconfiguration

All talk, no trousers

Ms Thunberg might have a thing or two to say about this and the FB outage :

Change control - blah, blah, blah

No single point of failure - blah, blah, blah

Systems engineering - blah, blah, blah

UK Ministry of Defence apologises – again – after another major email blunder in Afghanistan

Presumably the suspended person is the muppet who included the addresses in the cc field.

It should be people at the very to of the MoD who ultimately get suspended. The system is at fault, not an admin clerk. Being able to paste the addresses into the cc field means they were somehow available on a standard email distribution list or most likely an Excel fu**ing spreadsheet. They should be on a secure list server where nobody can see the addresses and where each recipient receives an individual copy of the email, preferrably with the address in bcc, and the sending of which is logged and stamped with the ID of the user who authorised the sending. Nobody, whether within the MoD or outside it should see these addresses on screen.

Or even better, use a secure portal to communicate.

FFS Mailchimp would be a thousand times more secure than what the MoD is doing, apparently routinely.

These twats have put actual lives of actual people, along with their families in grave danger of death or worse. No fine is big enough - a spell in prison should send the right message.

Ransomware-hit law firm secures High Court judgment against unknown criminals

Re: Sigh...

Propagander : have a good look

Re: Nail, meet hammer!

Exactly what I was thinking. It's like someone trying to shoot down the Death Star with a shotgun.

BOFH: Where there is darkness, let there be a light

Re: Definitely pick which battles you want to fight...

Upvote for "more than a hod of house bricks"

9 years after SpaceX strode into Texas village, Elon Musk floats name change for Boca Chica: 'Starbase'

You've got to Marvel at him

Starship, Starbase. Henceforth Elon shall be known as Starlord and all shall bow before him.

Who knew? Hadoop is over, says former Hortonworks guru Scott Gnau

Re: The future is MUMPS?

Good call ghudson. I remember the InterSystems reps coming to visit us soon after the launch of Cache for a demo. Must have been over 20 years ago. It was very impressive which is why I still remember the demo.

Fusion boffins apply plasma know-how to building thrusters

Impulse drive

The guy clearly has a warped mind.

Spaghetti Junction! Brum hospitals on hunt for new ERP and finance supplier to untangle current systems

Sounds promising

An NHS organisation with a large pot of cash to spend and which "... provided very little details on its requirement for the new software or of the potential challenges that lay ahead". What, as they say in the trade, could possibly go wrong?

Germany prepares to launch COVID-19 contact-tracing app 'this week' while UK version stuck in development hell

Foreign suppliers

Nobody told the American and Swiss developers that much as it is a lovely place to visit, things happen ever so slowly on the Isle of Wight.

Plus ça change plus ç'est la même chose as they say in (some parts of) Switzerland.

City of London Corporation explores options to escape Oracle's clutches

Integrate

SAP - very funny.

Why not pick best of breed SaaS offerings for each of the functions then integrate. That's one thing SaaS services make very easy, either through custom integrations directly via their APIs or more likely pre-built integrations via the likes of Mulesoft of Zapier. The added advantage is that you're not over the contractual barrel for a decade with a single supplier.

The days of the monolithic ERP are surely over, along with the near business death catastrophes that were so often associated with their implementation.

SAP proves, yet again, that Excel is utterly unkillable

SuperCalc

I used to know an accounts clerk who typed numbers into Lotus 123 on and IBM AT, added them up on a calculator, then typed in the total. And she kept a paper spreadsheet as a backup.

I preferred SuperCalc myself.

Airbus and Rolls-Royce hit eject on hybrid-electric airliner testbed after E-Fan X project fails to get off the ground

So ... the shit hit E-Fan then

Microsoft's Teams clocks 2.7 billion minutes of meetings in a single day as April starts to run out for Windows 10 2004

Teams clocks 2.7 billion minutes

Education, education, education

Ever dream of being an astronaut? Now’s your chance. NASA wants new people for the Moon and Mars

Re: Not all good...

If it's Boeing I'm not going.

Fujitsu warns HMRC Projects team that 30% of them could be out of a job come April

A little bit of Schadenfreude maybe

For years the industry bemoaned the move from in house teams to the big outsourcers. Now, the big outsourcers are getting a taste of their own medicine as they lose work to the big cloud providers. Bitter? Me? Just because my small business lost loads of local work to monolithic national framework contracts with the likes of Capita and Fujitsu? Well, yes actually.

Well, well, well. Internet-of-Things speaker biz Sonos to continue some software support for legacy kit after all

I'm 51 and I've got a so called "old" Sonos speaker (I think it's 3 years old).

I also have an amp and speakers I bought when I was a teenager ... and they still work brilliantly ... even with smart TVs and smartphones.

GCHQ: A cyber-what-now? Rumours of our probe into London Stock Exchange 'cyberattack' have been greatly exaggerated

Nothing to see here

A) Massive cover up to avoid tipping off the Russians that we're on to them.

B) A software upgrade gone wrong.

Drawing on all the experience gained over a long career in IT troubleshooting, on balance, having assessed all the possibilities and even though the client tells me the problem is definitely B, I'd still have to say that the most probable cause is A.

Now it's Terrance Dicks' turn to regenerate: Golden-age Doctor Who mainstay dies aged 84

In my view morals started to slip with the introduction of jelly babies, but I don't think Mr Dicks was responsible for that. RIP and thank you.