Posts by Michael Wojcik

When it comes to DNS over HTTPS, it's privacy in excess, frets UK child exploitation watchdog

Re: TCP/IP vs. HTTP(S)

And if TLS is in the picture, there may be SNI as well, further confusing the issue. The SNI name is usually the same as the Host header value, for HTTPS, less the optional port suffix; but it doesn't have to be.

The application (e.g. browser) has to tell the TLS layer what SNI name to use. Some TLS APIs may not provide a way to do this separately from the target FQDN (or bare hostname or address) supplied by the user - that is, the TLS API may combine the DNS lookup, SNI configuration, and connection into a single call. That would force the application to use a "correct" name (i.e. one the server recognizes for SNI purposes) in your step 1, in order to get the correct server certificate to perform destination validation.

For that matter, if TLS and PKIX are involved, the application has to match some user-provided string against the SANs in the server certificate. Normally that comes from your step 1.

With other TLS APIs SNI, DNS, connection, and server-certificate SAN matching are separate. You can set SNI and server name explicitly using the s_client command of the openssl utility, for example. I'm not aware of a popular browser which gives you that level of control, but, hey, they're mostly open-source.

Microsoft throws lifeline to .NET orphans in the brave new Core world

Re: I expect down votes...

Microsoft will bin .Net Core one day, you can be sure of that.

This is a vapid observation. As you implied yourself, no product line will last forever. The question for developers is whether .Net Core is likely to last as long as their application. Frankly, that's hard to say for anything with a reasonably lifetime, as Microsoft's abandonment of Silverlight, WCF, etc show. I'm not making any judgement about whether those technologies were worth preserving or indeed using in the first place - just pointing out that Microsoft hasn't shown much commitment to the developers it encouraged to use them.

On the other hand, there were plenty of people who were dubious - with good reason - about Windows NT when it first appeared on the scene, and plenty of vendors who've been able to sell software on that platform for a quarter century.

As in most domains, making predictions in this domain is a fool's game. There's value in assuming that a platform might become obsolescent long before you're done with it, and planning based on that. But there's also value in giving customers what they're asking for, even if it requires using a dubious platform; and there's value in getting to market quickly, and in making use of widely-available labor, and so on.

Idle Computer Science skills are the Devil's playthings

Login spoofing

It's good to know that almost 40 years ago, miscreants were spoofing login screens to catch unsuspecting users.

Well, yeah. It's been around nearly as long as login prompts, presumably.

Hell, PLATO IV had a Secure Attention Key - the sole purpose of which is to defeat login spoofing - in 1972. So we're nearly at 50 years, and there are probably earlier examples of login spoofing.

Re: OReally?

I can believe it, for some of the systems universities were running in the '80s. Drives were much slower. Filesystems lacked some of the optimizations of modern ones.¹ On shared systems contention for CPU and memory resources could be fierce - and they made use of disk-backed virtual memory extensively, increasing contention for the storage system.

And if the filesystem were an NFS mount, over 10BaseT or similar ... it would have been agonizing.

¹Note that readdir(2) updates the atime of the directory inode, and unlink(2) updates the ctime. In the Old Times rm -r could quickly fill the write cache just with metadata updates.

Re: while(1) { fork(); }

Any POSIX-compliant OS since 1994 (and many UNIXes prior to that) is excellent at defending against trivial fork bombs and many other simple resource-exhaustion DoS attacks, given a moderately competent system administrator.

Re: Press CTRL-C before logging in

I was also studying Computer Science at a university in the 1980s

I was as well.

(yes I am an old git)

I don't think this qualifies us as "old" by Reg readership standards. There are still a number of folks here who were working in the industry in the 1970s. Not sure if we have any regulars who were doing significant IT stuff in the '60s, but I wouldn't be surprised.

The best defence against it was to press Control-C before logging in, to exit the prank script.

Yes, that's worth a try, though a clever script author would (assuming UNIX here) trap the signals they could, or even better suppress all line-discipline signal generation using stty.

But then this is why the SAK was invented.

Re: Who hasn't done something similar?

Under Unix it spawns a new process. Cue the system dying due to running out of PIDs!

Admins who don't set reasonable resource limits (setrlimit / ulimit) get what they deserve.¹

I've seen this plenty of times at customer sites. They report some problem, and it turns out one of their applications has an inadvertent fork bomb or filled up a small /var partition or what have you. "Isn't there some way we can prevent this?" they ask. Yes. Employ a system administrator who actually knows the OS you're running.

¹Granted, depending on how long ago this was, it might have been a UNIX variant that didn't have setrlimit. But setrlimit's been around for a while. Man page history says it appeared in BSD 4.1c, and while I'm not sure when AT&T UNIX picked it up (don't have my reference books handy), it was incorporated into POSIX.1 in Issue 4, Version 2, in 1994. As far as I can remember it was in all the UNIX variants I was using in the early 1990s. (I don't remember using it in anything in the '80s.)

Re: Friend did something similar

Yes. There are various sorts of well-formed pathological zip files (and similarly for other archive formats), well-documented in forums such as BUGTRAQ and VULN-DEV. The topic may have come up in an article in PoC||GTFO, too; I have a vague memory of that.

Anyway, this is why modern malware scanners generally have configurable limits on directory depth, expansion factor, and nesting for archives and other compound file formats. If a limit is reached, the scanner treats the file as malicious.

Of course this is an arms war, with attackers finding new looping constructs the scanner developers forgot to limit, creating polyglot files that scanners interpret incorrectly (or at least not in the way that end users interpret them), and so forth.

Re: Caps

SSg7 is ONE of our resident KOOKS, of the variety ADDICTED to random BLOCK capitals. Skipping SSg7's posts USUALLY means nothing more than missing A BIT of entertainment.

There's a reason why my cat doesn't need two-factor authentication

Re: figuring out

IS it possible? Or does it become a problem of Decidability, which has been proven to not always be possible

To answer that, we'd first need a formal definition of "untrickable", which is itself an intractable problem.

For nontrivial security systems, it's usually impossible to precisely partition behavior into valid and invalid. Given enough time to argue, system experts can usually find some edge cases for which they can't agree on validity. And if your gold-standard panel of human judges can't agree on what the system's behavior should be (or whether that behavior is correct) in a particular case, then by definition you can't say whether the system is correct - you have no rubric.

So in the general case, perfectly-secure systems are not possible, because they can't even be specified.

Someone slipped a vuln into crypto-wallets via an NPM package. Then someone else siphoned off $13m in coins to protect it from thieves

Re: Surely...

you knew that you had no authorisation to interact with the computer

Authorized users had already installed Komodo's software, giving Komodo authorization to interact.

I may be (and, indeed, am) annoyed every time I use Excel, but I can't claim that Microsoft is running it on my computer without my permission. Should Microsoft update Excel so it uploads all my data to their cloud (hmm...) and deletes it locally (who'd be surprised?), I can't claim they were "unauthorized".

Re: Surely...

However what they have done could still be considered unauthorised access to a computer system.

Could it? My reading of the article - I haven't investigated the details, because frankly I don't much care - is that they simply changed the code in their wallet app to move the balances to wallets they control. Someone who uses their wallet app might have grounds for claiming violation of contract if they have some sort of agreement that Komodo won't do that, but I don't see any "unauthorized access". The users decided to install and run the Komodo wallet software. It's authorized.

Re: because everyone is abandoning their duty of care

It's not a binary choice. Software security is a process, and part of that process can, and should, be implementing improvements to third-party dependency handling. Some people in this thread seem to regard that as all or nothing: either you inspect every line or you throw up your hands and let automated package managers pull anything, whenever they want.

This is true of every aspect of security, in every domain. Security is never finished or perfect. That doesn't mean we shouldn't do anything.

Re: Just goes to show

The OP's theory is lovely, but it's completely unworkable.

Rubbish. There's a world of options between "I've personally reviewed every single line of source in my external dependencies" and "I let npm download arbitrary updates every time I build".

For every project I've ever worked on, it's entirely possible to keep a manifest of every single third-party dependency, know what versions I'm using, know when they're updated and why, and check the provenance of those updates. Which is good, since those projects all are required to conform to those requirements.

None of those projects would ever have incorporated a new dependency automatically. Yes, someone could still fail to perform due diligence when that dependency was added to the existing component; but that's a far cry from letting a package manager simply add it to the product automatically.

There are far too many software products - particularly web-based ones - where the development teams have no idea what dependencies they're pulling in. That's lazy negligence.

It's official! The Register is fake news… according to .uk overlord Nominet. Just a few problems with that claim, though

Re: Give the users a break

Perhaps El Reg should buy theregistrar.uk and use it to launch their own registrar. "Register your domain with the Register! Bite the handle that means you!"

Re: Nice write up! Excellent fact checking!

a meal conveniently delivered in a bucket (that one might later find useful as a receptacle for vomit)

Ooh, I wouldn't recommend it. For KFC vomit you really want something deeper, to cut down on overspray. I'd also want something tougher than coated paper.

Re: Nice write up! Excellent fact checking!

And what sort of assholes run those companies, as Uzi Nissan discovered.

Judge slaps down Meg Whitman for accusing Autonomy boss of being a 'fraudster who committed fraud'

Re: Wow, that certified software has really had to prove itself.

Yes, I'm sure the judge would put great weight in an amicus brief submitted by a single ex-employee, concerning a vaguely-described procedure he may not have actually performed. That would be a trenchant thrust indeed!

Re: Making it up?

Outside the realms of overtly creative accountancy, the rules of finance are fairly deterministic

I'm not an accountant, but I believe this claim is wildly inaccurate.

First, we're talking here about accounting, not finance. The latter, as a term of art, generally refers specifically to the analysis of assets and liabilities; the former is broader, dealing with various non-financial aspects of economic entities as well.

Second, which rules? GAAP? IFRS? In this case, I believe (haven't bothered to confirm, but this is usual for US and UK) we have an organization using the former purchasing one that used the latter.

Third, even the most surface understanding of GAAP or IFRS shows how many more or less subjective decisions are made when accounting for various events under them. Just look at a summary of GAAP or IFRS, such as Wikipedia's; it will be full of loaded phrases such as "as long as it is reasonable to do so", "may be charged", "decided based on", "should be considered", "selection of", "measured in either".

It's not a matter of throwing a bunch of numbers into a spreadsheet and toting them up at the bottom.

But there are contradictory facts.

Are there? Or are there simply diverse contributing factors?

Lesjak and others said from the start that Autonomy was overvalued by HP. Apotheker admitted he didn't perform due diligence - he didn't read the auditors' preliminary report, ignored those who did, and completed the purchase and fired the auditors before the final report was ready. That suggests a significant portion of the blame goes to Apotheker and his supporters.

Hussein was convicted. He may have been wrongfully convicted, but the conviction (on all 14 counts) is at least an argument for improper accounting and misrepresentation by Autonomy. That puts some blame on Autonomy.

Whitman's and Lynch's testimony and related evidence strongly suggests HP's internal culture was badly broken in ways that impeded sales of Autonomy products after the acquisition. That puts more blame on Apotheker and some on Whitman, and on their management teams.

None of these are contradictory. All of those parties¹ could have contributed to the gross overpayment for Autonomy and the subsequent failure of the Autonomy product portfolio within HP. There needn't be a single villain in this story.

HP(E)'s attempt to salvage the reputation of its board and CEOs in this debacle by crying foul does seem to be floundering in this trial, as no one is coming off very well. But I expect that means the case ultimately won't be strong enough to find for the plaintiff (HPE), which depending on your interpretation would either vindicate Lynch and Autonomy or acknowledge mutual bad behavior.

¹Except perhaps Lesjak, who seems to have been the Cassandra of the original deal. Whitman appears to be trying to lay the primary responsibility for HP's accusation of fraud by Autonomy at her feet; whether that's valid, and if so whether that accusation was made in good faith, are still open questions.

New twist in underworld of alleged code, data theft: Two, er, boffins accused of trying to steal, uh, a river model

If you dress up as a ghost to do it, you achieve Full Scooby Doo.

Supra smart TVs aren't so super smart: Hole lets hackers go all Max Headroom on e-tellies

Re: Bah humbug

I was able to buy a non-"smart" TV off the shelf at Target a year or so ago.

Granted, they only stocked one model. But there was the one.

I expect the next "TV" replacement will be a dumb monitor, driven by a set-top box. It's not like I have any trust whatsoever in most of those, but I'll take one misbegotten security-hole-ridden spybox over two. And the set-top boxes seem to get more frequent updates, and they're a lot cheaper and easier to replace. They cold-boot faster than the TV, too.

CVE-2019-12477 has nothing to do with UPnP or DLNA, as two seconds of research would have shown you (and the me-too idiots who replied to your post).

If you're going to be too lazy to read or think, why not spare us your efforts at commenting as well?

Dissed Bash boshed: Apple makes fancy zsh default in forthcoming macOS 'Catalina' 10.15

Solaris is the most ubiquitous commercial Unix

Citation? I spent a minute or so on research and I found a lot of conflicting claims with little to back any of them up.

Re: The shell wars.

csh was my first shell-of-choice; then it was tcsh, which I merrily built on all the UNIX flavors I used, for several years.

But while I don't know if I'd call csh "evil", I did become disenchanted with t?csh's misfeatures and infelicities. I started using ksh variants on most of my systems, and gradually moved to a mix of ksh and bash - the latter on machines I administered, and the former on various shared systems where I was too lazy to bother running chsh and setting up a bash-friendly .profile and .bashrc.

I've found ksh and bash are generally more consistent, sensible, and feature-rich than csh and tcsh.

I played around a bit with various other shells (zsh, scsh, probably others that I've forgotten); I even spent a few days on my Solaris box using dbx as the shell in a couple of xterms, just to see what it would be like. (Solaris dbx is ksh-complete.) bash seems to be one of my local minima, though, and nothing's annealed me out of it yet.

Re: Anecdotal datapoint...

$ set -o vi

You are a very naughty boy!

I'd rather laugh with the sinners than cry with the saints.

I'll just clear down the database before break. What's the worst that could happen? It's a trial

Re: BTDTGTTS

I seem to recall that the commands should be issued separately, to allow the syncs a chance of working while you were typing.

Exactly. With old, slow MFM drives of the ~ BSD 4.2 era, the idea was that you'd enter "sync", and by the time the shell was able to show the command prompt again, the flush would be well under way. Repeating the process twice more gave you high confidence that it was able to complete, because if there were a lot of pages to flush, the system would be correspondingly sluggish (particularly if the sticky bit was not set on /bin/sync) and so it would take longer to get the prompt and run sync again.

"sync; sync; sync; reboot" was a cargo-cult corruption of that process which lost the purpose of the multiple syncs. Yes, running sync the second and third time would give the kernel a little more time to finish flushing, but not nearly as much as entering them as separate command lines, and it wouldn't adapt to the system load.

Wow, talk about a Maine-wave: US state says ISPs need permission to flog netizens' personal data

Re: I can see why this was a thing.

Is that actually a thing? The combination of having a hardwired broadband connection, and not having a mobile signal? That's an unusual combination. Usual mobile comes to an area first.

There's a lot of rural territory in the US where households have electrical service but wireless coverage is poor or non-existent, or at least limited to only some of the major providers. Since the wiring infrastructure (poles, access roads) is already in place, it's relatively easy to wire them for telecoms as well, and indeed in many cases there will be DSL-capable lines already.

Here at the Mountain Fastness, in northern New Mexico, I have fibre to the premises (courtesy of the local electrical & telecoms co-op), but if I didn't have my own picocell connected to it I wouldn't be able to get mobile service in the house or on most of the property. There's a spot out front where I can usually get a single bar, which I use to call the aforementioned co-op when there's a line cut or other outage.

On my way here from the Stately Manor in Michigan, I pass through such teeming metropolitan areas as Eads, Colorado, which definitely has some sort of wired Internet service (the gas stations have that damned GSTV, for example), but no AT&T mobile service, at least.

Wireless coverage in the US outside metro areas is greatly exaggerated by the FCC's bogus census-grid-based metric, as has been reported several times here in the Reg.

Re: I can see why this was a thing.

I think every ISP I've ever used provided email accounts, and still do. Many of them provided "web space", though I think most of them have dropped that. I've never bothered using those bundled services, and I suspect neither have the vast majority of customers.

One man went to mow a meadow, hoping Trump would spot giant grass snake under flightpath

Re: childish

"proposition"? "cackles up"? Your command of the English language is indeed impressive.

Introducing 'freedom gas' – a bit like the 2003 deep-fried potato variety, only even worse for you

Re: "Methane is odourless"

You do have to admit that your regular El Reg reader is not a "vast majority of people".

I'm a vast majority of people, and so are my wife.

Ex-Autonomy CFO Hussain will not defend himself in the High Court

Re: One assumes

I wouldn't make that assumption. For one thing, his US sentence has already been decided. It wasn't a plea bargain, so I don't offhand know of any process that might alter it for the worse, short of committing another crime. And speaking in your own defense is still not a crime in the US, particularly not in a trial in another country.

Many defendents choose not to give testimony in their own defense. Giving testimony is widely seen as risky. It may still be the better move, but there's always a chance it could backfire.

I don't think Allenwood is "cushy", either. It has low-, medium-, and high-security facilities, but even the low-security one is hardly a picnic. For one thing, you're still forced to stay there and do what they tell you to do.¹ Maybe that's your definition of "cushy", but it's not mine.

Being out $10.1M probably isn't all that much fun either. I don't know what sort of resources that leaves Hussein with, after legal fees and other encumbrances.

¹"I'm incarcerated, Lloyd!"

Mad King Leo pulled the wool over HP shareholders' eyes, ex-CEO Whitman tells court

Re: RE: "...why is the price of your printer ink daylight fucking robbery ?"

Pfft. She doesn't think anyone should pay more than a fair price. That doesn't mean she's obligated to refrain from offering them the opportunity to get screwed.

For that matter, inkjet printers in general, much less HP inkjets in particular, do not have a monopoly on printing. Hell, you can get a monochrome laser printer for < $100 these days, and even get color laser printers for < $300. Will the manufacturers still try to gouge you on toner? Probably, though I wouldn't know, as my HP 4Mps from 1992 is still working fine.

And, of course, printer ink is a product of HP Inc., not HPE. Dion Weisler runs HP Inc. Whitman hasn't had anything to do with that product line since the 2015 split.

Re: The more this goes on...

That's also what Microsoft did when Bill Gates was at the helm.

Agreed. Look at Microsoft's first big acquisition: PowerPoint, in 1987, for ~ $2.8e7 in 2011 dollars.

Then look at Balmer's Boondoggle: Skype, in 2011, for ~ $8.5e9. Two orders of magnitude more, adjusted for inflation.

Which has driven more revenue / year, in absolute terms or relative to purchase price? Even if we adjust for how much cash Microsoft had at the time of purchase, and allowing for the fact that PowerPoint is part of the Office bundle and it's hard to separate the major components of that product into their individual contributions, I think it's hard to see how PowerPoint wasn't a much, much smarter move. (I don't much like PowerPoint myself, but it's obviously a hugely popular product in markets that are willing to buy many licenses for it.)

Tesla's autonomous lane changing software is worse at driving than humans, and more

Re: Unconstrained College Students Dataset:

To some extent it doesn't matter whether it was legal, despite Boult's appeal to that standard. (From the article: "Boult said taking photos of people in public isn’t illegal".)

For any accredited US university, this is going to be an IRB (Institutional Review Board) violation. Adding photos of people to a dataset for research purposes is Human Subjects Research, and the IRB will require the PI (Primary Investigator, the chief researcher on the project) get permission from the subjects.

I've seen people get in trouble with the IRB for doing research on things like forum or email-list messages without releases from the authors, even though those are public texts.

Re: I actually own one

Yes, this single subjective anecdote certainly outweighs all other evidence.

Re: Autopilot is itself Incomplete

Agreed. Unfortunately Tesla isn't the only manufacturer that's going this route.

I currently have a 2015 Volvo, and I suspect I'll never buy a newer one, having seen how many of the physical controls have gone away in my wife's 2018 model. Touchscreens for drivers are an imbecilic idea.

I rented a Hyundai Santa Fe once (you take what you can get at the airport rental agencies), and the idiotainment screen in it didn't dim with the instrument lights, either automatically when it got dark or using the manual instrument-light dimmer control. It was extremely distracting and irritating to drive that thing at night.

War is over, if you want it: W3C, WHATWG agree to work towards single spec for HTML and DOM

Re: Why not save the planet at the same time?

I find the attitude of many WHATWG members annoying, and I dislike the "living standard" concept; but WHATWG did add a bunch of semantic tags to HTML5, such as header, footer, and section.

Re: Why not save the planet at the same time?

Perhaps we need a new protocol, APP, and engineer that from the ground up to be a distributed app / client / server environment without all the layered mess and complexity of the current approach.

This has been done So. Many. Times.

Eternal September is eternal.

Re: Why not save the planet at the same time?

I haven't attempted to do any calculations, but I'm willing to bet that the costs of processing HTTP and HTML are orders of magnitude less than those of processing all the images web pages are festooned with, often scaled by every single client because the site developer couldn't be bothered to scale the source images.

And those will be many orders of magnitude less than the costs of running all the damn scripts.

For many pages, the cycles burned by HTTPS crypto dwarf what was used to generate the actual requests and responses. Should we get rid of that?

And, of course, there are other uses of IT which consume a hell of a lot more resources than traditional web activity does. You're optimizing the wrong target.

And even with false economies aside, there have been various proposals and attempts to replace HTTP and HTML over the years. Hyper-G was an HTTP replacement that offered bidirectional linking, for example. BEEP tried to serve as the one-protocol-for-all that HTTP became. Any number of sophomores have proposed tokenized HTML variants, only to have it pointed out to them that all significant servers and user agents support HTTP compression, if that's what you want. (And, of course, we had various attempts at TLS compression, which were a disaster.)

These things don't catch on because the effort of replacing HTTP and HTML would be enormous, and would need a similarly enormous reward to be justifiable.

As it is, HTTP/2 is a very substantial change from HTTP/1.1, and largely designed to reduce the consumption of various resources. HTTP/3 will go further. I'm not fond of HTTP/2 and HTTP/3 myself, because they make my job more difficult with little return for my use cases, but for organizations that serve a lot of content they make sense.

IEEE tells contributors with links to Chinese corp: Don't let the door hit you on Huawei out

Re: Ho hum

As an undergrad, I was invited to join the IEEE. I threw the application out when I saw they still (at that time) required endorsements from two members in good standing. I was interested in joining a professional organization, not a club.

Since then, I've never seen any real reason to review that decision. I get significant benefits from my ACM membership. The incremental benefits of belonging to IEEE aren't compelling.

Re: If it hadn't before...

In AmEnglish, yes. In BrEnglish, collective nouns are often treated as grammatically plural. This is well-established usage. You frequently see it in reference to corporations, for example ("Micro Focus have announced...").

Essentially AmEnglish conventional usage leans toward making the verb agree in number with the syntactic number of the noun, while BrEnglish leans toward making the verb agree in number with the semantic number of the noun.

Neither is any more "correct" than the other, of course, unless you subscribe to the religion of linguistic prescriptivism.

Infosec bloke claims: Pornhub owner shafted me after I exposed gaping holes in its cartoon smut platform

Re: Whatever floats your boat

In terms of fantasy, sure.

The original question was actually in terms of arousal, and in that context the source of the stimulus is irrelevant. Mr Benny seems to have a spot of difficulty with reading comprehension.

Re: Who watches cartoon porn anyway?

Two yen symbols? How is this possible, even in a cartoon? It defies the very laws of visual representation!

On a slightly more serious note, human fetishes are essentially unlimited. There's really no point in asking "how could someone be aroused by X?" for any X. There's always someone out there who can form a libidinal attachment to it. That's the psychological foundation of Rule 34.

'Evolution of the PC ecosystem'? Microsoft's 'modern' OS reminds us of the Windows RT days

Re: hmmm...

Automatic updates have helped a lot here too - something most devices support nowadays but only Windows gets slack for around here for some reason.

My Windows machines are the only ones that spontaneously update and reboot, discarding my working state. That alone makes them unfit for purpose. No other devices, systems, or applications I use have that problem.

You complained about this yourself in the previous paragraph. It's one very good reason why Windows 10 is criticized in these parts.

The other, of course, is that Win10 updates have a history of breaking things.

Re: hmmm...

AI powered is great if the AI is as smart as a smart human personal assistant would be to anticipate your needs.

Ugh. If I wanted that, I'd have a human assistant. No thanks.

Though, frankly, this particular abuse of "powered" is generally a reliable sign that I don't want whatever shit some idiot is trying to sell me anyway. My OS is powered by electricity. It might have features that make use of ML or other AI techniques (insofar as "AI" has any useful meaning), but it's not "powered" by them.

(And "always connected" can Fuck Right Off, too.)

Re: The future is called Powerpoint

the state is separated from the operating system; compute is separated from applications

Since this statement is nonsensical, it doesn't really matter what its consequences might be. Parker is just spouting a lot of vague bullshit.

There are ways to resolve such issues, but are far from being simple.

For the most part they're very simple indeed: make your data structure and API changes backward compatible. I've been doing that in systems as complex as most of the Windows subsystems for decades, and so have plenty of other developers.

Microsoft's problem in this area is primarily a cultural one, not a technical one. It's the same reason for "DLL Hell" and the abomination that is SxS. They can't be bothered to enforce a backward-compatibility policy on their developers.

Egg on North Face: Wikipedia furious after glamp-wear giant swaps article pics for sneaky ad shots – and even brags about it in a video

And copyrights and trademarks are entirely different things.

Remember, the ad agency isn't in the business of selling North Face stuff to us, they are in the business of selling adverts to North Face.

Yes. Every time I see an agonizingly awful advertisement¹ I think "what moron decided to buy this from the agency?!!". Then I reflect that selling advertisements to the client is what they do, after all. Presumably they're good enough at it to stay in business.

¹Today's shibboleth: the "Microsoft AI" ads that are running on some TV streaming service my wife has been watching in the other room. Every time I overhear one I am filled with rage. I suppose this means the campaign is a success, since I remember it.