Posts by Pascal Monett

Windows might have frozen – but at least my feet are toasty

A user's ingenuity to find ways to do what he is not supposed to do far surpasses his ability to understand why he should not do it.

Google AMP gets a shock to its system as advisor quits, lawsuit claims foul play

Lessons learned, eh ?

"All we can do now is learn from the process "

And what have we learned ? That you do not allow Google to be in charge of the Web and its standards.

Any body that purports to create and maintain something destined to be a standard should have a multi-stakeholder Board and should take input not from companies but from experts and public opinion.

In a transparent and public manner. While publishing the minutes of the meetings. And ensuring that what is said is being done is actually being done.

In other words, do the opposite of ICANN and you can't go wrong.

Re: Fuck javascript.

Absolutely agree.

JavaScript is a menace. 99.9% of all malware starts with a piece of JavaScript. Block that and you're safe.

Unsecured Azure blob exposed 500,000+ highly confidential docs from UK firm's CRM customers

"Azure blob security"

Three words that sound ridiculous together.

How is it that multiple customers were using the same cloud storage thingy ? Did nobody think it would be better to have a storage per customer, or was that a more expensive solution ?

Yeah, it was probably more expensive. Couple that with a dev that probably had to set security to the lowest setting that worked with all customers, and a PHB that didn't give a damn, and this is the result : a massive breach of very intimate, personally-identifiable data.

Somebody should be jailed for this, and I'm not talking about the dev.

Wait ages for an antitrust battle and three come along at once: Google sued by 38 US states over search monopoly

"Google argues the lawsuit seeks to dictate how it designs its products and services"

Well duh, is that supposed to be an excuse to have the lawsuit thrown out ?

That's like a thief accusing the police of ruining his revenue stream by arresting him. Again, duh.

It drives me crazy when highly-paid lawyers blurt out such stupid excuses.

Google is a multi-billion dollar multinational behemoth. The only way to get it to behave is by nailing it to a wall and putting a gun to its head. Otherwise known as a lawsuit, in business circles.

Do No Evil is gone and buried. Be Forced To Do Good is on its way.

Search history can calculate better credit ratings than pay slips, says International Monetary Fund

Re: a succinct comment to reflect how I feel about it

I've got one : bullshit.

You're going to establish my credit rating on what I've searched for ? So if I search Ferrari I'm going to get a good rating, and if I search Ford Metro I'll get a bad one ?

How's about basing your evaluation on what I've actually purchased ?

This is just one more excuse to fleece me of my private life.

Go to Hell.

Dodgy procedures doomed Arianespace's Vega before it even left the launchpad

"not picked up in testing"

Then the testing is not sufficient.

I really can't imagine any scenario where plugging something in the wrong way around won't create merry mayhem with the electrical signals. Electricity is not something that adapts itself to the configuration - either you plug it in right or you're going to get a melted component.

Seems like Vega needs some physical modification in the connections to ensure that you plug it in right - like computer PSU connectors on motherboards. We've had those since forever, why does rocket science not have them ?

Cats: Not a fan favourite when the critters are draped around an office packed with tech

Re: there are strange folk who actually like cats

Yes, there are. People who like the purring of a cat sitting in your lap, especially on a cold winter evening. People who find it fun to see a cat lying in the sun, giving that impression of utter exhaustion only a cat can achieve. Oh, and farmers who like the free pest control around their grain reserves.

I love cats. I've always had a cat around since I was 5 years old. Not the same cat, obviously, but there always is a cat. I like it when they come for cuddles and push their head against my knuckles to scratch their cheeks, purring all the while like a motor boat.

I don't mind dogs, but they don't purr.

Re: Dead mouse

7mm ?

Wow. That's really small.

UK Home Office chucks US firm Leidos £30m for help snooping on comms data

It has played a role

"[It] has played a role in every major Security Service counter-terrorism operation over the past decade. It has also been used as evidence in 95 per cent of all serious organised crime investigations handled by the Crown Prosecution Service. "

Stop the bullshit general declarations and give us the numbers.

How many terrorists has it helped stop ?

How many crime bosses has it helped put behind bars ?

95% of all investigations means nothing if there have only been 12 of them.

There is not an ounce of actual information concerning this surveillance activity. It's all just PR waffle and grandstanding.

Give us the numbers, then we'll decide if it's worth it.

SolarWinds’ shares drop 22 per cent. But what’s this? $286m in stock sales just before hack announced?

Re: looking for the easy life

It seems to me that they already have the money for an easy life. Those $100+ millions they sold ? They invested that first. They likely needed a fair amount of millions to be able to sell those shares for that amount.

If I had $50 million, I guarantee there would be no VCing for me. I'd shut down my company, kick back and enjoy taking my wife to the restaurant every day of the week, spending the rest of the time gaming, YouTubing and generally being retired.

But I don't have that money.

China's Chang'e 5 probe lands Moon rocks in Inner Mongolia

Great success

I'm glad that China is climbing the (steep) ladder of rocket science achievements. When the asteroid comes, we'll need all the countries we can get to participate in deflecting it.

That said, do we really need to collect more moon rocks ? What more can we learn from this new batch ?

Dutch officials say Donald Trump really did protect his Twitter account with MAGA2020! password

Well he stuffed the Supreme Court with all the Republicans he could find and they shot him down anyway, so I'm not sure him being vastly more intelligent (twice of nothing is still not much) would make much of a difference.

We're not saying this is how SolarWinds was backdoored, but its FTP password 'leaked on GitHub in plaintext'

That article does not make clear how the data was accessed. Of course, obtaining personal, intimate data on up to 14 million government workers is very much a bad thing, but there is nothing that says that an FTP password was at fault.

Solarwinds can explain all it wants, the fact that it has rubbish password security is now established and that is a stain that is not going to go away quickly for a company that is supposed to deal in Internet security and network monitoring.

Up yours, Europe! Our 100% prime British broadband is cheaper than yours... but also slower and a bit of a rip-off

Re: your own selfish ilk

Funny, I don't remember saying that I do download 365 days a year.

I do have a dedicated fiber line. 1Gbps up and down. It costs me €53/month for Internet, phone and TV.

Not that expensive for the performance.

Data cap ?

I'm sorry, I'm paying for a connection at a given speed. The ISP's job is to support that connection 24/7/365. If I choose to download during 365 days, then that's my choice and I'm just using my bandwidth.

The only companies that impose a data cap are the cheap bastards that oversell their lines and underdeliver their bandwidth.

Australia sues Facebook for slurping user data from Onavo Protect VPN app

“deprived Australian consumers of the opportunity to make an informed choice"

I'm sorry, they made the choice to use a Facebook product. Don't tell me they're not aware of what Facebook is. There are largely enough posts about The Zuck for people to know exactly what it is that Facebook does : mine your life.

Larry Ellison says he's not following Oracle to Texas, prefers his private Hawaii pad

Re: adding ~ 1 million tons of lava to that area every day

There is nothing in your linked article that states how much lava is being added. Personally, I think a million tons a day is a bit much.

This page indicates that the Long Mountain, aka Mauna Loa, has not erupted since 1984, although it also specifies that the threat level is very high.

I don't know how to parse that information.

Your ship comms app is 'secured' with a Flash interface, doesn't sanitise SQL inputs and leaks user data, you say?

Shipping network security

I am not bothered by the fact that multi-million dollar floating transport behemoths can be taken over by miscreants. If the owner of the ship doesn't care, it's no skin off my back.

When they have had several ships wrecked because of malware of outright network takeovers, then they'll pay attention and the problem will go away.

Until then, it's not a problem.

Tableau 2020.4 crams pretty chart chops into browser so you can evict chunky client from storage real estate

"download its seriously weighty desktop client"

And just how weighty is that ?

My Lotus Notes installation is a hair under 13GB - and that's just the program, the data is in another folder.

Diablo III weighs in at 16GB. My Lord of the Rings Online install tops 27GB.

So how weighty is this Tableau application ?

Taiwanese manufacturer Wistron pegs damage from iPhone factory riot at $7m

If workers are forced to riot to get paid, then there is a problem that needs solving - wherever it happens.

It is not about capitalism, it is about basic human decency. You do the work, you get paid.

Right-to-repair warriors seek broader DMCA exemptions to bypass digital locks on the stuff we own

Re: Too logical...

I think that, if a manufacturer refuses the right to repair, it should automatically be obliged to extend the guarantee to the lifetime of the product.

Oh, and I mean the real lifetime, not the projected, expected lifetime. Guarantee until the thing breaks down physically.

I can't repair my own kit that you took my money for ? Fine, you do it then. For free and for as long as I have it.

Leaked draft EU law reveals tech giants could face huge 6% turnover fines if they don't play by Europe's rules

I disagree

This is the EU. More importantly, this is Eurocrats we're talking about. They live in a special world, one where money did not keep them from drafting laws that furthered Human Rights and the respect of privacy. GDPR, much ?

Lobby money will change nothing. The EU is setting up the legal framework to ensure that everyone plays nicely. It is not a threat in itself. If Apple, Facebook & co play nicely, nothing will happen.

But, if they don't then WHAM! and then they have to explain to shareholders why results are down by 6%.

Suits me.

SolarWinds: Hey, only as many as 18,000 customers installed backdoored software linked to US govt hacks

Thank God they're using red-blooded American software

It may be a fiasco, but it's a home-made fiasco, so it's all right.

It's not like they were using some foreign kit widely accused without proof of any kind of being beholden to another government. That would have been <shudder> terrible, right ? Using kit that just might exfiltrate data to an unfriendly country.

No, thank goodness, that didn't happen. It's just good ol' American incompetence that allowed a foreign government to . . oh, wait.

US Treasury, Dept of Commerce hacks linked to SolarWinds IT monitoring software supply-chain attack

"all of these organisations boast of having strong defences against such attacks"

Of course they do. And it's true - until they get hacked.

But that won't keep them from crowing about their "strong defenses" in the future because, you see, we will forget that they got hacked and, if we remember, they will trot out the good ol' "lessons learned" trope.

So it's all good, people. No reason to panic.

Ad blocking made Google throw its toys out of the pram – and now even more control is being taken from us

"server-side tagging"

Does that escape NoScript ?

I get that Google is doing its level best to scrape every last sliver of information it can get from me, but NoScript does a damn good job of keeping anything I don't want from running and Google is javascript all the way.

So does NoScript put this new approach to pasture ? I'd like to know.

Cruise, Kidman and an unfortunate misunderstanding at the local chemist

Back in my day

I remember film rolls very well. The whole development process was expensive, so you tried your best to make every shot count.

Then there were the urban legends of photo developers taking copies of "interesting" pics for themselves. Maybe there was a bootleg market for racy pictures or something, I don't know.

In any case, that door is now permanently shut. Everyone has their own camera and entire photo album in their pocket.

So, instead, they post racy pictures of themselves on the Web.

Progress ?

Oh, no one knows what goes on behind locked doors... so don't leave your UPS in there

Re: That reminds me <nostalgia mode>

A UPS is not only there to take over in the event of a power cut - it also smooths the voltage and ensures that the equipment is not subject to power spikes.

Well, if you buy a good one, that is.

I live in northern France, not far from a nuclear power station. When i started getting heavily equipped in computers and peripherals, some twenty years ago, I quickly noticed that, despite my being less than 30km away from the source of all power in the region, I was getting micro-drops in power that would freeze my computer regularly. I'm talking about several times a week.

I pride myself in always buying the best I can afford, so I was a bit miffed that my power supply was likely to damage my equipment.

I bought an 800VA UPS in 2001 and never experienced any problems again. When that one died of old age in 2009, I bought a new 1000VA UPS, and when that one died in 2019, I got a 1400VA model.

It's not just the power cuts that count.

It does solve a lot of problems.

Thursday, my daughter (who is living at home these days because of COVID) signaled that her laptop could no longer connect to WiFi.

I was giving a 2-day training course in Excel, so I couldn't do much at the time. I told her to sit tight and I'd take care of the issue in the evening.

That evening, my wife complained that her WhatsApp message hadn't gone out since 17h00 (5 P.M.).

After adding 2 + 2, I rebooted the Box (the Internet router), and everyone was fine again.

Question : how is it that a non-Windows platform still needs a reboot from time to time to work properly ?

FBI confirms Zodiac Killer's 340 cipher solved by trio of amateur math and software codebreakers

I think it would be more because 51 years ago, nobody had the means to test 650000 variations in anything resembling a human lifetime.

Cryptographic experts today have likely not invented new ways of decrypting things, how to decrypt was known decades ago. It's just that, today, computers make everything faster so you can try more things and stumble upon the solution.

This was a brute-force hack. Beck then, they didn't have the means to do it.

Rogue ex-Cisco employee who crippled WebEx conferences and cost Cisco millions gets two years in US prison

Sudhish Kasaba Ramesh

Someone who will never again get any job with admin credentials anywhere in the Northern hemisphere.

I don't care that his login was still available five months later. It's not because a door is open that you have the right to steal private property.

You've got to be shipping me: KatherineRyan.co.uk suggests the comedian has diversified into freight forwarding

Very unprofessional

I don't know the name of the person who was managing her website, but to let personal issues override your professional duty is sloppy at best.

Not someone I would want to work with.

Exonerated: First subpostmasters cleared of criminal convictions in Post Office Horizon scandal

"six people cleared of criminal convictions"

Six people who have lived a decade and a half with a criminal conviction putting their lives in shadow.

I cannot image what it must have been to live through that.

Of course, now they must be very relieved, but I doubt very much that the Post Office is going to "redress" the situation in any satisfactory way.

The baseline for me would be all the years of salary they did not get, plus at least half of that as penance.

But it obviously won't happen.

CEST la vie: HMRC admits controversial IR35 status checker returns undecided verdict in nearly 20% of cases

"HMRC stands behind every result it gives"

So HMRC is perfectly fine with a tool that tells 1 out of 5 people to go fudge themselves. How's that for service ?

Of course, when the time comes to pay taxes, HMRC will be the first to blame the contractor for not doing things right (obviously, not the same department).

France fines Google, Amazon €135m total for slipping ad cookies into people's computers without permission

@Headley_Grange

I have a friend like that. I've been educating him on web security for almost twenty years now. He uses Firefox with an adblocker and NoScript, like I taught him, except that, a few weeks ago, he admitted that he had disabled NoScript.

It annoys him because he cannot access his usual sites likes he likes to.

WTF ? I explained how you can just Allow the sites you work with. Where's the problem ?

I think the problem is that many people just can't be bothered to think things through - at least, not where computers are concerned. It annoys them and <i<they don't want to know</i> .

I spend my life on computers. It's my job, and my hobby. I breath bytes. I cannot fault other people who like other things.

I can, however, feel dismayed by it.

Re: Two words...

There are countries that evaluate a speeding ticket based on your revenue.

Just daydreaming here . . .

Google Cloud (over)Run: How a free trial experiment ended with a $72,000 bill overnight

From the article

"The GCP Cloud Run defaults also played their part. "The max-instances is preset to 1,000, and concurrency set to 80," he said. If he had corrected this to small values like 2 and 1, the bill shock would not have occurred. "

So he did find the setting and understand its importance. Only he checked after the bill, not before.

He should have checked the docs and settings before releasing the code

It seems to me that he did all the necessary checking after the fact.

I'm sure a $75K bill prompts you to do some deep verification, but it appears that he could have avoided the whole kerfluffle by, <gasp>, actually reading the documentation of what he was about to use.

It's quite obvious, as mentioned by a previous poster, that his contacts in Google is what got him out of the mess he put himself in. Anyone else could just go crying to the bank for a loan.

UK Ministry of Defence: We won't prosecute bug bounty hunters – oh btw, we now have one of those

Well yeah

"the whole technology community can effectively become your distributed dedicated full time CISO "

Absolutely. It's just like Microsoft making its dedicated customers its beta testers. You're sure to get results before the miscreants teach you an expensive lesson.

If you are too "proud" to use this as a tool, you have no business dealing with the Internet as a company. Unless, of course, you are a small company using widely-available tools and not doing anything more on the Web than hosting a basic commercial site or a personal site with next to zero functionality.

Apple fires warning shot at Facebook and Google on privacy, pledges fight against 'data-industrial complex'

When he read the phrase "Terms and conditions may not apply in China " he just saw the word China and knee-jerked all over the keyboard.

Bitter war of words erupts between UK cops and web security expert over alleged flaws in Cyberalarm monitoring tool

What a bunch of tossers

First, they send out a PDF with a link to an outdated version. Why was that outdated version still available online ? It seems a bit of housekeeping is in order.

Then they get a second negative review and, instead of dealing with the issues, they abuse their power to send a menacing cease-and-desist because they're the Police and they don't want to waste their time any more.

Sorry, but that is illegal and unacceptable. Apple does not have the luxury of sending cease-and-desist orders to people criticizing its products, but you, because you have the authority, you just bang one out. And that does not solve the problems that were raised.

Oh, and saying that "...it is not conducive to the delivery of the programme's objectives to spend further time and public money engaging with these issues or with you " is really the most demeaning "speak to the hand" you can possibly deliver.

Congratulations on being assholes. You get an A+ for that.

Expect to work between Christmas and New Year as Brexit uncertainty continues, UK SAP users told

"whether there is a Brexit deal or not"

I'm sorry, what "deal" are you still banging on about ?

There will be no deal. There is no deal. It's dead. You're leaving, and that's it.

Apple's M1: the fastest and bestest ever silicon = revolution? Nah, there's far more interesting stuff happening in tech that matters to everyone

Thank you for the link. I've learned something.

You could have referenced that to start with, though.

Reading El Reg while working from home? Here's a pleasant thought: Kaspersky says 1 in 10 of you are naked right now

"toiling away in the buff"

It is 1ºC outside.

In the northern hemisphere, this is not the season to be naked anywhere but in the shower or the bed.

Not unless your heating bills are not your problem.

And besides, having your sweaty crack oozing away on your chair all day ? Yech.

Uni revealed it killed off its PhD-applicant screening AI – just as its inventors gave a lecture about the tech

"It was never used to make decisions to admit or reject prospective students"

And who exactly do you think you're kidding apart from yourselves ?

This application "reduced the number of full reviews required per applicant by 71 percent and, by a conservative estimate, cut the total time spent reviewing files by at least 74 percent ”. You'll excuse me if I infer that you only reviewed the applications that were favorably noted by your AI, which clearly indicates that it chose who you would spend your time on, therefor anyone it didn't like you didn't spend time on.

I'm sorry, but your statement is factually incorrect.

It is also a blatant lie.

FOSS developer survey: Mostly male, employed... and many don't care about 'soul-withering chore' of security

'I find security an insufferably boring procedural hindrance.'

Well maybe a prison sentence would help you focus your attention a bit ?

SAP's strength is the basics: Not RPA or AI, but 'consistent' data models that make sense for actual business processes

"You cannot have these modifications that you had in the on-premises world"

Well I guess the world is going to do without cloud.

It's incredible that one company thinks it can dictate to all its customers how they are supposed to conduct their business.

So, The Cloud is not only "give me all your data, you might be able to work with it most of the time", but now it is also "you work the way I decide you work".

Well, in a word, no. Companies have spent millions on tailoring SAP to their needs - when it worked - I doubt they're going to spend tens of millions tailoring their company to SAP.

How'd they do that? It's classified: Microsoft's Azure cloud goes Top Secret

Azure Government Top Secret

The Government would be barking mad to put top secret files in an environment where it does not have total control and cannot shut everything down in an instant in case of a breach.

Then again, the current US Government is barking mad anyway, so . . .

PSA: The 2020 monolith is a dead meme. You can stop putting them up now. Please

You're the one who clicked the article. If you don't like it, go somewhere else.