Posts by Pascal Monett

We're almost into the third decade of the 21st century and we're still grading security bugs out of 10 like kids. Why?

The task sounds enormous

So, two low-scoring vulns could be combined into one big problem. Sure, theoretically, but how do you evaluate just how many low-scoring things can be combined and in what way, before you can rate all of them properly ?

Security is always in hindsight. We know to look out for privilege escalation issues because some hacker one day taught us that it worked. We have a body of knowledge today that is certainly impressive, and it will be one hell of a task to knit all that knowledge together to create a proper rating system, but there is no such thing as automating the risk evaluation - it has to be analyzed by a human. Humans don't know everything, and are rather bad at taking into account hundreds of parameters at once.

It is obvious the CVSS is not very valuable, but crafting a good replacement is going to be a massive headache. And yet, it should definitely be done. Good luck with that, then.

Intel insists Xeon vs Epyc benchmark fight was fair, amends speed test claims anyway

"Intel [..] would not intentionally mislead,"

Funny you should say that, given how many times you've already been nailed to the post for misleading reporting on performance. So either you employ incompetent people to draw up your reports, or you don't do enough reviewing before publishing, or . . you're marketing efforts are a bit too zealous (yeah, let's put it that way).

This kind of behavior is quite common in the industry, just look at the continual skirmishing between NVidia and AMD on the graphics side of things. AMD is always being forced to defend the performance of its processors in all domains, because AMD is a worthy contender and we need AMD to keep everyone else in line.

IT is the one domain where the numbers should not lie. Thanks to AMD for their continual efforts to keep it that way.

NPM today stands for Now Pay Me: JavaScript packaging biz debuts conduit for funding open-source coders

Re: getting hacked to change the funding link to one not controlled by the authors

Yup, when I read the words "all you need to do is set up a funding URL" I immediately thought "and all the hackers have to do is hijack that".

I totally agree on the principle, but JavaScript being the most hijacked thing in the IT world, I can't see how that will not attract all kinds of scum.

Still, at least they are trying something.

Open wide, very wide: Xerox considers buying HP. Yes, the HP that is more than three times its market cap

Only in the business world

An $8bn company starts talking about buying a $27bn company. Reality stares back and says "Nope".

If I had $8000, I could conceivably persuade my banker to loan me another $20000 to buy a $28000 car, but even if I had $80000, I don't think my banker would loan me $200000 to buy a $280000 house. Not at my age and not on my salary.

So what is the real reason behind this pie-in-sky thinking ? Xerox can re-evaluate its cash flow, redo its financials six ways to Sunday, it doesn't and will never have the cash or the means to match HP's weight.

The whole affair is nonsense.

Leeds IT bloke pleads guilty to hacking Jet2 CEO's email account

"statistically speaking, he is unlikely to end up behind bars"

Maybe, but he's also unlikely to ever work in IT again in a professional capacity. It's time for a career change - whether he wants to or not.

What is this, 1989? Laplink is still a thing and wants to help with Windows 7 migrations

Re: external USB hard drives

You do realize that hard drives are not backups ? They are subject to failure, magnets, and various other risks.

An optical disk is the only proper backup. Keep it in the shade at reasonable temperature and your photos will still be viewed decades from now. I suggest a BluRay writer and buying the 50GB disks. They are a bit more expensive per GB than the 25GB disks, but hey, double the storage is worth it.

Controversies aren't Boeing away for aircraft maker amid claims of faulty oxygen systems and wobbling wings

"implemented corrective actions"

In other words, the whistle-blower was right, and he was right to blow the whistle.

That is what happens when cost and schedule get top priority over security. I hope that not too many people risk dying because of some zealous beancounter.

Bad news, developers: Apple Mac App Store tells cross-platform Electron apps to get lost

The problem is not in private APIs or not. The problem is the rule said do not use them, developers used them and got away with it for a while, building their base and reputation, and now boom, no more private APIs.

That is not consistent. The developers should never have been able to post those apps in the first place. That would have been consistent.

After that, if you don't like it is another matter entirely. But if you ban them then you ban them from the start, not after a few years of saying so.

"a rule long ignored is now being enforced"

And therein lies the rub : consistency. Apple is well-known for wanting to control everything, but how it controls is not consistent. It is useless to lay down a rule if you only enforce it after years of ignoring it. That is how you get backlash and discontent among your user base.

Of course, it may be that Apple has decided it doesn't care, but the lapse between declaring the rule and enforcing it is just sloppiness. When a company decides to only accept Word files as job submissions, you can bet that it won't let the first 20 PDF files through anyway, just because. No, those PDF files are going straight to the round filing cabinet and those who submitted are likely never even going to hear about it.

Three UK does it again: Random folk on network website are still seeing others' account data

"fewer than 10 customers"

Oh, so that's all right then, nothing to see here.

Move along, move along.

GitLab mulls ban on hiring Chinese and Russian support staff because 'security'

Re: Nothing to see here

When did GitLab become a defense contractor ?

Re: I'm a bit confused...

Where in the article was outsourcing mentioned ?

The article is about (not) hiring, not outsourcing.

In a world of infosec rockstars, shutting down sexual harassment is hard work for victims

It is disheartening

It is disheartening and despicable to realize that we are in the 3rd Millennium CE and there are still men who treat women as objects to be acquired, without acknowledging that they are also people.

I do not understand that mentality. If you really think a woman is just an object, then go buy yourself a Real Doll. You'll have exactly what you want and women will have what they want : not you.

Tech and mobile companies want to monetise your data ... but are scared of GDPR

"your data for what"

These days, it would seem that the ability to post inane tweets, a picture of your meal or some other equally useless thing is quite enough to validate the usage of people's data.

The only reason we're having this discussion is because people don't actually care what they are being used for on the Internet. There appears to be a general approach of "I can do whatever I want, there are no consequences and I will use anything that is free without thinking".

As long as the majority think that way, companies will be able to get away with a lot. That is why GDPR is likely the best thing to happen to the Internet in general. Only the fines will keep companies in line.

OneCoin lawyer trial kicks off in NY as cryptocurrency founder remains on the lam

"get in on the ground floor of what she claimed would be the next Bitcoin"

But it is the next Bitcoin : a refined Bitcoin, without all the hassle of having to manage tokens and deal with exchanges.

No, this is just pure "gimme the dough and shove off".

Heads up from Internet of S*!# land: Best Buy's Insignia 'smart' home gear will become very dumb this Wednesday

Ah, yet another joy of IoT

All the wonderful things that come with "smart" now also include "the provider can shut it down without your consent". Just like all those defunct music services where you thought you buying music tracks, remember ?

Man that really encourages me to dash off and purchase all that smartness.

Boffins hand in their homework on Voyager 2's first readings from beyond Solar System

I don't understand the diagram

The heliosphere is based on solar wind, so why isn't the heliosphere centered around the Sun ? Looking at the diagram, I see a very exaggerated version of Earth's magnetic field. I know the Sun is moving around the center of our galaxy, but surely the heliosphere encounters the pressure of the interstellar medium in all directions, no ?

So why the gigantically-disproportioned tail ?

PSA: Turning off silent macros in Office for Mac leaves users wide open to silent macro attacks

I don't get it

As a programmer, how can one possibly get two different results for doing the same thing, but one is with notification and one is without ?

I'm not going to code disabling macros twice, having a notification is just an option, so how did Microsoft get there ?

Baffled by bogus charges on your Amazon account? It may be the work of a crook's phantom gadget

Ah, the joy of Smart

It seems that, in their rush to provide yet another way to monitor consumer behavior for no benefit to consumers, all these "smart" thingamabobs are opening yet another Pandora's box worth of trouble.

The Internet appears to still be in its Wild West period. Maybe, in a few decades and after many, many lawsuits, companies will finally be capable of design products that do not shit on their their customers without them having a clue.

Maybe.

The .amazon argy-bargy is STILL going on – and Uncle Sam has had enough with ICANN

Oh for God's sake

Bezos's Amazon is a company, and it has it's .com address already. What are we supposed to do, have a .ibm, a .apple and a .whateverthefuckelse as well ?

Companies are on .com, end of.

Yes, I know that will bruise the ego of those multi-billionaires, but there should be some things that money cannot buy.

Chrome bug squashed, QNAP NAS nasty hits, BlueKeep malware spreads, and more

"users and camgirls' email addresses, IP addresses, chat logs, and more"

With a data trove like that, no payment data was needed. Miscreants will exploit that to extract payment via blackmail.

One can only hope that the people using the sites were using a throwaway mail account, but the odds of that are likely rather low.

If you're going to exploit work's infrastructure to torrent, you better damn well know how to hide it

The sly devil

Ok, points for having weaved through all the issues, but points docked for having thought that the server bandwidth was free and not checking to ensure that it was.

It is fascinating to see how the dominoes fall in real life, and that obstacle course was rather hair-raising at times.

A very interesting tale.

Top American watchdog refuses to release infamous 2012 dossier into Google’s anti-competitive behavior

Splendid response

After being asked to please publish the full report, the FTC answers that it is outside the scope of FOI requests. Congratulations on not answering the question in such a way that we instantly understand that you don't give a damn.

Trump and the Republican Party has managed to literally behead justice and professionalism in almost every governmental agency. It is frightening to witness how quickly a country that once had a functional and fairly respectable system has become a banana republic.

Cubans launching sonic attacks on US embassy? Not what we're hearing, say medical boffins

Actually, they should look at replacing their editors, and probably their management as well.

A news publication that stands by a false story they cannot substantiate should be shut down, pure and simple.

Cyber-security super-brain Rudy Giuliani forgets password, bricks iPhone, begs Apple Store staff for help

Re: It's incredible...

Agreed. In three short years I have seen more scum churn around Trump than I would have thought possible to ever see in the company of a President of the United States.

Microsoft sees sense, will give Office 365 admins veto rights on self-service Power tools

"we’ve been listening to customer feedback"

Yes, I bet you have, because this time it's the customers you desperately want to keep : those that pay you the big support contracts and enormous license fees. So yeah, you listened, because those are not the Joe Public nobodies you don't care about when they whine about your craptastic GUI.

Bet you can't guess what I'm wearing, or where I'm wearing it

So, Adobe publishes your personal details and that is not sensitive data ?

Why hasn't GDPR been shoved in its face to educate it a bit yet ? There's massive potential for a stonking big fine there, I would think.

Thought you were good at StarCraft? DeepMind's AI bot proves better than 99.8% of fleshy humans

"DeepMind reckons the whole effort is worth it"

Sure, if I was paid to make a computer play StarCraft II, I would also think it's worth it.

So, what domain do we have in real life that could possibly benefit from this experience ? What domain has constantly changing variables that require the intuition of experience in order to not get blinding by the sheer amount of data and cut to the right solution in as short a time as possible ?

Maybe Wall Street trading, or eventually weather forecasting, but we already have massive computers that handle that (albeit not always very well). Anything else that we humans can do happens at human speed and we're better equipped to handle it than a 3K core cloud computer.

Astroboffins rethink black hole theory after spotting tiny example with its own star buddy

In this case it couldn't be accretion, because there is no reason why would the neutron start stop accreting when it turned into a black hole.

I'm pretty sure nobody is going to scrap existing theory. We'll amend it to fit the new findings.

Just take a look at the carnage on Notepad++'s GitHub: 'Free Uyghur' release sparks spam tsunami by pro-Chinese

"when it is only we and they left standing, we will fight to the death"

And if you think you'll be the winner, you're dead wrong.

China can not only raise a 10 million-strong army, it can also afford to lose it and raise another one.

The US lost a mere 50441 men (no disrepect intended) in Vietnam and the US government almost imploded.

If you intend to fight China to the death, you may as well dig your own grave.

The Feds are building an America-wide face surveillance system – and we're going to court to prove it, says ACLU

"the FBI has a larger database of over 640 million faces"

640 million ? That's almost as much as the entire North and South American continents !

Are there that many terrorists on US soil ? Why are they not apprehended more quickly ? I mean, if 1 in every 2 people are terrorists, either you need to drastically expand your prison infrastructure, or your political base.

Honestly, am I supposed to believe that there are over 200 million terrorists on this planet ? Where does the FBI get that data from ?

Guess who the Co-op Bank chose for £141m outsourcing deal? Can't be. Yes, it's Capita

"testament to a new Capita"

We'll see how long that sentence can stand.

Capita certainly needs a turnaround, just be sure to not do a 360° by mistake.

Boffins blow hot and cold over li-ion battery that can cut leccy car recharging to '10 mins'

"simple but elegant"

And it will still take up to 3 years to get it to the consumer.

And after that, it will take another few years before Apple, Samsung and Huawei avoid having their models burst into flames while recharging.

So, in ten years time, we'll finally have batteries we can recharge in just five minutes - from cars, to phones, to rechargeable AAs.

Looking forward to it then.

Linux kernel is getting more reliable, says Linus Torvalds. Plus: What do you need to do to be him?

An exceptional mind

Simply because he wanted to see if the (at the time) latest Intel CPU could do proper semaphore stuff and other things, this kid (at the time) kickstarted an entire industry that now has a firm majority of all the servers in the world under its reign.

No, he didn't write all of it and yes, it took a lot of people a lot of time to get to this point, but he was the pebble that started the landslide and he is still the God-Emperor, The One Who Decides. And thank God he does.

I don't think we'll be seeing ads in Linux any time soon.

So how well did you block fake news, Google? Facebook? Web goliaths turn in self-assessment homework to Europe

Re: I try to ignore that crap

Use Brave. You won't have to try anymore.

Come on, you can't be serious: Now Australia mulls face-recog tech for p0rno site age checks

You really think so ? Last time I checked, he's still in office.

Re: Optional

Yeah, I got those too. At least one also claimed to have hacked my email as well by including an actual password that I used to use on sites that required a login and I didn't care about it. The wording was actually above par for what is generally written by that kind of scum.

Of course, it didn't impress me for one second. No, you haven't hacked my computer. That means that you have not enabled the camera, since I disabled it in hardware. Even if you had, you can't remove the lens lid and record anything. Also, I have never used that password for my email. And finally, no, there is no clock ticking now that I have read your stupid email. Email does not work like that, and you didn't think of requiring a return receipt so no, you have no way of knowing that I read it.

But I have to admit, the non-tech-savvy population could be impressed by all the verbiage.

Q. Who's triumphantly slamming barn door shut after horse bolted at warp 9? A. NordVPN

Re: I'm torn

As far as I'm concerned, for the home user there is most likely only one use case : viewing videos when your IP is deemed unworthy of being granted the privilege.

What's that, BBC ? You don't want me to check out that short informational video you made on <some subject> ? Fine, I fire up TunnelBear, choose the UK as my exit point, and I can view the video now.

I'm not saying I do it all day long, but it's an available solution to a problem that should not exist in the first place.

Apart from that though, I have no idea why I would want to use a VPN all day long.

WhatsApp slaps app hacker chaps on the rack for booby-trapped chat: NSO Group accused of illegal hacking by Facebook

"strongly encrypted platforms are often used by pedophile rings, drug kingpins and terrorists"

There we go again. Since some bad people use encryption, nobody else should be able to.

Well I have some similar information for you : guns are often used by drug kingpins and terrorists in the course of their criminal activity.

Funnily enough, there is no call to limit the availability of guns.

We need a merry-go-round icon.

UK ads watchdog slaps Amazon for UX dark arts after folk bought Prime subs they didn't want

Well they didn't complain to Amazon, they complained to the ASA, who proceeded to do its job.

Well done there, ASA. Good to see that there are some government functionaries that actually have teeth.

'Earworn Wearables' will save the day (wireless earbuds, but cool name for your D&D halfling)

They call that smart ?

"Tommy Jeans [..] included chips in some of its products that allow the user to track how frequently they're wearing a particular garment"

That is what we are polluting the environment for now ? A chip that can tell you how many times you wore something, wow. Gobsmacking. How utterly useless.

You want to put intelligence in clothes ? Make chips that can tell if the shirt goes with the pants. Make chips that bleep when garish color combinations are being chosen. Make chips that tell you "Alert : clothes tissue is stretching beyond advisable limits - choose larger size".

That would be smart.

Europe's digital identity system needs patching after can_we_trust_this function call ignored

Well, now that you've mentioned it, Johnson is preparing a National Government ID project to tie all different services together and bridge these various ID number issues.

It will be a grand, sweeping project with an initial budget of just £80 million, to be completed in three years. Three years after that, costs will have ballooned to £450 million, and the planned end date will be six years from then. After ten years working on the project, UK Gov will sadly conclude that £935 million were wasted and bin the project.

"a validate() function call [..] was ignored, and the software progressed regardless"

And now the system is patched, and the function call result is no longer ignored, right ?

So all the systems that were put in place and tested based on ignoring the function's result are now going to have to deal with a new, untested scenario : the function returns False. I'm sure they planned for that back then, but how come nobody ever tested a False before ? Because if they had tested the False scenario and found it worked anyway, this bug would have been raised a long time ago.

Once again, improper testing is the source of a bug.

Microsoft welcomes ancient Project app to the 365 family, meaning bleak future for on-prem

"It makes perfect sense for Microsoft"

Of course it does. Bring everything into Azure, tag on subscription plans and watch the Cloud revenue stream gradually replace the OS one as Windows slowly fades into oblivion (ok, veeryyy slowly).

Microsoft is not full of idiots - just the GUI department is.

Move over Ceres! There's a new, smaller dwarf planet in town called Hygiea

"its surface only had two meager craters"

Yeah, well its size is minuscule and it is far, far out there. There's a good chance that most meteorites missed it and went on to hit the Moon - or Jupiter.

Nonetheless, great science !

Median speeds for UK 5G four times faster than 4G, but still way behind US and South Korea

I understand now. Thanks for the clarification.

So you're saying that the SIM can have an effect on the phone's 5G performance ?

How can that be ?

Annoyed by too many kernel testing projects? Good news. Linux Foundation anoints chosen one – KernelCI

Secretive companies

I don't get it. You're doing kernel development, not photo-enhancing software, raytracing optimization or advanced Wall Street financial algorithms. You want your kernel to run on all the hardware ? Then publish your test data and get the bugs fixed.

But that will fix your competitor's bugs ? Um, we're talking about Linux. It's free. You're contributing to the community and making all products better. There is no competition here, there's only the product that best suits the customer's needs.

This is definitely the area in which product is judged on merit, not on price. There is no prejudice in publishing all the details of the bugs so that the community can benefit and solve the problem.

This secrecy mindset is legacy from the time when everything was closed source. The world is changing, get with the program.

Cringe as you read Horrible Histories: UK Banking Sector, sigh as MPs finger cloudy Big 3 as future risk

Re: Which is a bigger worry?

They are both an enormous worry. Once upon a time, the notion of confidential had meaning. Now, apparently, banks have forgotten that and see no more problem in putting customer data on someone else's server.

And if this is the trend, then saying that you won't deal with a bank that uses The Cloud (TM) is not an option because they're all going to be doing it.

Reminds me of a saying with the words 'Hell' and 'handbasket'.