Posts by Pascal Monett

Russia-backed crew's latest malware has discerning taste – when screening visitors to poisoned watering holes

"the C&C [command-and-control] server replies with a piece of JavaScript code"

Which is blocked by NoScript.

Again, NoScript to the rescue. Frankly, NoScript should be considered as a must-have, receive a Public Utility Award as well as a Keeping The Internet Safe Award, and be enshrined as a tool that defends Democracy and Privacy.

Oh, and somebody give its author a million bucks. He deserves it.

Meanwhile, a Flash Update ? Really ? And "high interest" people fall for that ?

I wonder what the malware guys will do when Flash has been eradicated from the Internet. Are they going to try to push YouTube updates ?

Resellers facing 'months' of delays for orders to be fulfilled. IT gathers dust on docks as coronavirus-stricken China goes back to work

Just an FYI

The WHO Situation Report 51 states that there are, as of yesterday, 118 322 confirmed cases, and 4 292 deaths worldwide.

That is a mortality rate of 3.6%.

Not 1%.

Not 0.1%.

I thought it might be useful to say that, because there are some people out there who still think that COVID-19 is nothing more than the common cold.

It isn't.

Oh, and by the way, it's not getting better. The sitrep from a month ago had 2 560 new cases to report. Yesterday, there were 4 623 new cases. That's over 50% more new cases.

In one month.

US telcos tossed yet another extension to keep going with Huawei kit despite America's 'security threat' concerns

Re: There is as yet no hard evidence of Huawei malfeasance

And there never will be, because if there actually was some hard evidence, someone would have leaked it by now. A motherboard is not a state secret, and there is enough Huawei hardware all over the world that, if someone had actually spotted something truly fishy, it would be all over Twitter in a heartbeat.

This whole thing is simply due to the fact that Huawei is eating Cisco's breakfast, and getting ready to eat Cisco's lunch as well. So the OHSG is doing the only thing he knows : kicking up a stink based on a gigantic lie to try and preserve Cisco's market share.

That's all it is, and that is why Huawei's situation can be "negociated". Because if it were actually true that Huawei equipment was talking to Beijing, you can bet your bottom dollar that its equipment would have already been banned and existing equipment would have been literally torn out by ISP and telcos everywhere.

Boots on Moon? Well, the boot part is right: Audit of NASA's Space Launch System reveals more delays, cost overruns

Re: Hillercopter

A giant helicopter to "catch" a falling rocket stage "in midair". Great idea, that. I'll sure be interested to learn how exactly a helicopter of any size is going to maneuver to get close to the falling rocket stage, wait until it falls below the rotor blades, then reach terminal speed to catch up to the rocket stage and "catch" it, all the while having enough height to not crater the whole thing.

Not to mention that helicopters are rather limited in their cargo capacity. Or that they are rather inherently unstable, and suddenly adding an ungainly, gigantic, non-aerodynamic lump to its mass is not going to help any either.

Edit : okay, parachute. The drawing does not show that, you have to get to the second paragraph before it is mentioned. With a parachute, it just might be feasible, but I'll wager it would still be very dangerous. It's not hard to find videos of helicopters with cargo underneath tipping and crashing, and the cargo isn't a rocket stage either.

Appareils électroniques: Right to repair gets European Commission backing

Hang on a minute there

"It's not just about electronics – packaging, food and construction all get a mention too"

My pizza is single use and I like it that way !

Yelp finally gets its chance to tell US Congress how Google screws its listings service every minute of every day

Re: This is News?

Yes, this is news. Not what Google is doing, but the fact that now Senators are listening.

That is the news.

AI startup accuses Facebook of stealing code designed to speed up machine learning models on ordinary CPUs

"nifty software tricks to achieve similar speeds on CPUs"

That sounds quite impressive, however there is one problem : most of the time, you only have one CPU.

There are motherboards that can work with two CPUs, but they are rather rare. I haven't found any motherboards, including server types, that can have more than two CPU slots. GPUs on the other hand can be slotted in up to four at a time and that, even on rather cheap motherboards.

I'm not convinced that focusing on CPU speed is the best idea - you've got less hardware to work with.

Core blimey, that's edgy: HPE makes a play for next-gen 5G market

"The new core stack will be a cloud native infrastructure"

And cue the world-wide cloudy breakdown in 3 . . 2 . .

Google: You know we said that Chrome tracker contained no personally identifiable info? Yeah, about that...

Just one question

Why is it important for a website I visit to obtain knowledge on my Chrome installation ? I come with a browser, they serve the page, that's the deal. Why is it important that they be notified of any extensions I have ?

If I ever have the chance of meeting someone from Google, before shaking their hand I'm going to ask them the brand and size of their underwear, their shoe size, what deodorant they're wearing and how old their socks are. Let's see how they like that.

The Reg produces exhibit A1: A UK court IT system running Windows XP

"We are in the process of upgrading our courts' computer systems"

Indeed you are, and by 2045 you will probably have finished upgrading your laptops to Windows 7.

Congratulations.

Oh, and I sincerely hope that all your bluster about the security you have means the biggest darn firewall in the country, because if you think you can secure an XP laptop, you're going to be in for big, unpleasant surprise.

The Internet of Things is a security nightmare, latest real-world analysis reveals: Unencrypted traffic, network crossover, vulnerable OSes

Re: But the current government postion is to ban encryption.

Yep. That's going to be an interesting debate the next time we hear of a hospital having been hacked because of lack of encryption.

I wonder how the politicians will spin that ?

Agree totally. I fear that the medical sector is basically screwed. Their IT might have been installed by competent people, but their equipment was installed by the vendor who just needed to get the thing on the network and didn't care about security or firewalls. IT is a process, not a thing, and you need to have the competence on-hand, not a consultant dropping in every now and then.

If anyone can just plug a new thing into the network and there is no authorization to prevent that (I'm talking network authorization, not administrative), then your network will soon be an inextricable hodge-podge of stuff without either overview or oversight.

Then you have the problem that medical staff need to have access to all that eminently personal data to do their jobs, and they simply can't spend all day entering passwords or shoving tokens onto readers. They need free access to the data and if they have it, then an attacker can easily get to it as well.

Add to that the lack of money to upgrade anything and I really don't see how this will end other than in tears.

There's gold in your biz's processes and mining them is the future, says bloke behind topic's first practical guide

"[using] analytics and AI on application log data"

Well that sounds interesting and I'm sure that it can help a lot, but only where there is a log. MS Office does not have a log. Outlook does not have a log (Exchange can, but not Outlook). So it looks to me that stuff that is logged concerns mainly networking and servers, not endpoint applications. I'd like to know how the AI statistical analysis machine can help make more efficient processes if it has no log to analyze on what people are doing in their Excel spreadsheets.

Because they are using Excel. A lot.

Four months, $1bn... and ICANN still hasn’t decided whether to approve .org sale with just 11 days left to go

"get this wrong, and there is no reason for ICANN to exist"

Oh boy, if only. I can but smirk when I hear of trust in ICANN, and in its model. If you're talking about the way it should have been, the spirit of its inception, then maybe, but if you're talking about what it has become as "model", then it should be purged with flame and the Earth on which it stands salted so nothing can ever grow again.

House of Lords push internet legend on greater openness and transparency from Google. Nope, says Vint Cerf

Trust Google, yeah, sure

Saying that something is complex is not a reason to not show it. That is just a smokescreen of an excuse.

It is obvious that Cerf was not there to answer questions, he was there to deflect, buy time, and try to quell this outrageous uprising of petty lawmakers. Unlike Zuckerberg, Cerf actually went before officials, but just like Zuckerberg, he remained steadfast and blocked any attempt to get anything.

Finally, Vint, just because you have a near-monopoly does not necessarily mean that you are "doing something right". The Nazis had conquered all of Europe at one point, do you mean to say that they were also "doing something right" ?

UK.gov sits down with mobile big four to formalise plans for rural shared 4G network

"The move was also hailed by the heads of the big four"

Well yeah, they're getting a subsidy. Let's see how well they squander that.

Check Point chap: Small firms don't invest in infosec then hope they won't get hacked. Spoiler alert: They get hacked

What the ever-loving frack ?

You need 3 different security firms to ensure you can use Office 365 in peace ? Here's an idea : don't use Office 365. Go back to 2016.

Also, companies that don't have backups today should not be covered by insurance. There is no reason to insure a company that doesn't give a rat's ass about its data. You got ransomed, your data encrypted and you don't have a backup ? Tough. Start over and learn to make backups.

There is no excuse for supporting the lazy incompetents that can't take care of their data.

Spyware maker NSO runs scared from Facebook over WhatsApp hacking charges, fails to show up in court

"NSO no-show in Facebook suit"

It's because of COVID-19. Which means that The Zuck had that virus engineered so as to ensure that the NSO lawyers could not get past border control.

It's Zuckerberg's fault !

P.S. : Hey, why can't I start a conspiracy theory for a change ? I've read about enough of them.

UK.gov is not sharing Brits' medical data among different agencies... but it's having a jolly good think about it

So, basically speaking . .

You're not considering it except you are, so when you say you're not going to do it, it means you will.

We truly are in the 3rd millennium. Now we all have to become experts in doublespeak.

Former US Homeland Security Inspector General accused of stealing govt code and trying to resell it to... the US govt

Re: Quite Right

Well, at his age, that's basically what he's going to get.

Watch this space: Chinese mobe flinger OPPO flexes first shot at the wearables market

Seems like a nice bit of kit

Now what's the word on security and privacy ?

Why is there no mention of that in its specifications ?

Not that I'd want one anyway, but I think it's time that all this tat have basic security concerns addressed in the marketing spiel, not just the tech stuff (even though I'll be the first to admit that tech stuff is by far more interesting, but shh, don't tell anybody).

Axiom signs up with SpaceX to fly private astronauts to the International Space Station

"the primary issues detected during the company's uncrewed Orbital Flight Test"

Primary issues, such as "insufficient testing" ?

I do hope they're going to talk about that.

More than a billion hopelessly vulnerable Android gizmos in the wild that no longer receive security updates – research

Re: Shrugs...

So we should all just forget about it then ?

NordVPN quietly plugged vuln where an HTTP POST request without authentication would return detailed customer data

Or TunnelBear.

'Optional' is the new 'Full' in Windows 10: Microsoft mucks about with diagnostic slurpage levels for Fast Ring Insiders

I'm not planning to upgrade from 7 at all.

7 will be my last Microsoft OS. I've had it, I'm done with Microsoft.

When I do upgrade, it will be for some flavor of Linux. Haven't decided yet, but Mint looks like a likely choice.

In any case, I'll take care of that when I retire in 12 years, then I'll have the time to muck around and find my way.

Until then, it's 7 and that's final.

Or Brave.

Morrisons puts non-essential tech changes on ice as panic-stricken shoppers strip stores

"throughput of goods is in excess of the usual Christmas peak"

Um, calm down ?

The zombie apocalypse is not yet upon us. Wait for a few months until the death toll exceeds a million, then it will be time to panic.

You'll get your money – when this bank has upgraded Windows 7... or bought extended support

Just a question

If the central OS is on the fritz, because of non-renewed support licensing, and given that this is a bank we're talking about, shouldn't the proper response be a pickax to the screen ?

After all, once the screen is done in, and given that the camera depends on the OS and is, therefor, out of order, that might incite the bank to some effort in getting its shit together again, right ?

I won't forget that these are the people who were happy to deal in the tainted sub-primes and then got paid for their troubles when the whole thing tanked.

Fuck them.

Uber takes a downer as ride-sharing app service crashes

I would like an ecological impact study on ordering coffee delivered to my door.

I do think that there is not a single first-world problem that causes more global warming than that.

Turnover down, losses widen and shares crash: So, business as usual at Capita

"our plan is the right one and remains unchanged"

THIS ! IS ! SPARTAAA !

If you're wondering how Brit cops' live suspect-hunting facial-recog is going, it's cruising at 88% false positives

Re: And a damn sight faster - cheaper, too

Cheaper ? Who said it was cheaper ?

Do you have the figures on that ?

Re: "inaccuracy rate of 87.5 per cent"

In any case, I'm quite happy that we now have some hard numbers on this tech. Up to now, all I was hearing was companies waxing lyrical about how efficient their "solution" was. Well now we know : 12.5% efficient.

Less than solar panels.

I wonder, is the Met holding it wrong ?

HMRC claims victory in another IR35 dispute to sting Nationwide contractor for nearly £75k in back taxes

"between 2007 and December 2014"

That's seven years.

Over seven years the company has largely enough time to train somebody in-house, get a knowledge transfer or acquire some expertise and bring it in-house.

A contractor that lasts seven years is basically part of the woodwork. That's exaggerated.

HMRC's approach to the problem is exaggerated as well, but seven years is a hell of a long time to not be part of a company you work at every day of the week.

I've been a contractor for the past 25 years. I go in for a day, for a few days, a week, a few weeks. Rarely, for a few months. In all my career I've had two contracts that lasted around 18 months each. Those were very long contracts and I was glad to see the end of them.

Seven years ? I think I'd go crazy. Hire me already and let's stop pretending.

That being said, it certainly smarts being hit with £75K of back taxes. My sympathy to the guy who just tried to make a living.

Stop us if you've heard this one before: HP Inc rejects Xerox's $36.5bn buyout plan as takeover saga drags on

"the offer remains too low"

Well gosh, whaddya know, being Icahn may just not be enough to clinch a deal after all ?

Despite all your bluster, Carl, it seems that there are experts out there who disagree with your lofty views on how much HP is worth for your enjoyment.

That's gotta sting.

Australia down for scheduled maintenance: No talking to Voyager 2 for 11 months

Re: planes going overhead

I think that commercial airline traffic is located at a comfortable distance from said antennae and thus, that should not be much of an issue.

They don't avoid building radio satellite dishes next to airports for nothing.

Alleged Vault 7 leaker trial finale: Want to know the CIA's password for its top-secret hacking tools? 123ABCdef

"Hollywood is not going to have to adapt"

Dammit, it's now, not not.

I really need to learn to proofread.

"intensely embarrassed by the loss of some of its most valuable weapons"

Actually, the CIA should be more embarrassed by the fact that it didn't have a clue they were stolen in the first place.

Which clearly indicates that they might have been, and some foreign power has acquired them (or maybe more than one).

In the end, this kindergarden-style management of security concerning so-called weapons of state is the most damning indictment of all. Hollywood has a habit of showing the CIA as cool, efficient people. Hollywood is not going to have to adapt to showing them as kids at the lunch canteen throwing yogourt at one another and posting passwords in the hallways.

'Unfixable' boot ROM security flaw in millions of Intel chips could spell 'utter chaos' for DRM, file encryption, etc

And none of this is important

unless the miscreant gains physical access to your PC. And if he gets physical access, it's game over anyway.

Well, thank you for yet another method to cause chaos if some goon gets to my keyboard. I'm thrilled to know that there is yet another way he can trouble. Apart, obviously, from just ripping out the hard disk and chucking it into an external reader under a different platform allowing him to read everything.

I'll file this under Hollywood Apocalypse Scenario #4622.

Can you hear me now? Roadtesting Anker's first Bluetooth speakerphone

I have to admit, this thing sounds good

I have no use for such product at this time, but I will keep it mind for the future. No telling when it may come in handy in building a multi-national company environment.

After 16 years of hype, graphene finally delivers on its promise – with a cosmetic face mask

He must have been quite relieved to be on his way to Manchester and not still being grilled by maniacs.

A bit unfairly ? I think it is quite unfair to ask an engineer why the Government is doing something. That smacks of gratuitous put-down and I would have thought that there would be a smidgen of enough intelligence in a room full of Engineers to avoid that kind of pettiness.

Goes to show that education and intelligence are still two different things.

Re: Manufacturing?

Don't forget that, in cosmetics, it's like homeopathy : you just need one molecule of the stuff in the bottle to claim that said product contains that molecule.

Actually, that would mean that cosmetics are still marginally more honest than homeopathy.

Absolutely. The sentence is exactly as nebulous and empty as it needs to be while still making the clueless believe that there is meaning in it.

So, your beauty products have graphene ? I'm thrilled, but do they have Bucky balls ? No ? I need the additional bounce of Bucky balls.

Sarcasm aside, chalk up another CEO and entire company on my black list. He is clearly just in it for the money, and it is impossible for me to imagine that anybody in that company is not in the same mindset.

Hackers? Leap day? Nope, just plain old internet hysteria took down stock-trading-for-noobs app RobinHood

Good point. At least, until I went and read about the Dark Web, and found this site which states that "The dark web is a part of the internet that isn't indexed by search engines ".

It's still a part of the internet, therefor it is taken into account by DNS servers.

But your take on this is still plausible - maybe they want to limit the amount of visible DNS requests by handling it themselves.

Why do they need their own DNS ?

They're dealing with people over the Internet, which already has DNS available. What's the point of creating their own DNS server ?

How is that supposed to help them manage their customers (it didn't) ?

Sadly, the web has brought a whole new meaning to the phrase 'nothing is true; everything is permitted'

"...could I borrow $60 (US) via PayPal..."

Well sure, if you can explain how you'll get to it if you no longer have a phone or a laptop . . .

And, while you're at it, explain how you are using Skype at a hotel. They don't provide laptops now, do they ?

Most scams are rather easy to detect if you just use a bit of logic. You're not locked out because of 2FA, you're locked out because your stuff got stolen. What good is it that I send you money via PayPal if you can't get to it ?

Take me for a fool, why don't you ?

Fella accused of ripping off Cisco, Amazon, iRobot, others to the tune of $2m by fraudulently demanding replacements for tech gear

"more than four times the proceeds of the alleged crime spree"

Meanwhile, telcos get caught selling your information and they get what ? Certainly not a fine four times the amount of what they made.

Sure, this guy is a scumbag and, at only 23 years of age, it's frightening to think what he could become.

But come on, 800+ years and he didn't even kill anybody ? The system is crazy.

And yes, I know that this is just the count of all the indictments and he doesn't risk getting 800 years. It's still nuts though.

Oracle staffers in Europe weather cloudy job cuts: As many as 1,300 workers face chop after sales slide

"talking about aggressive hiring"

And now they're talking about rebalancing spending to revenue. It's not 'agressive layoffs', oh no dear, that wouldn't sound pretty.

As far as headcount is concerned, Oracle seems to be on a bit of a roller coaster at this time. But as far as aggressiveness is concerned, Oracle is only on the High setting.

It seems that strong-arming your customers into accepting a Cloud license doesn't really work, eh, Larry ?

If Tesco was prodded and probed by hackers, your data could be being flogged for just £2.70 – research

Wait a minute

"For less than £750 criminals can access not only your bank details, but online shopping, social media and email information too"

Well, okay, but criminals are generally intent on making money, not spending it. If they have to outlay some expenses beforehand, it has to mean that they intend to make a lot of money off your life, and even if there are quite a few millionaires around, there isn't one in every town. So the criminals are going to have to filter out the poor to get to the profiles that are actually interesting to plunder. At £750 a pop, it's an expensive undertaking.

UK.gov lays out COVID-19 guidance as the tech supply chain considers its own

Well I have to admit that I would find quinque sex raather distracting as well.

As Australia is gripped by bog roll shortage, tabloid says: Here, fill your dunny with us

Nice marketing move, though

It sure is a great idea from a selling viewpoint, however usage of such paper is best suited to bears-in-the-forest activity and not, as outlined in the article, as actual toilet paper to be flushed.

Now, as a follow-up, I'd like to know what customers actually thought of the experience.

Mine's the one with the 4-ply bog roll in the pocket.