Posts by Pascal Monett

Brit infosec firms urge PM Boris to reform the Computer Misuse Act

Well good luck with that

I sincerely hope that that letter will have some sort of positive impact, but given the UK government's track record on backdooring encryption, I doubt it.

But here's hoping anyway.

As the world secures itself, so do crims: Encrypted malware on the rise, warns Sonicwall

IoT is a plague on security and will stay that way until Joe Schmuck gets his fancy automated house overrun by malware and nothing works any more. Only when his heater in on full in the middle of summer, his doorbell is constantly ringing, his lightbulbs are not lighting up but they are playing the Valkyries at full blast and his security cameras are posting everything on YouTube automatically, only then will he start wondering if all that was a good idea.

Then he'll ask Siri and the Internet will implode.

Migrating an Exchange Server to the Cloud? What could possibly go wrong?

Re: Why are the admin accounts disabled by Exchange?

Well, there are two types of admins : the ones who have the time and resources to do everything right in a secure manner, and the rest who have no time because they are constantly in fire-extinguisher mode because either they are incompetent or they are competent but do not have the resources to their job correctly because IT is a cost center.

In other words, if someone hadn't fucked up with permission security, the guy who fucked up with Exchange would have basically reset the company's IT network.

What a weird way to save the day.

Apple techies analyzing Siri recordings may have heard you unzipping and bonking – plus more

"This means the Windows giant is automatically tipped off [..] about the fledgling malware"

No actually, this means the malware developers are not going to test their stuff against Microsofts monotonic whatever and Microsoft will remain in the dark and their tool be useless.

Does anyone at Microsoft really think that it'll be that simple ? Those malware developers are not skript kiddies, they are intelligent people. I do not see them shrug and decide to put their code into Microsoft's database. If they were testing on an offline computer, it was for a reason : they didn't want Microsoft to find out what they were doing.

Alibaba sketches world's 'fastest' 'open-source' RISC-V processor yet: 16 cores, 64-bit, 2.5GHz, 12nm, out-of-order exec

That is only a threat if you use their seeds.

Monsanto does not have a patent on wheat.

City-obliterating asteroid screamed past Earth the other night – and boffins only clocked it just 26 hours beforehand

Re: A Miss Is As Good As A Mile

I prefer asteroids of any size to pass outside the orbit of the Moon, thank you.

Juniper Networks struggles with service providers as US-China trade war continues to suck

Re: I'm quite surprised, really --

It may be precisely the wrong time, but having spent half a century on this planet, I have the feeling that, whatever governments do, people will survive.

I lived through the petrol crises of the 70s, the bank crises of the 2000s, and we're all still here, living, breathing and consuming.

Yes, it would be nice if major governments had their shit together, but in the end, my opinion is that governments, in general, are just there to ensure that people can continue living their lives.

It is not governments that make the economy, it is people. And, try as they might, governments can only make it more difficult for people to thrive. So the best you can expect from a government is that it does not get in your way. So yeah, the US is fucked, and the UK likely will be soon. But all that is temporary (for certain values of temporary). In the end, the people making the economy go will end up all right.

Or they will be dead. Toss of the coin, really.

Sleeping Tesla driver wonders why his car ploughed into 11 traffic cones on a motorway

Re: "This accident was my fault. I fell asleep at the wheel...."

Honest ? Not quite enough. Yes, he recognizes that he fell asleep, and then blames the car for not stopping.

Sorry bud, you are at the wheel, you are responsible.

Your fancy Tesla has a bunch of stuff to help you, not replace you.

Somebody is working on a $600m data center in Lincoln, Nebraska, could rhyme with schmoogle

Re: 'High-Paying Technical Jobs'

That line caught my eye as well. I would be surprised if there were that many highly-paid people working in data centres. There's the Head Admin, obviously, and one or two of his minions probably, but the rest of the technicians are there for more menial duties (move that rack to room 214) and then there's the cleaning staff and maybe an aircon technician.

I found here a list of Data Center Technician salaries, it goes from $31k to $95k per year. So I guess there can be highly paid people there, but there are logically a lot more low-paid people, like I thought.

Summer vacations put an end to rampant desktop crimewave

"humans remain more effective than machines when it comes to securing digital assets"

Well they certainly are more effective at goofing it up.

As for where my pen is, I see what you did there and look forward to the inevitable rise of that site's popularity.

Our sales were to genuine customers, Autonomy ex-CEO Mike Lynch insists in court

Re: They don't seem to be putting up much evidence to explain why

It might be that they don't have any. It's just that HP is miffed that the golden goose turned out to be a turkey, and they want a scapegoat.

The fact that HP upper management didn't pay attention to the people they had who were saying that it was a bad deal is not pertinent to HP.

It is to everyone else, though.

AWS still a cash machine for Bezos, Intel is down a 5G modem biz, and Google is on Tulsi Gabbard's bad side

"among the most-searched people on Google"

It's okay dear. You never had a chance to be President, but now you get to blame Google for it.

Oh, and Google : you might want to think of incorporating a flag in people's profile if they start running for President of the United States. I'm guessing that their profile generally sees a lot more activity once that fact has gone public.

Backdoors won't weaken your encryption, wails FBI boss. And he's right. They won't – they'll fscking torpedo it

"FBI investigators worked with the app's developers to identify the perpetrators, and [arrest them]"

And you didn't need a backdoor for that, now did you ? You just did actual police work.

Oh, go ahead and implement your backdoored encryption. The rest of the world will use proper encryption and everyone will point and laugh at you.

Car crash: Ford writes down $181m in Pivotal stock as investors claim cloud biz still can't do Kubernetes properly

Hang on

"[Pivotal] failed to disclose to investors: (1) that the company’s PAS [Pivotal Application Service] product was not compatible with the industry-standard Kubernetes platform;"

So you invest in a cloud services company and you do not check that it is Kubernetes-compatible beforehand ?

Are you HP or what ?

Rise of the Machines hair-raiser: The day IBM's Dot Matrix turned

I had the reverse situation

As consultant I have seen all types in the past thirty years, but one I will always remember. She was a gorgeous young blonde, really strikingly beautiful, and I immediately understood on entering that company that she deemed me beneath any effort to interact with. She ignored me royally for the two weeks of my intervention, until one day near the end when, surprise, surprise, she came over to me with her nicest smile and asked me if I could change something in her mailbox.

Unfortunately for her, it was something that was not possible to do, and I was happy inside that I had to tell her it couldn't be done.

Obviously, she never looked at me again.

Airbus A350 software bug forces airlines to turn planes off and on every 149 hours

Re: "albeit with some more ground time and financial loss"

Financial loss ? Well you're obviously not in charge of an airline, that's for sure.

Airlines are already running close to red, they really can't afford to just go around losing more money.

Honestly, given how difficult it apparently is to operate an airline, I'm surprised they don't just give up and quit. There must be more money in it than I think.

Re: Windows 98 ?

I have never seen a Windows 98 that managed to last a week, let alone 49 days.

XP SP3 was much better behaved, but it still had trouble getting through a month in a single stretch.

Very difficult ? Nah. Very eventful, though.

Hey, Windows Insiders! Sorry about that whole 20H1 build thing. Won't happen again – honest

Re: Nothing new

You should most definitely not run 2 different AV packages on the same PC.

If at first you don't succeed, Fold? Nope. Samsung redesigns bendy screen for fresh launch in September

$1,980 ?!?

For that price I can get a top-of-the-line laptop that has much more computing oomph and a much bigger screen.

Two grand for a phone with delusions of grandeur. I just wish for a phone that can allow me to actually talk to someone and send text messages easily, maybe with attachments, and receive the same. With a battery life that exceeds the attention span of my cat.

Virgin Media promises speeds of 1Gpbs to 15 million homes – all without full fibre

"speeds of 1Gbps"

Um sorry, that would be "speeds of up to 1Gbps".

There, FTFY.

Huawei is planning to inject $436m into Arm-based server silicon

"the company presents a national security risk"

Bollocks. As far as the UK is concerned, this is just as true with Cisco.

In any case, with Huawei one thing is sure : China has attained technological independence from the Western block. It is on track to no longer need anything from us to grow its own IT industry, which means we will now have the chance to witness true competition in the IT space, with products grown in an entirely independent sphere.

Who knows what Chinese inventiveness and ingenuity is going to bring to the computing table of the future ?

Privacy? Watchdogs? Fines? Whatever, nerds, more people than ever are using Facebook and filling its deep coffers

"the settlement shields the company from responsibility"

And who thought that was a good idea ? How is it that someone thought giving FaceBook a blank slate was a good thing ?

When a criminal is caught stealing, he doesn't get forgiven for anything the cops have not yet found.

Disgusting.

Meet the super-speedy white dwarf binary system that's going to grav-wave our world

To think

Imagine the gigantic amount of energy that a stellar mass the size of the Sun has whipping around a twin in less than 10 minutes.

The energy concentrated there must be simply apocalyptic.

Don't press the red b-... Windows Insiders' rings hit by surprise Microsoft emission

"lacking even the internal testing run by Microsoft"

Right, well, given the current quality of Microsoft internal testing I'm not sure they're worse off.

After all, it's the users that do the testing these days. They're just going to be testing a bit earlier than planned.

Ah, Microsoft Quality. Not only do they not test, they don't even control what they're publishing any more.

The future is looking good . . for Linux.

Hi. Sorry, we're still grinding Huawei at this: UK govt once again puts off decision to ban Chinese giant from 5G

"the UK expects a new prime minister on Tuesday"

I was under the impression that the UK is expecting a new Prime Fuckwit on Tuesday.

From what I've heard.

Allegedly.

Equifax to world+dog: If we give you this $700m, can you pleeeeease stop suing us about that mega-hack thing?

Re: Passing the loss to the shareholders is fine

I like that idea. Should be simple to implement as well - just instruct Wall Street to down the global value of the shares by the amount of the fine. Shareholders will scream bloody murder and then things will change.

How does UK.gov fsck up IT projects? Let us count the ways

Re: ensuring that the truth is hidden from the Company Directors

Except when it is the Company Director fudging the figures in an attempt to hide the scope of the disaster.

Well, you know what they say

There's never time to do it right, but there's always time to do it over.

It's 2019 and you can still pwn an iPhone with a website: Apple patches up iOS, Mac bugs in July security hole dump

Re: Who’s worse?

From a ROI point of view, it is far less efficient to spend time crafting an attack for 5% of the market than it is for 95%.

Now that Apple has upped its market share, it is becoming a better attack surface from that point of view.

If I decide to try to scam Bill Gates out of a billion, I am going to spend years of effort to get to know him, his family, his house and his habits, and it will cost me a small fortune for no guaranteed return.

On the other hand, if I craft a threatening letter over torrenting or somesuch, hire a spammer and split the proceeds for an attack of 10 million people, I'll likely cover my costs and reap a nice bundle, while likely staying out of reach of the law.

If I were such a criminal, what do you think I would prefer ?

Silly money: Before you chuck your chequebook away, triple-check that super-handy digital coin

"The age of digital money has arrived"

Um, sorry, no. Digital money has been around for quite a while already and was invented by bankers. Cash represents a laughable percentage of all money that is in circulation and a minuscule part of my monthly spend. My VISA is by far the greater part of my spending methods.

The age of funny money has arrived, and it is funny right up to the point where the exchange that has yours folds in a puff of smoke, leaving you with nothing. It's funny to stuff it to The Man until you realize that when you try to purchase something, you're likely to pay more in fees than the value of what you bought. It's funny until you see the conversion value hit the floor when you bought it for $3000.

Yeah, some people have made it big - invariably they got in early. And some people win the lottery. The lottery is more reliable.

Bankers have no reason to be scared of this kerfluffle. There's a dozen cryptoshenanigans available now and no economy is going to collapse because of that. Bankers have other things to do, as in respect their charter and keep track of all the money.

The day I will feel threatened by cryptostupidity is the day Goldman-Sachs puts out its own. But why would it ? It already has all the money.

Marketing biz bares folks' data in the act of asking for their GDPR comms preferences

Here we go again

"we are an organisation that takes data protection and privacy with the utmost seriousness"

Except when you don't, like when you set up a URL to specifically contain person-identifying data and not a single nitwit in your organization wakes up and says "hey, should we really be doing that ?"

But go ahead and trot out that threadbare carpet with the "we take your security seriously" embroidered on. It's not like that already hasn't been used to the bone, right ?

Palo Alto gateway security alert, FSB hack, scourge of data-stealing web plugins, and more

Death Wish, the new version

I sure hope those guys at 0v1ru$ are not based in Russia or thereabouts. That contractor will never be heard of again, and if those hackers are not on another continent, I think they are going to have to learn to live while looking over their shoulders for the rest of their lives.

The CIA, the DoD, the FBI, they can impress you, but the FSB is going to send a team to kill you. After interrogation. Painful interrogation.

It's a facial-recognition bonanza: Oakland bans it, activists track it, and pics taken from dating-site OkCupid feed it

Hallelujia

"If we allow this dangerous biometric spying to spread and become ubiquitous, it won't be used to keep us safe – it will be used to control us"

Finally, someone with a smidgen of authority says out loud what everyone is thinking. And why is it that we suddenly have this rash of facial recognition in cities that have no history of terrorism ? Since when has Oakland been a hotbed of terrorist activity ?

I could eventually accept that New York try facial recognition, it unfortunately has a history of terrorism. But California ? Give me a break. The only reason cities other than New York or Washington D.C. want to try facial recognition is have that feeling of power over the people.

Except that, it doesn't work. Which calls into question all those reports about how airports are delighted with it. How can they make it work when entire cities can't ? Something's fishy in the land of surveillance cameras.

When you play the game of Big Spendy Thrones, nobody wins – your crap chair just goes missing

"disk drives the size of top-loading washing machines"

I worked with those once, way back at the beginning of my career. I was an operator on a Bull DPS-7. I can tell you one thing : when the heads on those babies crash, you do not need the console to tell you.

When Harry met celly: NSA hoarder thrown in the clink for 9 years – after taking classified work home for decades

Apparently, a guy named Bubba.

Re: NSA security procedures?

I found this article about him and it states that he was a naval officer with access to classified data. So the fact that he got access is clear now, but it would have been nice to put that in the article.

And, as he was an officer, decorated no less, I guess it would be pretty standard for him to come and leave with a briefcase or something, making it look official. So there might be an explanation.

Now someone please explain how is it that the NSA, an organization devoted to the security of the nation, apparently has security procedures that rival that of the Flintstones.

I'm a consultant as well, and I regularly walk into the IT departments of banks, insurance companies and other large organizations. I can swear that, not only am I not walking out with any document whatsoever, I am certainly not plugging in USB keys. So banks and such are more secure than the NSA. My mind is boggled.

Enjoying that 25Mbps internet speed, America? Oh, it's just 6Mbps? And you're unhappy? Can't imagine why

Yup, but only in places where the phones lines are not made of string and plastic cups.

British ISPs throw in the towel, give up sending out toothless copyright infringement warnings

Entertainment is a problem

My personal opinion on this problem is that, on the one hand, people definitely deserve to be paid for their work, but on the other hand, I fail to see why I, having paid for a film on DVD, should be subject to an unskippable FBI warning on piracy every time I want to watch a film. I paid for it, so get that shit out of my way.

I also care very little for the often unskippable film previews that are frankly ridiculous five years later. And, if I had it my way, I would force all studio logos to appear on screen at the same time, and they would be limited to 15 seconds max. Deal with it, Lionsgate, Dreamcast and the rest. Do you really think I bought the film because you made it ? No, I bought the film because I wanted that film. Who made is anecdotal.

So I buy a film on DVD, then I go to torrent sites and find a ripped version without all the bullshit and I watch that. It's a much more pleasant experience.

You totally need VMs to do AI, nods VMware as Bitfusion dissolves in its vSphere of influence

"VMware seems to be set on acquiring [..] capabilities, rather than building them in-house"

Well, it worked (somewhat) for Microsoft, so ?

Apollo 11 @ 50: The long shadow of the flag

Apollo 11 _was_ NASA's greatest achievement

But landing on a comet was fucking impressive as well, not to mention a great advance for Science.

All of the Voyager stuff has brought - and is still bringing in - indispensable information that increases our knowledge of our Solar System and of the Universe in general.

NASA can be proud of many things, and can regret some decisions, but for the sheer exhilaration of daring and success, nothing will beat the Apollo program before a long time.

Excluding Huawei from UK's 5G will harm security, MPs warn

Re: Impossible request!

The decision has been made by the White House, it is useless to discuss the situation any further.

Cloud makes it rain for Microsoft: IT giant turns green with Azure, cash poured all over investors

All is well then

Wall Street was expecting a record year, it got a bit more of a record year, so everything is fine. Cloud is justified, using customers as beta testers is justified, telemetry is not a problem, the sky is bright and blue and everyone is happy.

Now, if Microsoft had managed "only" $123bn, then it would have been doom and gloom and the share price would have dropped, right? Because they would have missed the mark by barely one per cent while still raking in the dough by the supertanker.

Stupid Wall Street analysts.

We don't mean to poo-poo this, but... The Internet of S**t has literally arrived thanks to Pampers smart diapers

Re: Where does the data go

Well there's an app, isn't there ? You can be sure the app is not just there to display notifications and show nice charts. It's going to need access to your GPS, your contacts, your camera, your storage and your WiFi password as well. Which will be stored on Pamper's AWS storage bucket (which just might not have default password access).

For your security, of course.

npm uninstall co-founder --global: Laurie Voss rides off into the sunset waving goodbye

"Laurie was the brains and the conscience of NPM"

And he is now gone. The new NPM is going to demonstrate just how well it's CEO understands capitalism.

I'm expecting that to be no better than his understanding of staff management.

It's never good when 'Magecart' and 'bulletproof' appear in the same sentence, but here we are

"the storage bucket [..] was left facing the public internet with no security protections"

Well then, it seems to me that the problem is not actually Magecart.

You can hardly complain about being robbed when you leave the front door wide open. Of course, this problem exists because everything Internet is made to be as simple as possible. Create your web site in one click ! The goal is get people to subscribe, not to ensure they do so securely. And people are not security-minded, not to mention that many, if not most, have no idea what they are supposed to pay attention to.

It should be easy to prevent any web site from going live as long as the passwords are still default, but hey, that would be bothering the customer and we can't have that, now can we ?

So we have Magecart instead.

The pro-privacy Browser Act has re-appeared in US Congress. But why does everyone except right-wing trolls hate it?

Re: making people click a lot of pop-ups

I'm not clicking more pop-ups now than I was before GDPR, so I don't get your point..

Let's be clear : nothing in the bill is forcing pop-up notices on users. It is the ad companies who are going to use pop-up notices to try and get consent. Because they cannot simply go with no consent by default, and if someone changes their profile to accept, then gather details.

That would be a privacy-respecting, adult way of doing things. It would also not bring in any money.

So, pop-ups it is.

Arrested development: Cops dump Amazon's facial-recognition API after struggling to make the thing work properly

So, to sum it up

For starters, there's the problem of incompatible equipment. Then there's the bandwidth issues, which is kind of surprising. The there's the random disconnects, which, given the bandwidth issues, is understandable. Finally, you have a backend that the police force is not qualified to run, which is hardly surprising (I doubt they have many statisticians in uniform).

In other words, the whole thing was a fiasco from the start. It's nice to know that Rekognition can apparently only handle one camera at a time, and is very picky on the camera it can connect with. Good.

All in all, I am quite pleased with the results of this project.