Posts by Pascal Monett 19433 publicly visible posts • joined 10 Apr 2007
What I will never understand is how someone can set up an AWS account and not think of locking it down from public access.
You're putting data on the Internet, don't you realize that ? It doesn't matter what kind of data it is, lock it down tighter than a gnat's arse. If somebody with actual authority complains, you can always relax it a little in his favor.
Better safe than sorry, right ?
And there we go, minions in power disregard the law and set their own criteria.
That is exactly where the USA has gone wrong : letting minor government officials reign supreme without any recourse. That is exactly how a corrupt regime displays itself.
If the limit is $220 000, you little scribbler have no authority to decide that it is suddenly $1 million in a specific case.
But they did it, and nobody can complain about it.
And you still call yourself a democracy ?
Well duh. Given how difficult it is for Microsoft to get its own code right, I wouldn't take any MS certification to mean vuln-free.
Certified by Microsoft simply means they ran it once on a machine and that machine didn't crash inside of 15 minutes.
Um, what makes you say that due process was lacking ? I don't remember reading that the FBI jumped to conclusions or arrested the wrong people.
The fact that the FBI is not making its tracking procedure public does not mean that the judge isn't aware of how it was done, I'm sure the FBI explained everything to the judge behind sealed doors.
The use of that term indicates to me that security is not the primary goal of all this hoopla. Indeed, if it's security that is the issue, then I think LetsEncrypt is doing it right : you got a cert valid for 90 days that can autorenew for free.
If LetsEncrypt can do that, then why can't DigiCert and the rest of them ? Because they're in it for the money, security is just the cow they milk.
So here's your solution, DigiCert : go for 90 days auto-renewable, and turn your hefty fee into a yearly subscription without changing the cost to companies. You get your money, web sites get their certs, companies do not pay more, everyone is happy.
Except your Board, of course, who would have wanted to charge the yearly subscription to the 90-day charge, but you can go screw yourselves.
I checked out the site and, apart from blurb assuring how good they are, it is quite light on technical details.
From what I understand, you prove your identity to AgeChecked by " a range of options" (not telling, though), and then AgeChecked vouches for your ID and age to other sites who ask them - for a fee, of course.
The complete lack of technical details make this look like a racket to get money with minimal expense.
It's because of users. Always has been, always will be.
You can design the perfect security for a house, if the owner forgets to shut the door, it's screwed.
And if you mandate vise-level security, the user will just go somewhere else.
It is quite hopeless, but removing a valuable indicator just because 85% don't pay attention means that the 15% that do will have to do without.
That's sad.
And you do have a thing against all those bloody immigrants, right ?
Well they're leaving too. You should be happy.
Ah, but you hadn't thought of that ? Well, looks like we're going to spend quite some time discovering all the things you hadn't thought of, as well as their consequences.
Frankly I am appalled that the Navy got a touchscreen-based steering function installed. You'd think they, of all people, would want to ensure that they could control their ships in all conditions, even if the windows broke in a heavy storm, for example. But no, they went ahead and created something touchpad-based for a crucial function of the vessel and got bit in the ass for it.
Well, at least that's one mistake they'll not make again for long while.
Just out of curiosity, why is it the NHS should be the one to invest in this tech ? Shouldn't some other university or research organization front the costs, trial the thing, prove it works and then the NHS buys the solution ?
I mean sure, I'm all for improving cancer diagnostic and treatment, but the NHS doesn't really have the means to do the research part, does it ?
Um, you're bringing that back in-house, right ? And who was the genius who thought to put that in The Cloud (TM) in the first place ? And how many numbskulls signed off on that ?
I can't believe you'd be stupid enough to imagine basing an industrial process on a server that is not on-site. You want to throw your accounting to the wind ? Go ahead, you'll only have to re-enter it if when it goes pear-shaped. If your connection to the server goes down, the entire company is not blocked.
But basing a mission-critical component of your company on the vagaries of a data line and the uncertainty of someone else's server is just insane.
Here I was thinking that GDPR was the bee's knees and I find that someone else can request details on me ? I'd never thought of that. Now that I'm thinking of that, I don't like it one bit.
That being said, this guy lives in America. It doesn't say where he sent his requests, but I'm guessing it was mostly to American companies. In Europe, you wouldn't get far with banks because, in order to make any changes, you have to either do it via your online banking account or, most often, you have to present yourself in person with a valid ID at the desk. So I'm of the opinion that European banks would be a lot less likely to fall into this kind of trap. But for the rest of companies, I don't see that my side of the pond would be any different.
With one notable exception : there is no mere company that has anyone's Social Security number. You'd have to try the Administration for that, and I have no idea how that would work out.
Honestly I don't see that the battery pack for Tesla cars is in the same ballpark as mobile phones or even regular car batteries. The battery pack for a Tesla is a huge lot of cells and no one man can lug that around or replace it. The fact that you can only have it replaced by Tesla is, at the moment, logical.
In a future where all cars have such packs, then it will be normal to expect any dealer to be able to handle changing the pack, but you'll still have to go to a dealership to get it done.
Finally, someone with indisputable authority confirms what I've always been saying on the subject : paper for ballots. How unfortunate that this is happening in the USA, where corrupt people hold the keys to change. It is crazy to witness a group of people so openly corrupt and contemptuous of the rules of their own country, and nothing can be done about it.
Well, not until the next election, that is. Which will be held via electronic voting boxes. How curious would it be if Trump got re-elected in a landslide, hmm ? Like, 90% of the votes. I wonder what people would think about that ?
It's an app for threesomes a dating app, of course it has an open backdoor.
There, FTFY.
But seriously, how can anyone trust dating apps these days ? Made by two jerks in a garage, most of those things are just an excuse to make money out of people's loneliness. Don't use them, just go to a pub.
That may be the recommendation, but in my last home I had a 12Mbps ADSL line that was rather good and stable, and I hated watching TV over it so much that I installed a satellite dish. You couldn't watch half an hour of anything without getting a frame freeze with the sound continuing merrily behind (sound costs nothing next to image, so obviously) that could last from a blink to a full second. And that was before HD streaming. Very jarring.
Today I finally have a 1Gbps fiber line to the house, and it's paradise. Now I can watch TV over that line and not have any image freeze or stutter. At the same time I can also have Torrent downloading the latest Mint release, my daughter on YouTube and my wife on Pinterest, and nobody complains. So yeah, now things are fine. But watching HD TV over an ADSL connection ? I tried that and I never want to try it again.
EDIT : the link to the article in the footnote is broken.
Good for the competition and all that, and apparently good for innovation. AMD has led in the past on important things, and now Intel is following yet again on multi-chip cores. Personally I'm not following CPU innovation that closely any more, but if AMD can shake things up I'm all for it.
I did note one thing though : "Twitter is able to run 40 per cent more cores per rack (from 1240 to 1792) while maintaining the same power and cooling".
To me that means that Twitter is running more cores, and not using AMD's Epyc to diminish its power and cooling costs. That, in turn, means that Twitter needs that much more CPU power to handle all those 200+ character size tweets that are flooding the Internet.
That is a frightening thought.
"samples awaiting playback and analysis, which are, apparently, scrubbed of any information that could identify those recorded"
And those samples have been scrubbed by what again ? A human, obviously. So I'm thrilled that MS employs someone to scrub the samples it submits to translators, and I understand that there isn't really other way to do it since machines have to be taught. I'm guessing MS is counting on the fact that everyone should know that only humans can possibly train a machine to translate, so it'll play dumb and run behind the EULA when confronted on this.
I take this as a storm in a teacup. Politicians are going to go ballistic over this ? Don't think so. MS has a rather solid position from a legal standpoint, so you can try to raise a stink, but unless the users react negatively, it won't go very far.
And the users don't care. They're buying and using stuff that they know listens to them and they don't give a damn until it goes "wrong" from their point of view. And even then, they don't send it back.
It has enough trouble with consultants hoarding secret information, using unregistered copies of MS Office and not paying attention to Internet-facing servers with tons of juicy exploits on them, not to mention so-called "security personnel" who apparently let people leave with reams of top secret documents without batting an eye.
With all that, it does not need potheads who could be bribed or coerced into revealing yet more information to The Wrong People (TM).
Yeah ? Well we're disappointed in Boeing's irresponsible and unprofessional handling of its code. You leave part of the software platform on an Internet-facing repository and you didn't think of locking that down ? This after designing functionality that can change the attitude of plane based on only a single sensor ?
Something is seriously wrong with Boeing these days. It used to be a company whose engineers had the word "security" practically branded into their foreheads. Seems that, today, it is yet another company taken over by beancounters for whom all that security nonsense costs too much money. Well, this is the result of that mentality.
Um, game streaming is, if I'm not mistaken, integrated by default into a lot of games these days, and there is an order of magnitude more channels on YouTube that are all about showing what players are doing on a multitude of games.
So, crazy as it sounds, I do think there is a use case for game streaming. The only problem is choosing to uphold streaming for the popular games. Well, if you want to monetize it, that is, and since we're talking about the Cloud, of course they want to monetize it.
So, the question is not "will game streaming work for the mass market" ? It already is. The real question is : "can we make money out of it ?".
"it allows big employers to effectively ignore EU-mandated trade unions when sacking large numbers of staff"
Congratulations on having finally understood the point. As for those who consider that this gets rid of some "remaniac" issues, I'd love to see your face when you're the one getting the sack without recourse.
I think it's awesome that somebody finally did this. We've all been hearing about hash checks for decades, but this is finally going to make it part of standard checking automatically - or as near as possible.
Sure, there's always a risk, but that does not diminish the value of this tool.
In those days, he was a bit lucky that everything came back online correctly.
On the other hand, having a sticker with the name of the server would have helped as well. Hindsight and all that.
Of course, in today's virtualized server centers, the sticker could name quite a lot of servers, but then you can put the name of the physical machine.
In any case, stickers with names on it. It's the only way to maximize the chances of avoiding such errors.
It never did make any sense, except to Microsoft.
We are here today because Microsoft couldn't be arsed to bring itself to respect web standards, and now it's coming back to bite its ass.
About time too. No sympathy for the poor, poor managers at Microsoft who have to juggle with all the legacy leprosy that is IE while trying desperately to pull MS into the 3rd millennium. There is only one solution : burn it down. Cut the limb off. Protect the rest of the body.
Completely agree. It is a sad indicator of the state of our Internet that so-called "experts" are only wondering. We've been hearing for years that you shouldn't re-use passwords, so the conclusion seems pretty inescapable if you have the slightest amount of logic.
That said, password managers. Yes, definitely use one, but not necessarily a commercial product. After all, for accessing your Internet web sites from home, a notepad (with actual paper, not the Microsoft product) is largely sufficient and not at all hackable from the Internet. And before some of you attack me about having to access your passwords from multiple locations, not all of Internet users are such power users. Most people use the Internet from their home computer and that's it.
A notepad is enough for that. Oh, and a sense of organization.
Well, to be fair, it appears to be disk status reports, not what you do with your files.
It is, however, just another example of a company choosing to do what it wants with your bandwidth "with the best of intentions" and "to improve customer service" because it can, without wondering if it has the right.
I think that we should start invoicing our bandwidth under default terms, as in €100/month flat rate, for unauthorized usage of our bandwidth. That would probably set things straight pretty quick.
