Posts by Pascal Monett

Just how rigged is America's broadband world? A deep dive into one US city reveals all

Re: When I read articles like this...

Because 640K is enough for everyone, right ?

Re: Choice

Actually, it's more like 30 identical versions of the same breakfast cereal made by the same company under 30 different brands.

Because companies use branding the same way you and I use disposable mail addresses.

Muslim American woman sues US border cops: Gimme back my seized iPhone's data!

Re: Entering a country becomes more and more like entering a prison.

Do not confuse entering the USA and entering any other country.

Practically every single democratic country in the world is quite polite and somewhat subdued in its border controls - the USA is the only one I have ever been to to be so stuck-up and openly paranoid about visitors.

And yet, they still come.

Back to school soon – for script kiddies as well as normal kids. Hackers peddle cybercrime e-classes via Telegram

Okay, so where are law enforcement students ?

What should be done is that law enforcement should have some personnel sign up to these courses and learn the techniques.

Shouldn't be difficult and I don't see the crooks doing any reputation checks from their home base.

Once we have officers fully trained and up to speed (because $1,100 for 40 days seems a pretty good deal to me), then our Cybercrime units will know what to look for and how to fight it.

If that isn't being done, then our governments are even stupider than I thought - which, of course, is quite possible.

Teardown chaps strip away magic from Magic Leap's nerd goggles

@ detritus

Apparently I wasn't clear enough. I did not wish to draw any parallel between Google Glass and Magic Leap. What I wanted to point out is that Google's enormous resources were behind Glass and it tanked - due to social pressure as has been pointed out.

Magic Leap does not have Google's means, and it is disappointing people right out of the gate.

That does not bode well for the future of its little toy, especially, again - as has been pointed out, with ML's past as a swindler now public for all to see.

So it's not that magical now that it's real ? Shocking, innit ?

I'm sure that Reg readers were pretty much expecting this turn of events. Seems that the promotional videos were lies after all. No surprise there.

So it's a bum ride for over $2K. Google Glass was less expensive, and Google was behind it - it tanked anyway.

I predict the same future for this ex-Magic Not-such-a-Leap.

Facebook pulls 'snoopy' Onavo VPN from Apple's App Store after falling foul of rules

When will people understand that anything related to FaceBook has only one job, which is reporting everything to FaceBook ?

UK's info commish is having a howler: Site dies amid 'plagiarised' GDPR book scandal

"what criteria was used to make the claim that it was 'authoritative' "

She told her ghostwriter to be sure everything was factual, so she asserted to herself that the book was authoritative, as one would.

And it looked good in the foreward, didn't it ?

IBM slaps patent on coffee-delivering drones that can read your MIND

"if I see someone of high status drinking coffee, I'll want coffee too"

Um, no. I don't drink coffee. Ever. Not interested.

I respond quite politely when offered, but the answer is always no thank you.

And forgive if someone "of high status" having something I don't does not make my brain go into dumb mode and want the same thing.

US Democrats call in Feds: There's something phishy going on with our voter database

"This fake website was spam-vertised using bogus emails"

What is it about the human mind that pushes people to a) blindly accept what a completely unknown person sends them, and b) click on a link that they haven't the faintest idea where it will end up.

Especially at work.

Okay, this time it was a test. Fine. There will be a next time. And a next.

Until we all, collectively, understand that if someone you don't know sends you a mail, the only proper thing that can be in that mail is either a request for information or an introduction from a work colleague that has just taken his post, so you know you'll be working with him.

And you should check to be sure.

Anything else is spam and should just be binned.

The only person who can legitimately send you a URL is someone you already know. And that person had better have a good reason.

Redis has a license to kill: Open-source database maker takes some code proprietary

Whoosh !

My point is : nobody pays you dividends for Open Source code.

Yes, I know full well that people get paid to contribute. Good for them, and good for Open Source in general.

But their right to remuneration stops when the code is published. What is done with the code afterwards does not generate a right to get paid.

That was my point.

You're welcome.

I do not understand

Well I do, Redis wants a cut of the pie its code helped create. But when you contribute to an open-source project, you do so knowing full well that you're not going to get paid for that.

You are giving the code to the world for the betterment of everyone.

Now some of these code-givers are suddenly complaining that they're not getting a percentage of the revenue that other people are getting thanks, in part, to their code.

Well I'm sorry but that's exactly how it is supposed to work. You gave the code, they used it. Instead of complaining, make your own hosting service and generate revenue on it.

If I were to adopt Redis' attitude, I would ring up all the companies I have ever written code for and demand a percentage of their revenue because my code helped them get money.

Hmm. Maybe I should give that some more thought after all ;)

Apache's latest SNAFU – Struts normal, all fscked up: Web app framework needs urgent patching

Pluma ? Are you kidding ?

Notepad++ FTW.

Start the flame wars.

Everyone screams patch ASAP – but it takes most organizations a month to update their networks

These posts are very interesting

Most of them point to patching issues with large or very large user bases.

I am self-employed. If a patch borks my system, I am good for a full day of reinstalling everything to be able to work again. Who's going to pay me that time ? Nobody.

If my system is bricked, then I am good for an emergency trip to the nearest quality hardware dealer and a hefty ticket price to get a new machine, which I then have to spend the day cleaning, removing stupid vendor-installed cruft I couldn't care less about, and getting the stuff I need to start working again. So a day lost again, and a big expense that I have not budgeted. Who's going to pay me for that ? Nobody.

If my system should be hacked (has never happened), then at worst, I'm good for losing a day reinstalling.

So my threat profile tells me that I can wait a while before patching, to see if there are any howls of pain from the latest batch of Windows updates. If I don't hear anything for a few weeks, then I put Windows Update back into Auto and patch, reboot, finish the patches and reboot again. Then WU goes back to Disabled, where it belongs.

@ Mr Dogshit

It is obvious that you are not in charge of ensuring that over 1,000 people can work every day.

Neither am I, but have rather close relationships with people who do. And I have learned from them that patching is a tight-wire rope exercise in managing not only safety and machines, but people and expectations.

Yes, security is obviously preferable. However, you always have Mr Performer who just can't have a minute without his server access, because he is making all the money for the company so his needs trump server downtime needs. And since he is the guy bringing in a fair chunk of revenue, his managers are on his side.

Of course, the admin knows that if the network is breached, it will be his fault and maybe even his ass, but the divas are the ones who give the okay for downtime, not the admin.

When something's weird in your ImageMagick upload, who ya gonna call? Ghostbusters!

Kudos for stepping up to the plate

And an upvote for the clarifications. Now I understand what Ghostscript is doing and what it is based on, and yes, as a programmer I fully understand that you're working on interpreting a programming language.

That's obviously an open door to all sorts of shenanigans, and can only work if the spirit of the system is always honored.

But still, sanitizing the incoming code should be possible, to a certain point. Whether that would make any difference is not something I can judge.

Australia blocks Huawei, ZTE from 5G rollout

An interesting suspicion, to be sure. Sounds like a plausible one to me.

OpenAI bots smashed in their first clash against human Dota 2 pros

The humans won because strategy - no surprise there

I have played my fair share of Battlefield and other multiplayer mayhem fests, and if there is one thing I learned it is that the team that has a strategy is the team that wins.

Most humans go into these games thinking and acting as if they were alone. If everyone plays like that (most common case), then the win is just chance to the team with the more efficient killers. But play a team that has no cohesion and find that the other side has a group that are actually playing together, and they will wipe the map with your corpse.

Had these tests been against the regular human bozo, humans would have been squashed, no question. It is good that they play these matches against human players who do have team cohesion. That way we see that programming strategy into a statistical analysis machine is not an easy thing to do.

I wish those programmers all the luck. Or do I ? Did I just hear the whine of a phased plasma ri<no carrier>

Network monitoring is hard... If only there was some kind of machine that could learn to do it

Oh for God's sake

There is no AI. There is statistical analysis, and vast amounts of data, but we do not have a machine to which we can ask : "tell me what is working".

There are highly intelligent people who understand statistics and can fine-tune these statistical analysis machines, but AI it is not.

I would really like for the media to drop the "AI" in their articles, but that is obviously never going to happen because . . marketing. Ai is sexy, and because we don't have it, it is the perfect fantasy.

Ex-UK comms minister's constituents plagued by wonky broadband over ... wireless radio link?

"we’re doing all we can to resolve the matter"

Short of actually putting any money into infrastructure that is . . .

Everything's great at Supermicro, just small matter of impending NASDAQ delisting

Supermicro

That hasn't filed for Chapter 13 yet ?

Wow.

One-in-two JavaScript project audits by NPM tools sniff out at least one vulnerability...

Re: "The only way to be safe was to host absolutely everything that your code uses"

And that is also the only way to be sure of what the hell your website is doing.

I have never understood the mentality of all those who just outsourced half of their website code to people they don't know.

But hey, what do I know ? I'm just an old programmer . . .

Use Debian? Want Intel's latest CPU patch? Small print sparks big problem

Re: What's wrong with "contacted"?

Not part of NewSpeak any more.

Marketing has rewritten the dictionary, and all those stuffy words that have worked and had meaning for the past 200 years are gone, to be replaced by iWords that are nice and shiny and make marketers look smart and professional.

Emphasis on "look".

Big Tech turns saboteur to cripple new California privacy law in private

Corporate America is bouncing back

The masters see a threat to their money-making ability and that is unacceptable.

They will do whatever is necessary, say whatever weasel words are required, and push the law back into its place : to protect them and their livelyhood (ie making money).

Is it time yet to hold a memorial service for the notion of "the land of the free and the home of the brave" ?

'Cause those ain't nuthin' but words, now.

What's holding you back from Google Cloud? Oh, OK... it was hoping you'd say 'lack of hardware security modules'

Re: they probably hold the keys also

Not entirely convinced about that.

Sync is a secure file storage system that claims not only encryption, but also that the user is the only person who has the keys.

If Sync is telling the truth, then it is at least possible that Google does not have the keys.

Security MadLibs: Your IoT electrical outlet can now pwn your smart TV

So this is the future we're to expect ?

People configuring their house from their phone ? All wall outlets, every single power plug, the doors, the drapes, the shutters, each room and every single electrical thing in it ? From a phone ?

Used by people who, by and large, weren't capable of setting the time on their VCR when they had one ?

Is this really where we're going ?

This is no longer a handbasket, we're going to Hell in a rusty bucket.

Texas ISP slams music biz for trying to turn it into a 'copyright cop'

Personally, I love how Grande dissected Rightscorp's tool

And clearly demonstrated that Rightscorp are nothing but a bunch of tools in the first place.

Their tool doesn't do a single thing it purports to do.

And of course, the music industry loves it, because they don't have a clue either.

Hoping for and looking forward to a Grande win.

Fire chief says Verizon throttled department's data in the middle of massive Cali wildfires

"We are reviewing the situation and will fix any issues going forward."

Yup, and the "fix" will be make all firefighters sign up to the most expensive plan.

With a smile, though.

Heads up: Fujitsu tips its hand to reveal exascale Arm supercomputer processor – the A64FX

So the A64FX is officially at 7nm engraving

Meanwhile, Intel's flagship i9 7980 Extreme Edition is still loitering at the 14nm scale.

Double.

Hey Intel, you might want to take your finger out and get back into the game ?

They feel really old now, thanks for the reminder !

Microsoft Visual Studio C++ Runtime installers were built to fail

Reminds me of why I stopped using IE back in the day

"A website that delivers malware can, depending on your browser and its settings, automatically download . . "

A long time ago (in the previous millennium actually), I was at work and got an internal message to check something at a URL. This was not spam, nor malware, nor a joke. It was work. So I fire up IE and click the link, going to a website and, somehow, notice that I had a new file in my Downloads folder (which I had open on my desktop).

I do a double-take, close IE, delete the file, and start Firefox to follow the same link. Firefox gave me a popup warning that the site was trying to force a download, and did I accept ? Did I not !

That was the day I realized that some unfathomable moron had thought it a good idea to include in browsers and HTML a function to download stuff to people's computers without either their knowledge or consent. I was speechless with rage. It is inexcusable.

From that point on I vowed to never again trust IE and only use it on merchant sites I know and trust when I can't use use a more secure browser.

It was one hell of a wake-up call.

Brit Railcard buyers face lengthy, unexplained delays. Sound familiar?

Re: "an experience approaching the comfort and convenience of wartime"

Complete with hardware that dates back to those days and maintenance procedures that, apparently, are scheduled when the lorry with the spares manages to get through.

Dell EMC stumbles into composable systems late waving MX7000 box

I have to admit that The Cloud (TM) has been good for one thing

It seems clear that all this cloudy stuff has pushed server management into the stratosphere.

That has to be a good thing.

It has also created entirely new failure situations, which vendors are learning to cope with. A bad thing, but overall probably good in the long run - it'll just cost millions of companies tens or hundreds of millions of dollars in lost sales or lost data, but hey, you can't make an omlette without breaking a few eggs, right ?

Internet overseer continues wall-punching legal campaign

"Nothing [..] enabled the Applicant to foresee the Appellate Court's reasoning,"

And that is supposed to be a problem how exactly ?

I wonder if there is anything in the German judiciary system that would allow it to tell ICANN to just shut up and go away. If not, this ridiculous charade is going to be the new SCO, and I'm not amused by the thought of spending years reading about ICANN's latest failure.

Mozilla accuses FCC of abdicating its role, ignoring comments in net neutrality lawsuit

I wish Mozilla all the luck

It's gonna need it.

So phar, so FUD: PHP flaw puts WordPress sites at risk of hacks

Re: And then you take a look at Drupal security . . .

Um, nope. Won't do that.

I intend to die with my sanity intact, thank you.

SuperProf gets schooled after assigning weak passwords to tutors

Re: At Superprof we take security . . .

I love how they always say that after it has been clearly demonstrated that no, security was NOT taken seriously.

And resetting tutor profiles, inventing new clauses and forcing people to pay again to fix stuff ?

Here's a thought : do your integration on a seperate server, unplugged from the Web, and ensure that all the stuff is properly represented as it was when the customer paid his money the first time. You buy a company, you buy its obligations.

Once you can be sure that the data has been reliably integrated, then you fold it into the production site.

Just a tip for the summer intern who visibly did the job.

Face-PALM: US Patent and Trademark Office database down for 5 days and counting

"a novel approach to dealing with the problem of patent trolls"

Heh. Suits me. They can even leave it down.

How's that encryption coming, buddy? DNS requests routinely spied on, boffins claim

@ Aodhhan

Thank you for your enlightening response. Here's my point of view : I click a URL, nothing happens. I leave.

I am willing to discover, I am not willing to become an engineer. I have enough to do in my area of expertise.

That said, I am glad that there experts such as you who are well aware of the issues and obviously concerned by them. That is reassuring to know.

So I'll just leave you to it then.

@ Lee D

"Basically, insecure DNS breaks secure websites. Now do you care?"

Thank you for the explanation. I get the theoretical problem. Practically though, given that it is only ISPs doing that, no, I don't care. Not now. I will if Joe Hacker starts doing it - which I know he can, but he's not. So it's not an actual issue, it's a theoretical one.

whatismydnsresolver.com

When I follow that link, all I get is a page with the site name as title and a "Loading..." marquee. So, website fail.

And I note that all this hoopla is around DNS interception that is apparently put in place by ISPs. And the ones who do it for "profit" are in . . <drumroll> . . China, obviously. To me, if my ISP is intercepting my DNS requests, well I don't see that I can do anything about it and I fail to see why I should care, as long as I get to the web page I'm expecting to get to.

And don't bother me with MitM on this issue : if ISPs were widely redirecting people to other pages, we would know and we would sue.

So call me when Joe Hacker is intercepting my DNS requests. I'll pay attention at that point.

SUSE and Microsoft give enterprise Linux an Azure tune-up

"this tuned kernel [..] will see network throughput jump by up to 25 per cent"

Yeah, as long as the connection isn't down. Right, Gatwick ?

London's Gatwick Airport flies back to the future as screens fail

Re: "no redundancy in the internet link"

Exactly that. Over 1000 monitors tied to a mission-critical component and nobody ever asked "what if the cable was cut" ?

Complete, utter and total project specification failure.

Beam me up, PM: Digital secretary expected to give Tory conference speech as hologram

I can accept, and I practically expect, a politician to have no clue about technology.

I cannot accept a politician without a clue droning on about what he thinks needs to be done in a domain where cluelessness cannot be tolerated.

Surveillance without permission is invasion of privacy.

Encryption with backdoor is useless.

Get a grip on it already.

The future of humanity: A Bluetooth ball hitting your face – forever

This could be entertaining

I await with moderate anticipation the tales of mayhem this "product" is going to generate (hoping nothing serious, though).

That said, if this is the only thing they can think of as a justification of so-called "augmented" reality, then that's another fad that will be put to rest along with Google Glasses.

Et tu, Brute? Then fail, Caesars: When it's hotel staff, not the hackers, invading folks' privacy

Forget about staying there again. I've just read the article and now I don't even want to go there.

'Oh sh..' – the moment an infosec bod realized he was tracking a cop car's movements by its leaky cellular gateway

Security is not turnkey. It's time we stop people from putting wide-open stuff on the web.

And please, don't tell me that you can't just type in some characters in a page. It's not that difficult.

Go Zuck Yourself: Facebook destroys patent suit over timeline

@ Michael H.F. Wilkinson

In which case your labs & unis can demonstrate that their patent is being used to develop product.

I'm just trying to find a rule to kill trolls, so adapt it, don't shoot me down.

Nvidia shrugs off crypto-mining crash, touts live ray-tracing GPUs, etc

Re: "to quote the Windows update settings page"

Because you trust Microsoft to read that ?

Facebook flat-out 'lies' about how many people can see its ads – lawsuit

Re: The suit is without merit, says Facebook.

Along with millions of cats, dogs, canaries, cars, snakes and fishbowls.