Posts by Pascal Monett 19006 publicly visible posts • joined 10 Apr 2007
Of course it is. It ALWAYS is.
Only 1% of 300 million is still 3 million users ; not a small amount in itself, right?
And if 1% of those 3 million use 2FA and are affected, that's still 30,000 people.
So yeah, 30k people compared to 300M subscribers is small fry, sure. BTW, how many of you live in a town with 30k inhabitants ?
Just wondering.
And just what exactly can I do about it ? Nada.
While I applaud any article that draws attention to the security deficiencies of The Cloud (TM), I cannot help but remain unimpressed at this latest expositional piece. Telling me that state actors have the means to create malware to spy on VMs I would have spinning on AWS instances is hardly that important when the NSA can just write a National Security Letter to Amazon and have Bezos send them the data.
Having another country capable of it does not really make a difference.
You might remind your female friends of a basic difference : IRL, someone has to meet you, or at least be told about you, before they think of looking you up. I doubt that stalkers choose their victims by perusing the phone book. If they don't know your name, they can hardly look up your address and they'd have to follow you home before they can correlate an address to a name.
Publishing personal info and travel data on a social site removes that sleuthing requirement. The stalker can just peruse the activities, select a woman he likes and dive into her life. Finding the address is trivial at that point.
Security through obscurity works very well in real life. Do you know where US carrier fleets are at this time ? Hint : don't try finding out - that will land you in very hot water.
The fundamental social responsibility of government is protecting its citizens, not snooping on them.
Keeping the peace means feet on the ground, visible police presence by affable and polite constables always ready to help while keeping an eye out for shady behavior.
It is costly, doesn't catch everything, but it is civilized and respects the privacy of the innocent.
It was once said : "I prefer to let a hundred criminals free rather than jail a single innocent".
My, has time flown by . . .
And for the life of me, I can't understand why people are so prompt in throwing data at it.
Education on this point is going to be long and painful, and there will be tears before things get better.
Just because clouds have silver linings doesn't mean you can ignore the dark thunderstorm brewing within.
Not if you have NoScript (or equivalent).
As usual.
I'm a bit tired of all these articles on browser vulnerabilities that never, ever mention JavaScript blockers. They are the first line of defense and, in my view, they are as good as Star Wars ISD shields. Nothing gets through unless you allow it.
So yeah, maybe Firefox has some security issues in the core, but NoScript is the active energy shield that is protecting it and it is impenetrable.
Let's get JS blockers on all the other platforms, shall we ?
Yes : educating people that Science has no social or sexual connotations and none should be inferred. A black hole is a hole in space/time that is black because no light can be emitted from it. End of.
That education will likely take until the heat death of the Universe, though.
Because until such time as we have a complete definition, we still have to classify the discovery.
It wouldn't do to throw everything in the "Undefined" folder, and we can't reasonably put it in "Supermassive" either (or "Sun-like", etc). So we have a category that requires refining, but we still need the category.
Any mail I receive from someone I don't know that has an attachment goes directly to the round file.
I find that that simplifies things enormously and saves me a lot of time as well.
If that person has legitimate reason to contact me, they'll write again and a conversation will start from there.
One thing I remarked on that page was this :
The survey represents approximately 1,000 completed surveys from pre-qualified IT decision-makers primarily based in North America, Europe and Asia
Given that the top results concern everything trending in the Cloud these days, I'm guessing that those 1000 "pre-qualified" (?) IT decision-makers were not working for companies that have only 20 employees.
So this is a survey of 1000 large companies with hundreds of employees or more, raking in tens of millions per quarter. And we're being told that IT is going to be extracted from on-premise.
Reminds me of outsourcing call centers. That became very big, and then people starting hating it, and now it's not so big any more. This is going to be the same thing.
It is interesting to observe that highly intelligent people capable of finding such loopholes are nonetheless hopelessly naive when it comes to judging human character.
Did he really think that just saying "don't do bad" would be enough ? Well, as the first poster demonstrates, it isn't.
They might have, but given that they apparently didn't do any serious testing, we might never know.
I am honestly in awe of all these government projects that fail so publicly and completely and yet nobody is ever, ever sacked on any side.
If I go to a customer site to do a job and I bungle it up like that, I'm pretty sure that 1) I won't be paid and 2) I'll never set foot in that place again. I might even be liable for a lawsuit.
But these guys waltz in, pick up the contract, pocket the money, distribute bonuses and, when the time comes to deliver, mumble sheepishly and put their hand out for more money in order to correct errors that never should have been there in the first place.
Okay, I know UK government has a specialty in not being able to decide what it actually wants, endlessly changing specs and otherwise making life very difficult for people who actually want to get the job done, but I would think that the military would be less prone to endless waffling and more focused on getting what they need, knowing what it is they actually need in the first place.
So I tend to think that, in this particular case, it is Capita that screwed the pooch big time. They should know better.
But that won't keep them from getting another contract in the future, right ?
That's what I don't get.
Come on, people, there is enough history to demonstrate that you might as well gather ten local, small providers, give them the contract and see what happens.
Given how much money you've already wasted, it couldn't be worse, and it just might be better.
Indeed. Shit code from 2004 is still alive and kicking.
Goes to show that companies are never actually auditing their code ; they just wrap more layers around whatever works good enough to be sold. There is no oversight, no overall plan. It is not possible to have a framework in place and check every code addition against said framework to ensure proper and safe functionality.
And let's not mention code that depends on disappearing GitHub libraries, right ?
This whole code thing is already out of control. And now we have DevOps.
I do use Paypal now and then - when I don't have the choice to use anything else.
Visa is my preferred payment method, because when something goes wrong I have my bank to talk to. My bank manager knows me, knows my account and has been following me for the past ten years. If I tell him something is wrong, he will look into it.
Paypal ? You can send a message, right. Then you pray that Paypal does not decide that it's your fault and bans you for it. No office to go to, nobody to talk to via phone. Just a webpage, and a prayer that someone is awake and not pissed off on the other side.
Either there is a framework in place and that framework should be respected, or there is none. Allowing someone to exempt themselves from a framework means that there is, in effect, no framework.
So revise the framework and impose it, otherwise this whole thing is just a PR exercise.
That's interesting. Now tell me exactly how is it that "staff" not thinking it needs approval equates to "Accounting" actually paying money.
Are we talking Government here, or are we talking the corner coffee shop ? Isn't there supposed to be some fucking officer in charge of authorizing spending ?
Yeah. I especially like this one :
Q. How much money will VMware save through this activity?
A. This decision will help to streamline business processes, advance innovation, and deliver better results for the company.
Note how the answer absolutely does not answer the question.
Translation : we're all fucked for the duration. Microsoft is going to have years of faulty patch releases due to this, and everyone else is going to have to submit to regular panic attacks every now and then following just how well the media is going to do its follow-up on this subject.
I really would like to think that retirement would get me out of the panic zone, but it seems that even a bear pit won't be enough now.
Sorry, but i disagree. We're talking corporate user, meaning someone who has the backing of an IT department which is supposed to have done its job learning what kind of kit it purchased.
This has nothing to do with Joe User who doesn't have a snowball's chance in Hell of understanding what is going on. This is corporate stuff, and corporations are not supposed to be stupid enough to leave admin passwords unchanged.
Sounds a bit bitter, but realistic.
Especially in a world where all the marketing hype surfs on an undercurrent of slurping every detail they can find out about you and selling it off to any bidder.
That said, we're all adults here (allegedly), so could we please stop with the auto-censoring ? If you want to say shit, say it.
Ah, share price, that's your fall-back argument ? The disappearance of Windows Phone means nothing to you, then ? Cortana shutting down is of no consequence ? Sure.
As for server share, you obviously haven't got a clue.
Keep drinking the Kool-Aid. A numb mind is a pleasant thing.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
