Posts by Pascal Monett

Java security plagued by crappy docs, complex APIs, bad advice

@David 55

Yes, IBM Notes developer. Domino is still supported until 2022+.

But I do agree that my list of clients is on a very straight downward incline.

1.12.2 now. I totally agree and understand your point of view.

it is the very reason why I have abandoned adding mods and community upgrades to my Minecraft server. It's useless, mods are never updated as fast as the core game changes. My little group sticks to vanilla Minecraft and things work out fine like that.

Going back to the original subject though, I can hardly believe that programmers these days still don't know that MD5 and SHA-1 are not reliable. I'm a Notes developer and don't use either of those functionalities but even I have heard about SHA-1 and how badly it has held up to modern hacking techniques. With all the news that we are bombarded with describing how major companies and been pwned because they did not update their tech to SHA-3. Who am I kidding ? Most of them need to simply stop storing passwords in plaintext and start hashing and salting them in the first place.

Oracle promises ‘highly automated’ security in self-driving database

Re: "Ellison said it would automatically provision, patch,..."

and "automatically backup".

That in itself sounds like a bold claim to make. Backups need to be managed, if only to ensure that someone can find out when the backup crapped itself and failed.

Humans are not just there to make mistakes, they also serve as monitoring equipment and pick-up-the-pieces equipment. Automating everyone away is not going to do much good when you need to restore from yesterday's backup only to find out that the backup has failed for the past week and no one knew anything about it.

You never hear of automated restores, now do you ?

BYOD might be a hipster honeypot but it's rarely worth the extra hassle

Re: Never saw the Attraction

Don't forget that BYOD was a Silicon Valley invention, and in typical Sillycon Valley mentality they only thought of what it could theoretically bring in cost reduction, not what it could actually cause in terms of trouble. The fact that Gartner was totally incapable of properly analyzing the situation and didn't even ask any question about the legality issues alone is just typical of an organization that whores itself out to whoever is paying at that time.

I always hated the notion that, as an employee, I was supposed to provide the hardware I was supposed to work with. I have not seen very many employees embrace the idea either. Where I have seen BYOD implemented was with manager-level types who were initially overjoyed that they could get the latest iThing and bully IT into supporting it. On the other hand, let's not get confused : management will always get their way in the end. BYOD was just a new excuse for it.

Playboy founder and dressing-gown wearer Hugh Hefner dead at 91

R.I.P. Hugh

I spent my fair share of money on his mags, and I am still of the opinion that Playboy has the classiest style of pictures - although class is going out of style in that particular market.

See you on the other side, Hugh !

EasyJet: We'll have electric airliners within the next decade

I never said it was impossible. I specifically stated that with a major overhaul of battery capacity, it would be doable.

So we agree.

Except for the fact that an A300 is not even going to get to lift-off on batteries at this point in time.

But one day, it might. Say 50 years from now. Like when we have AI.

"In 10 years it is possible that some very short-haul aircraft might be flying"

No, it is not.

Batteries are heavy, and they store way less energy than petrol for the same volume.

Getting a plane off the ground, especially a commercial transport, costs a huge amount of energy. Without discussing any figures, lets just take this page as a reference. It concerns the A300-600. That plane has a range of 7500km and a maximum fuel load of 68150 litres.

The energy contained in 68150 litres of fuel is apparently in the order of 48MJ * 68150 = 3 271 200 MJ.

This page indicates that the best battery (as far as energy density is concerned) is the Lithium-Ion battery with 460000 J/Kg. So 0.46MJ/kg.

That means that we'd need 3271200 * 0.46 = 1 504 752 kg of Li-Io batteries to achieve the same energy availability. That's 1500 tons of battery and you don't have the plane, the passengers or the suitcases.

Oh, just FYI, the max takeoff load of the A300-600 is 171 tons.

P.S. : I'm sure I've made calculation mistakes, but I'm also pretty sure that I'm still right. Batteries are not going to be used to power planes any time soon. At least not until those famous carbon nanotube thingies with 80% solar panel efficiency wings are invented. And they won't fly at night.

Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'

Had an interesting experience not so long ago

It was during a handover on a client site, I was there to recover essential admin information from the previous company handling network administration.

During talks with the soon-to-be-ex admin, we agreed that he would give me the list of passwords for administering the network - you know, as per normal.

He handed me a USB stick. I plugged it in and had it scanned, as per normal. Then I asked him which file I was supposed to copy. Under his instructions, I copied an xlsx file that he stated had the relevant data.

We parted ways not long after that and I went back to the office. While writing up my report, I looked at the file.

Now, just to be clear, this was a file given to me by a senior admin from a major local consultancy firm that has scores of big companies on its customer list, not a beginner. It just so happened that, yes, the file was an xlsx file, and it just so happens that he had a filter on his formatted table.

Guess what happened when I removed the filter ?

Yes, all the passwords for all the clients he was responsible for.

This is the level of intelligence we are dealing with these days. I blame Facebook.

Helium's for balloons and squeaky voices, not this 10TB Toshiba beast

10TB for €600, 3TB for €133

Price is a bit steep for individuals at the moment. Actually, in 2015 I bought some 3TB HDDs for €130, so the price has eked up a bit, but is still reasonable.

Oh well, with these new 10TB beauties coming on the market, it means that I will be able to buy a few 8TBs in a few years when I need them for less than the €370 they are currently going for.

UK third worst in Europe for fibre-to-the-premises – report

Re: @Pascal

You really don't get it, Ledswinger. It's not about being spoon-fed, it's about checking that the source justifies what the article mentions.

If I google it on my own, I can very well find an article on the subject, but I have no guarantee that it is the same article the author is referencing.

@Ledswinger

This article is not a forum post made by a clueless Netizen, it is written by a professional and posted in a professional business online publication.

Therefor, as per Internet Protocol since the dawn of professional publication arose, you source your articles with links so as to provide fact-checking to your readers.

As such, I maintain that it is a shame that this was overlooked here, especially since it is not the usual practice in these hallowed pages. Oh well, mistakes can be made.

You didn't miss it

It's just not there.

Such a shame.

UK Home Office re-bans cheap call gateways because 'terrorism'

Just a quick correction . . .

"This direction is necessary to ensure that those charged with keeping families and communities safe have the NSA has access to relevant and accurate information when they need it it wants it"

There, FTFY.

Mobile stock trading apps riddled with security holes

An interesting development

Here we are at the apex of money and IT, and they still don't put in the money to ensure things are secure.

I'm guessing it's because time is money, so it is better to risk being hacked rather than take longer to get an app that can get your entire portfolio hacked ? Um, somehow that doesn't sound so good at second reading.

No, things will carry on until some golden boys get ruined because of poor security. That will be the call to 1) have a few class-action lawsuits (hey, the lawyers aren't going to miss a golden opportunity like that, now will they ?) and 2) have other golden boys invest serious money in doing it right.

Because there's never enough money to do it right the first time, but always enough to do it over again.

Twitter reckons Trump's Nork-baiting tweet was 'newsworthy'

"We hold all accounts to the same Rules"

Twitter, I think it is time you add a new rule :

Presidents in office don't tweet

And the sooner you add it, the better for everyone.

Yup. The US has a goldfish for President. Let no one say that they don't innovate.

Baidu puts open source deep learning into smartphones

"MDL can recognise a smartphone in less than half a second"

Well that there is a performance, especially when you remember that there have been experts paid $80,000 that couldn't tell between an Android and an iPhone !

Seriously though, I'm no more comfortable having Baidu hoard all my data than Google. I don't the like the idea of any government listening in to my life, not China any more than the NSA.

Boffins take biometric logins to heart, literally: Cardiac radar IDs users to unlock their PCs

"If [..] a different person standing in front of the computer screen, the PC will not operate."

Careful there. In professional or even private environments, someone coming over to see what's on your screen for whatever reason is very common. If the scanner can't cope with two hearts in the same vicinity, things will get ugly quickly. Not to mention that sometimes the helpdesk guy just has to sit in the chair and do stuff. I hope the scanner will be up to that as well.

And if it can, then the burglar doesn't care about the scanner - he can just tie the victim up, drag him to the PC and then do whatever he wants.

This tech may be fine to control access to physical areas, but I'm not convinced PC access is the right area to apply it.

CBS's Showtime caught mining crypto-coins in viewers' web browsers

Don't worry, download.com still does. And it is still in business.

Thank God for NoScript.

Web devs griping about iPhone X notch: You're rendering it wrong

"there's nothing wrong with Apple introducing new technology"

Of course not. There's already two different names for the same CSS functionality. What could possibly go wrong ?

Docs ran a simulation of what would happen if really nasty malware hit a city's hospitals. RIP :(

The lessons will be costly in money and lives

I can understand that medical equipment was not created with security in mind. Who in their right mind would want to hack a pacemaker ?

The problem is that there are many people who are not in their right mind, for whatever reason. So now we're going to have to add security to our medical environment and we're going to have to do it right, because when you're having a heart attack the last thing you want is the doctor having mistyped his password wrong for the third time and locking his account.

Sensitive client emails, usernames, passwords exposed in Deloitte hack

Yeah, "deeply committed"

Not deeply enough to put the money where their mouth is, though.

Actual security is a nuisance, and it is expensive. Humans don't like nuisances, beancounters don't like expensive. Ergo, security is an uphill battle. Both ways.

Sigfox doesn't do IP and is therefore secure, says UK IoT network operator

"Sigfox's proprietary protocol"

Cue the argument of "security through obscurity" . . .

That said, it seems to me that SigFox's security is mainly based on firewalls and VPNs. It's all very nice to say that you don't use IP, if you use VPNs, you're still riding the same bus for part of the trip.

There are two things in this article that bug me. One is this invitation to hackers on the subject of IoT (lack of) security. Asking for trouble, in my opinion. The other, more serious, is what is going to be the impact of this so-called non-IP proprietary protocol on the regular IP traffic that is happening alongside ? Is there going to be interference, or worse, outright clashing ? I hope that these things have been considered with great attention.

And if they have, then the argument about not using IP is even weaker.

On the other hand, anything that improves IoT security is welcome in my book : it'll shave off that many more botnets that trouble the world.

Doesn't mean I'll buy any of that shite though.

Aw, not you too, Verizon: US telco joins list of leaky AWS S3 buckets

This is exactly why I don't like the Cloud

An engineer had made a storage space and put confidential data in it without bothering to secure the vault. Was it company-mandated ? Apparently not.

It is simply beyond me that anyone can consider storing data that is considered critical (like the client list, invoicing history, etc) or confidential (access passwords of any kind) on a server that you do not control.

That is obviously not an issue to many people though, including people who 1) should know better and 2) have the required technical level to do things right, yet visibly still don't.

And it's going to get worse before it gets better.

IT plonker stuffed 'destructive' logic bomb into US Army servers in contract revenge attack

48 years old

Stupid enough to plant malware, and abysmally stupid enough to have it trigger mere days after the handover.

With that level of intellectual performance, I think that it's a good thing the Army changed provider.

Sysadmin tells user CSI-style password guessing never w– wait WTF?! It's 'PASSWORD1'!

"They looked for the password on the CD . . ."

Dear God. Look, I understand that it was a Friday evening but come on, if you send a password-protected file and the password in the same package, it really totally defeats the purpose of the password.

The last time I had to send protected data I arranged with the recipient to send said data via email, and the password via SMS. Might not be a perfect solution, but it fits the purpose. I'm sure most people would do the same.

Of course, the password I chose was a tad more complex - which means that, had the data been sent by me, this story would have ended quite differently.

First big Privacy Shield review has ended – and yep, it's great! Just don't ask about mass spying

Everything is going fine

They will continue to publish reports saying so for a few years, then they will reference those same reports to say that all is well and always has been.

And that is how you write History.

Equifax fooled again! Blundering credit biz directs hack attack victims to parody site

From where I sit, it looks like a full-scale investigation is exactly what is needed.

Quebec takes mature approach to 'grilled cheese' ban

Looks like it's party time !

Rarely has articles been subject to much punning. I almost felt swamped before getting to the end. The surprise was great in any case.

Well done !

Bill Gates says he'd do CTRL-ALT-DEL with one key if given the chance to go back through time

Brilliant idea

Oh yeah. Windows' stability until 7 was flaky at the best of times. Single-key rebooting would have made the experience that much more miserable due to user error.

There is history enough around the disposition of existing keys and why they were changed to explain that a 3-key combo requiring both hands was actually a good idea because you really can't do that by accident.

This comment from Gates simply demonstrates that it is high time people stop asking him questions about the PC era of his life.

Chap tames Slack by piping it into Emacs

Well, points for making it work I guess

Kudos to the guy for making the tool work as he wishes. Must have required quite a bit of persistence, not to mention time tinkering and thinking of how to go about shutting up a program specifically made to blabber continuously.

Oracle promises SLAs that halve Amazon's cloud costs

"the 30 minutes a year the database won't work will be planned downtime"

So there is to be no unplanned downtime, in other words, he is promising perfection.

This is IT, we all know that there will be glitches and unplanned downtime, if only because of some fat-fingered bungling at a critical point.

But of course, he's just the marketing mouthpiece. Marketing has never been there to be realistic.

Congress battles Silicon Valley over upcoming US sex trafficking law

Re: "Two wrongs don't make a right."

Agreed. But spouting clichés does not improve things either.

So, what's your solution to keep young women from being bought, abused and murdered ?

Got a better idea ?

Black screen of death after Win10 update? Microsoft blames HP

Re: "It's a Btrieve based database with resilience features"

From the Wiki page :

"Btrieve is not a relational database management system (RDBMS). Early descriptions of Btrieve referred to it as a record manager"

You are obviously a Microsoft patsy. The Registry has resilience ? In what universe ? One wrong change and you can reinstall the whole thing. It's "well designed" ?!? It's a fucking text file ! Oh, right, you must live in Colorado. I hear they've got good stuff to smoke over there. Seeing such arguments, that has to be true.

The Registry is an abomination, a blight on security and stability and that must be the reason why Microsoft is the only OS maker on the planet that uses it.

But you go on and roll yourself another one. I'm sure you're really happy with it, but try not to kid yourself : the Registry is there for DRM purposes and to ensure that your computer is in Microsoft's control.

Uber Cali goes ballistic, calls online ads bogus: These million-dollar banners are something quite atrocious

Scum got had by scum

Well sometimes the world turns in the right way after all.

Google, Bing, Yahoo! data hoarding is like homeopathy. It doesn't work – new study claims

Re: It works

If you really believe in homeopathy, then all you need to do when you feel ill is take some drops of seawater.

The sea has dissolved everything, ergo it has all the cures.

If you don't do that, then you don't believe and have no right to go pontificate on homeopathy.

Veritas considers 'restructuring' another two offices, with 350+ pink slips possible

"reducing support, in the name of a better-looking balance sheet"

In a perfect world, customers should then reduce their custom in the name of finding better support elsewhere.

Of course, this is an imperfect world and switching supplier is not always that easy, so it looks like wait times are going to get longer.

DXC Technologies mails another corp message (gulp)

“It’s good internal PR for not a lot of money"

Well if it's that cheap, make it a raise then. Might be even more "good internal PR".

WordPress has adverse reaction to Facebook's React.js licence

Good decision

I applaud two things here : first, that a provider doesn't just blindly bend over without caring when a change in terms happens and second, that someone actually puts in the work when conditions are deemed unsatisfactory instead of just shrugging and listening to the beancounters.

That said, I have no idea what the consequences can actually bem but given that we're talking about Facebook, my gut reaction would be to not trust them. Then again, I wouldn't have used React in the first place.

Senators call for '9/11-style' commission on computer voting security

"They have shown an eagerness to meddle in elections"

This article clearly demonstrates that the US is no stranger to meddling in other people's elections. It is actually an impressively comprehensive rundown of election meddling, and the US figures prominently in the list.

Kettle, pot, you know the rest.

Signs of ground ice found on ancient protoplanet asteroid Vesta

Re: Water from comets or asteroids?

If I'm not mistaken, most comets and asteroids are just the cooled-down clumps of residue from the original disc from which our Solar System sprang into being, not the result of planets crashing into each other.

The inner asteroid belt between Venus and Jupiter could have been a planet, but the material could not coalesce properly because of the gravitational influence between Jupiter and the inner planets.

As for the material in the Oort Cloud, there may be a planet lurking out there, but most of the material is likely just small clumps that never made planet-size either.

Uber loses bid to avoid trial in Waymo case

Yes !

Anything that nails Uber executives to the wall is a good thing in my book.

I hope they are made to squirm in court like the scum they are.

Homeland Security drops the hammer on Kaspersky Lab with preemptive ban

"60 days to develop a plan to get rid of it"

Here's a hint : Windows key + E, click Computer, click Uninstall and select Kaspersky.

Then install the NSA-approved software of your choice.

If I'm not mistaken, China is already using it's own version of Linux.

Given the current push on security, global knowledge of NSA activity and Microsoft's dismal handling of Windows 1 0 updates, I'm guessing that, in the next twenty years, there will be more country-based versions of Linux. Okay, scratch that, I'm hoping there will be.

One thing is for sure though, there will be a lot more encryption going around, and there's nothing any so-called democratic government can do about that because businesses (aka the real money men) need that to inspire confidence in the sheeple.

Apple's 'shoddy' Beats headphones get slammed in lawsuit

"a design defect that causes the battery life to diminish"

Um, not defending Apple by any stretch, but I do believe that battery life tends to diminish with or without design defects.

As such, pretending there is a design defect is going to be an uphill battle.

But hey, I wish them all the luck. It's about time Apple's lies got caught.

Weird white dwarf pulsar baffles boffins as its pulsating pattern changes over decades

Learn something every day

I knew white dwarfs, today I've learned about red dwarfs. They can last trillions of years because they are convective, meaning they don't build up helium in the core.

Science. You can read about for thirty years but there's always something to surprise you.

Get out your specs: Java EE's headed to the Eclipse Foundation

Nespresso

would be mine

Giant frikkin' British laser turret to start zapping stuff next year

Re: Next step :

The knowledge you seek is here.

This article has been deleted

Yes, let us salute these courageous officers who put their very lives on the line for months in order to quash this grievous menace to the continuation of our civilization itself. They bravely put aside terrorist investigations, white-collar crime costing billions and street thugs maiming and killing indiscriminately in order to ensure that puritanism lives on. Well done !

It's September 2017, and .NET lets PDFs hijack your Windows PC

Re: "I am totally invisible on line"

Glad you're so sure of that.

By the way, have you made any purchases online lately ? Because if you have, you're less invisible than you think.

Do you use a Javascript blocker ? Because if you don't, you're totally not invisible, even if you do use a VPN.