Posts by Pascal Monett

IBM used dud DoS shield for failed online census says Oz PM

Well why doesn't somebody at IBM just say so when they get a call ? You can't really argue with the law.

"systems put in place by IBM did not include adequate protection against [..] (DoS) attacks"

I have one question : where is it stated that ABS required such protection in the specifications ?

IBM may well be a lumbering behemoth that whose right hand doesn't know what the left hand is doing, but from my experience its consultants are very procedural and tend to want to include absolutely everything in the specifications to max out all possible chances of revenue. To me, that means that it is very likely that IBM offered DOS protection measures, and ABS said no to the cost, so the measures were taken out of the offer before signature and go-ahead.

I simply cannot believe that IBM got handed the project and "forgot" to implement DOS protection measures. If IBM didn't implement it, I think it's because ABS said no. Probably because they thought the risk was insignificant ("who would DOS a census ?"). Now that the risk has revealed itself to be much more important, ABS wants to deflect the blame on the supplier. Typical coward's response.

So which is it ? Can somebody shed some light on this ?

Cyber-crime cost calculation studies are rubbish: ENISA

Mistaken approach

ENISA has misunderstood the goal of these "studies". They are not made to explain an actual cost, they are made to push the hysterical fear agenda to scare punters into investing into security (any kind, doesn't matter as long the contract is in the tens of thousands) and therefor need to publish big numbers because that's more impressive than saying that a typical cybercrime will actually cost an admin a day/week of work to ferret out and lock down the affected parts.

Even if your admin is paid in gold bars, you won't hit a number that is anywhere near the million mark, so not impressive enough.

McAfee outs malware dev firm with scores of Download.com installs

Interesting

"Large software download sites are a hated web relic in infosec circles because security checks are often scanty, while bundler installation programs make direct efforts to trick their users into installing unwanted apps that increase PC attack surfaces."

Maybe they should have a word with CNet as well, eh ? I hate download wrappers. All of them.

Your colleagues will lie to you: An enterprise architect's life

Re: Startups. It is no wonder so many of them fail

Indeed it is not, because running a company is something totally different to what anyone does on a day-to-day basis.

The first big hurdle is to not confuse what you have on the company bank account with what your benefits are. The company can have cash ready and still be going bust.

The second just-as-important thing is not to confuse the company bank account with your money. That is a very quick road to failure.

But there are more insidious things, like being able to detect which costs are bringing your company down and which ones are helping support the business. You must remove the first without remorse and be prepared to take the latter. You generally have to spend money to make it, the trick is spending the right amount in the right ways. This is what generally kills startups in short order - and that's without even thinking about dot-com ones.

Being paid for shoveling shit doesn't mean you like having shit dumped on you.

Italian MP threatens parents forcing veggie diets on kids with jail

"on the advice of a naturopath"

That's the guy who should be going to jail IMO.

Mars' 'little green men' buried alive by merciless meteorites – new theory

Re: spend that money on something more useful, here on Earth

Yeah right ! And if we were meant to fly, God would have given us wings. Just make sure your cave has a proper Mammoth-skin covering at the entrance and you'll be fine.

Carry on and stay away from fire ! It hurts.

'Alien megastructure' Tabby's Star: Light is definitely dimming

Re: Why building a huge super-structure around a star,

The idea came from science-fiction. It's not supposed to be feasible, it's supposed to be awesome. It is supposed to mean that the civilization that built it had so much more resources that they decided to do it for kicks. It's supposed to demonstrate just how powerful the civilization that built it is.

They wouldn't use up all the resources of the system that the star is in, they would use up five or six start systems - because they could. It's the hipster solution to energy gathering.

What about a nebula drifting through ?

I am absolutely certain scientists have thought about this, but I can't help thinking that a nebula of varying thickness might be able to explain this.

Of course, I doubt we'd have any way of confirming that. Then again, we know that there is dust between us and the center of the galaxy, and we can still get images in certain wavelengths, so maybe they've already checked and there's no chance of a nebula lurking in that specific region.

Still, I think a nebula would be possible.

AT&T dinged for $7.75m after letting scammers gouge customers (again)

"This isn't the first time AT&T has been fined"

And what of the 3 strikes rule ?

Oh, silly me. That's only applied to poor people.

Say hello to Samsung and Netlist's flash-DRAM grenade: HybriDIMM

Re: Diablo's Demise

Your enthusiasm may be a bit premature. We're talking about whiteboard specifications, not production measurements. All the numbers are PR-driven and subject to verification with actual, real-world results.

We've been promised the moon before, many, many more times than we've ever gotten it.

Uncle Sam set to flog Silk Road's Bitcoins

Re: Bitcoins are not considered currency in the US

A Federal judge has decided that it is now.

Interesting to see this go through after that decision.

CubeSat Moon mission to test new Ion Drive

Ah, space

There is nothing that is not awesome about it. The smallest thing requires freezing, burning and shaking before you can even get it on the enormous explodey stick ride to the sky.

If ever we get to the point where gravity modulators are common as pie, it will almost be a sad thing for the awesomeness of space. Almost.

MIT's chip fires frikkin' laser at qubits

Well you must admit that we haven't had very many qubits in the past 30 years.

Power cut crashes Delta's worldwide flight update systems

Re: the investment didn't make sense

Reasoning which holds up well until the catastrophe occurs and you see the bill for repairs. More often than not, you will then reevaluate your opinion of what "makes sense" as far as investments are concerned.

True story : at an important government-level organization I will not name further, there was a kerfluffle when a senior engineer warned, in writing, all the way up the hierarchy, that the currently-at-the-time PC upgrade process was an open invitation to virii and expensive downtime.

He was hauled into his managers' office for a right chewing out, which, being a senior engineer in a function from which nobody could oust him, he took with a verbal barrage of his own (likely containing many words such as "idiotic", "moronic", "abysmally stupid" etc - don't know, wasn't there, but I damn well hope so). Still, he was told that the investment "wasn't worth it" and that he should "stop making waves".

As fate would have it, the tsunami hit later that year. An outdated PC piloted by a nincompoop got infected, the infection spread to the servers, and everything was shut down for at least 3 days. That's over 500 people with no more PCs for 24 work hours. You do the math.

He did the math, and presented the cleanup bill with a scathing "I told you so" that, curiously, all the managers took quite meekly.

The PC upgrade schedule was changed after that. Unbelievable, ain't it ?

Again with the cheap internet access in India, Facebook?

If at first you don't succeed

Bribe, bribe again.

Breaking 350 million: What's next for Windows 10?

Windows 10 did especially well

Is that supposed to be a joke ?

For an entire year, we were continually bashed over the head with how Windows 1 0 was free, how much faster it was, how much better it was, and how free it was. We were repeatedly told that existing kit would run better on it. Oh, and it was FREE.

Next to the marketing, MS tried absolutely everything to push it out whether you wanted it or not, including malware tactics.

With all of that, what should have happened is MS touting the fastest-ever adoption of a new OS version, and the almost-total conversion of all Windows PCs in existence.

Instead, it barely made a quarter of the market, and you're saying that is "especially well" ?

I hope you enjoy your check.

If you use ‘smart’ Bluetooth locks, you're asking to be burgled

Honestly, I don't care if a BluTooth lock is well-made. As far as I'm concerned, putting any sort of wireless connectivity into a lock defeats the purpose entirely.

I want my locks big, thick, sturdy and totally dumb, thank you very much.

Re: the surprise my insurance company greeted me with

Which will be nothing next to the surprise of those morons buying these doomed-to-fail locks when they report a theft and their insurance says "um, sorry, but those BT locks are not approved and represent a security risk, so we're not going to pay for your stupidity".

Violence, vandals and vomit: London's naughtiest tech Tube stations revealed

SPADs, TDFs, what a cornucopia for disaster

Reading this list of errors really enlightens one on just how badly things could be going.

400+ cases of trains passing a red light ? And there wasn't one collision for it ? Miracle.

More than a thousand cases of signal failures, and no associated loss of life ? Miracle.

Train Detection Fault. The mere notion should cause a shiver down the spine. The fact that so many occur in a year is downright terrifying.

A real heads-up for when the PR bods trot out the old "automation is safer" line.

'Nigerian scammer' busted after he infected himself with malware

The dangers of convenience

Once again the lack of proper procedures are the linchpin through which scum can ply their trade. Taking account details from an email means that you do not have a proper client db with the reliable data already inserted.

Which in turn means that your payment transfer system is probably a mess (no check on account number for an existing supplier ?) and errors like this will slip through unnoticed until you get an invoice unpaid letter and start wondering why - which is never the right reason to check your accounting procedures, but better late than never.

This is the kind of pain that will prompt more attention to detail. It is unfortunately a costly lesson, but there is a portion of the population that only learn by costly lessons (backups, anyone ?).

Windows 10 Anniversary Update is borking boxen everywhere

Re: a relationship ?

Ah, right, you mean Stockholm Syndrome. Got it.

Stealthy malware infects digitally-signed files without altering hashes

"Nipravsky reverse-engineered Microsoft's undocumented portable executable loading process"

And that is why you do not count on undocumented features for security when Internet connectivity is the order of the day.

The era of secret code is disappearing under the inexorable march of Internet connectivity and Open Source. It is now a security risk to not disclose your code and processes because that approach deprives you of all the eyes that can validate your code and ensure things will not become a major security failure.

Because the blackhats will deconstruct your code anyway, and they will find what you missed.

Private moonshot gets the green light from US authorities

"the Moon is a potential future source of rare earths"

They're going to have to find a way to deal with the very fine Moon dust if they want machinery to work in that environment.

How the HTTPS-snooping, email addy and SSN-raiding HEIST JavaScript code works

Breach, Crime, Heist

Just what is the statistical probability of such a coincidence ?

Oh, one in a million ? It had to happen then.

'ICANN's general counsel should lose his job over this'

"Maybe I'm naïve, but I hope they do the right thing."

Just one question : when has ICANN ever done the right thing ?

ICANN has a long history of publishing rules for the peons and then doing whatever they decide they want. Even the US government got told "shove off" when it tried to argue that ICANN has to respect something.

You think you've got a chance ?

I'll be following your time in court with great interest.

Classic Shell, Audacity downloads infected with retro MBR nuke nasty

Re: Also, a change to the MBR is 'before' any OS is loaded

I don't think so. The MBR was changed by the execution of the nasty. Besides, if no OS is loaded, how can any change be made ? Something has to run the code that makes the change.

Why this MBR rewrite could fly under the AV radar is beyond me. Is the MBR being regularly rewritten by the OS all day ? Don't think so. So why does MBR access not trigger a humongous red screen with nukular* blast in the background and big white lettering saying "HEY, SOMEBODY WANTS TO RECONFIGURE YOUR DISKS - ARE YOU SURE ???" and a nice red button with "FUCK NO" written on it to abort.

But no, apparently any piece of code can just go and write to the MBR. No problem here, no sir, carry on while I slow the Internet down with all the Flash checking I have to do. . .

* yes, I did write nukular on purpose

Microsoft adds new 'Enterprise Products' section to privacy policy

The policy came into effect on Tuesday, August 2nd

And that is the date where Microsoft has officially lost its mantle of OS maker and transitioned into Ad-slinging personal data slurper.

That is also the date where I will have retroactively dumped Microsoft into the same bag as Google and all other sleazy Internet companies who just want to milk my details to make their money. That you have to pay Microsoft for the privilege is just the cherry on the cake.

Thanks, Microsoft. It was an interesting quarter century and I am happy for what we had. I will cherish my Win 7 license for as long as I can string it out.

But we're done now. You have become something I cannot abide, and I will not trust you again.

Ever.

Simply not credible: The extraordinary verdict against the body that hopes to run the internet

Re: Umm, some balance please

Yes, let's balance. I don't give two hoots about corruption in the Olympic Committee or FIFA - they do not and will never affect me in any way.

I damn well care about my Internet and I am incensed every time I hear about how ICANN in general just doesn't give a flying monkey's about respecting anything so mundane as rules and regulations when it is the fucking global Internet that they've got in their hands.

It is literally criminal how they get away with blatantly saying "F U" to everyone's face and nobody lifts a finger in retaliation. I would send in the Marines and have them all shot for treason on site, no delay and no discussion.

$67M in bitcoin stolen as hacking typhoon lashes Hong Kong's Bitfinex

@Alan Brown

That attack was against the SWIFT system, diverting funds from where they should go. It was not an attack on funds in accounts. The system will be patched.

It also took advantage of a security hole, with an unprotected switch being exploited. That bank should have known better.

But okay, a hacker did get away with millions. Duly noted. I hope he knows how to run, because he'll be on the run for the rest of his life.

Yes, today money is virtual until you get some from the ATM. The difference between BitCoin and "normal" money is that banks are under a charter that has been hundreds of years in the making, and must respect financial obligations that have been polished and tweaked by law for centuries.

BitCoin, on the other hand, thrust itself into existence and, as its very first act, declared itself to be immune from all that legacy law and experience.

That is why you'll never hear of a bank hacker getting away with millions. There are breaches targeting user credentials, there are isolated thefts on one user account now and then due to insecurities with online banking, but there are no mainframe attacks on central databases. With BitCoin, there are.

Now that a judge has declared that BitCoin is not funny money, I'm just waiting for all the BitCoin trading to be force-folded into signing up for a proper banking statute world-wide and getting up to speed with what it actually means to be a responsible trader.

My guess is that all current BitCoin trading places will fold because none of them have any actual finance experience and actual banks will pick up where they left off.

Time will tell.

Post-Brexit spending freeze in UK is real, says enterprise distie titan

A market hiccup

Gonna be one looooong hiccup.

Reminder: IE, Edge, Outlook etc still cough up your Windows, VPN credentials to strangers

"Microsoft released guidance to help protect customers and if needed, we’ll take additional steps"

Microsoft released guidance - yeah, because all 350 million Win 1 0 users know about your guidance.

if needed, we’ll take additional steps - hint : it's needed !!

Foot meets bullet - again. This is karma for having stupidly decided to graft a browser into the OS for no technical reason whatsoever and not paying attention to the impact of internet-related bright ideas on core OS functionality.

Swede suffers shrinking penis after dentist fits mouthguard

"the plastic used in the mouthguard"

Keep that plastic for pool-based todger mishaps.

Make mouthguards out of ceramic.

If that fails, call in a psychiatrist.

Going! going! pwned? 200! million! Yahoo! logins! leaked! allegedly!

Re: Meanwhile....

Sure, mention it.

Standard Corporate Procedure, these days. She's far from the first CEO to bilk millions out of driving a company to the ground, and she certainly won't be the last.

It's private money. If the shareholders are stupid enough to give it away, it is literally in every sense their problem.

That said, I'll drive a company to the ground for a tenth of the price. Just saying.

Hitachi's Americas CEO resigns

"Jack Domme has resigned, with Ryuichi Otsuki already in place"

Well at least Hitachi didn't take months to find a new CEO, eh HP ?

Chinese Android smartphone firm: It packs a dedicated crypto chip

Shhh.

You're tech, they're Marketing.

Not the same universe.

300 million pelicans? Pah. What 6 billion plastic bags really weigh

Re: Enviromentalists are extrapolating

Right. Because the the Pacific trash vortex is just a tiny collection of a few bits of plastic debris. Nothing to worry about. Move along.

Windows 10: Happy with Anniversary Update?

Re: Bashing a machine with a spinning disk in it is definitely not a good cause of action

Yeah, but bashing a Windows machine with a spinning disc is highly cathartic and greatly reduces your stress levels.

Re: They can't win.

No, they can't. On the other hand, they did everything to put themselves in this situation in the first place. The guiding light has always been revenue, never proper protocols. As such, if MS had actually cut the cruft with XP, back when nobody had any other choice, and set down proper API rules and respected accepted browser specifications, the situation today would be a lot cleaner and programmers would have a decade's training in Good Programming.

They chose short-term money instead.

No sympathy.

Re: Windows 10 is good if you don't care about controlling your own computer or your privacy

Spot on.

An Operating System used to be the layer that could launch applications and manage the hardware.

Today it is an excuse to push ads, monitor users and create salable statistics.

I'm checking out of all this nonsense.

Liberata in £43m buyout by Japanese firm OUTSOURCING Inc

"The buyer is has spread"

There is absolutely no grammatical checker today that would let that pass.

No editor worth the name would miss such a thing.

That is the nature of journalism today.

If only it were Friday, dammit. I need a drink.

Australian spooks' email guide banishes MS Word macros, JavaScript

Re: We didn't take any risks, we just took the PC off that user

And that's all ?

You didn't take the servers offline to scour them for virii ? No in-depth analysis of all network shares ? Just re-image the affected PC ?

And you think you didn't take any risks ?

Ignorance really is bliss.

Australia to spend a billion bucks and seven years on SAP project

Re: only if they signed up to follow the above

And only if you have a fully-equipped dungeon to deal with the people who still stray from the path.

US state sues Comcast for $100m in row over 'worthless' repair plans

Re: if they're decent people

That seems to be the whole problem.

FBI electronics nerd confesses: I fed spy tech blueprints to China

Re: Veteran technician...

Veteran tech and he uses absolutely every single electronically under-surveillance tool known to Man ?

And working with inside knowledge of the NSA ?

He should go to jail just for that.

You think Donald Trump is insecure? Check out his online store

Nah, Mexico.

Re: Everything he ever built someone else paid for.

Everything he ever conned someone else into paying for.

FTFY

Google-backed Thread, OCF form alliance for Internet of Things sanity

But it will unfortunately rebound thanks to all the friggin' idiots who would die for a chance to control their lighting and heating from the slab grafted to their hand.