Posts by Pascal Monett

Hackers use Microsoft security tool to pwn Microsoft security tool

Used to be their/they're, now it's affect/effect

I understand the confusion from commentards, not from writers, and especially not from writers with editors supposed to check them.

Please do not encourage the confused ones in their confusion.

Reminder: How to get a grip on your files, data that Windows 10 phones home to Microsoft

"gaming achievements"

Yup, I understand perfectly that such information must be immediately sent to Redmond to improve Windows 1 0 stability and functionality. NOT.

My solution is to not install Windows 1 0.

Android users installed 2 BILLION data-stealing, backdooring apps

Hang on

"users who download apps from rogue marketplaces - and bypass multiple security warnings in the process "

So, you have to go to a rogue marketplace, meaning you have to root your phone because otherwise you can't download from there, then you have to decide to ignore all the security warnings (pretty much a given at that point, I guess), and then you're surprised you got pwned ?

That's like deliberately walking at night in the shadiest part of the city and being all surprised when you get mugged.

Sheesh, I'm starting to think that mobile phones lower your IQ by a fair number of points.

Browser made by China's top search engine leaks almost everything

Not really surprising

A Chinese company, based in China, is pre-empting government requirements. And we all know that the Chinese government cares not one whit about individual privacy, just like the US government but with less hypocrisy.

The real question is : will anyone outside of China use this browser ? Will the Chinese use this browser ? There are many alternatives, after all, but will a smidgen of nationalism get them to prefer a home-grown one ? Wouldn't be surprising.

FBI v Apple spat latest: Bill Gates is really upset that you all thought he was on the Feds' side

Well that's the end of that, then

I was willing to take the FBI's request at face value, but this means that the lying scumbag knew very well what he was asking.

Good on Apple's lawyers to have shed light on these shenanigans.

Bad on the government to have once again demonstrated that we simply cannot trust them.

How the country is going to solve the trust issue is beyond me, but a solution will have to be found. The country cannot continue like this and expect democracy to work.

Go hyperconverged. Or cloud. Or whatever. You won't save on hardware

So you don't save money

I think we all knew that, but it's nice to have an official confirmation. Someone needs to kick this info upstairs, because there's a lot of upper management types who are going to be quite disappointed for their bonuses.

Bill Gates denies iPhone crack demand would set precedent

Indeed, and they also want the disabling to limited to that phone, they don't want the code, and they agree to Apple being in control of the whole operation.

Really, it seems to me that the FBI is being extremely reasonable in their demands, compared to what they could have asked for.

Of course, we have to agree that, if Apple can create the limitation-erasing product for one phone, Apple can generalize the code. That is most likely the bugbear that everyone is harping on right now. And, given the NSA's attitude of "what we're doing is legal", it is not surprising that people are looking at their copy of the Constitution and seeing a whole portion of the text being erased and that is not making them feel better.

So, all in all, the FBI's request may be eminently reasonable, but it comes after a literal goatse from the government over individual liberties, so I guess the backlash is deserved on top of being understandable.

Re: keylogger

Well, PCWorld says it does, and WinBeta says it doesn't. Geek says yeah, but.

How much you trust any of them is up to you to determine.

Hackers aren't so interested in your credit card data these days. That's bad news

Re: "Pod People"

As far as hackers are concerned, I'm pretty sure they already consider most of us to be beneath even Pod people. For them we are just numbers on a screen, numbers they can take and use as they please.

The odds of catching them are vanishingly small, their odds of profit are vastly superior to robbing a bank or attacking an armoured transport, and, if caught, the sentences they face are laughably short.

The only good news I take away is that, after a long period of suffering, we might end up with better international cooperation to take down the scum that steal identities, better protections in place to prevent ID theft in the first place, and a global economy that is more stable and robust thanks to global encryption.

Sorry, NSA & Co., but your worldview is going to be proven wrong by the very tool you abuse for your surveillance abilities. That little irony is the only solace we can get at the moment.

Add 'Bimodal IT' to your buzzword bingo card: Faster... more stable... faster. But stable

"it is possible to collapse different infrastructure stacks onto a single larger infrastructure capable of serving all physical, virtual and cloud concurrently"

Is it just me, or has anyone else's bullshit bingo starting ringing ?

I might be totally wrong, and I acknowledge that network storage and workload virtualization have been making strides of late, but the only collapse of infrastructure I know of involves fire trucks, ambulances and many, many wounded after an earthquake.

Somehow I doubt that switching between Amazon and Azure is going to be a question of flipping a switch, even in this rosy picture.

Wi-Fi operators must notify device users of potential data processing

Re: "The first question you should ask ..."

Should be more along the line of "So, who is paying for it and why ?".

We all know that there is no such thing as a free lunch. If someone is buying for you, they most likely expect something in return (not talking about friends here). Knowing who is offering can most often enlighten as to what the expectations are.

Zuck: Facebook won't retry Free Basics in India

Re "due to the lack of data and consumer protection law"

I hate Facebook with a passion, but I cannot agree with your words there.

Signing up to Facebook is voluntary, there is no coercion from Zuckerberg, nor is there any obligation from the law or the market.

If you do decide to sign up, the onus is on you to read the conditions before accepting them. With all the hoopla around Facebook since it began to be a presence on the Internet, you cannot ignore the fact that Facebook is using whatever data you put on it, even if you might not realize how far it can go.

So I fail to see what consumer protection laws could exist that would prevent Facebook from existing unless you think a law that would forbid "social networks" from advertising would ever have a chance to pass - but that would be restricting free enterprise, which is a constitutional guarantee in the US if I'm not mistaken (so is the right to privacy, but that little detail has been swept under the rug).

Linode probe into 2015 crack finds fake 2FA creds flaw

@Destroy All Monsters

Well I'm me, obviously, but I have no idea why I was addressed to in French and no idea who the gentleman is. Welcome to the Internet :)

We have a saying in French : le monde est modial.

Re: Security Fail once again

Les mesures sont certainement proportionnels aux risques, mais le tout est de savoir quels sont les risques que l'on determine acceptable. Il est evident que l'effort auquel Linode vient de consenter démontre que, jusqu'à maintenant, une sécurité moindre à l'authentication a été considéré comme acceptable. Maintenant qu'ils ont subi une attaque réussie, ils ont revalue le risqué et ont agi en consequence. C'est au moins ça.

Quand à dire quels sont les fournisseurs qui implémentent la "bonne" sécurité, je pense que c'est impossible, vu que ce n'est pas le genre de chose qu'ils affichent sur leurs pages web.

Pour ce qui est du prix de l'abonnement, je ne suis pas convaincu que l'architecture avec authentication isolée soit plus cher à mettre en place que celle qui fait l'amalgame avec le serveur d'accès. Ce qui coûte certainement plus cher, c'est de changer l'architecture.

Autant faire bien dès le depart.

Security Fail once again

"It's also created an “authentication microservice” that completely separates customer applications from customer credentials"

The question is : why didn't they start by that in the first place ? it cannot be because they just didn't think of it, right ? I mean, I'm not an InfoSec guru by a long shot, but it seems to me that such a configuration is a basic when talking about secure authentication, no ? You want a minimum of internet interaction until you're sure of who it is you're talking with.

In any case, good on them to have made the change. Shame that it had to be following a breach, and that they didn't put the money there in the first place.

Black Monday: Office 365 down and out in Europe

Re: “A limited number of customers"

A limited number. Yeah. Limited to all UK users, or half of Europe's users, or whatever.

PR guys : limited does not mean what you think it means. You think it means that you can make us believe that this outage is not that important. We know it's important because it's all over the news.

If you really want us to know how small the issue is, just come out and say "only 12,000 out of <insert millions here> are impacted by this outage". In that case, we will be forced to admit that, indeed, it is not all that many compared to the total connections.

But you won't ever do that, will you ? That would be telling people the actual situation - and you don't ever do that, oh no. That would be an unacceptable break of tradition.

What we all really need is an SD card for our cars. Thanks, SanDisk

The article specifically states "Auto manufacturers can customise the card, as well as remotely monitoring the thing to see if it's operating okay and find out if/when card upgrades or replacements are needed."

So, on the face of it, I'd say yeah, there is some sort of wireless lurking around this tech, even if it only works in a garage environment. Then again, think OnStar and its all-knowing eye.

Thank goodness we all know that wireless is perfectly secure and has never, ever been breached by someone not authorized to access the data.

Oh wait . . .

Facebook sniffs at slow telcos, launches own Telecom Infrastructure Project

Facebook cozying up to ISP ? Welcome FaceNet - you can't escape from it

Given The Zuck's track record over "Free Basic" in India, I'm not at all enchanted at the idea of him getting his mitts on an ISP portal already used by millions.

The amount of privacy-invading surveillance "for your convenience" is going to make the NSA blush.

Samsung Galaxy S7 and S7 Edge: Betting on VR with a dash of Vulkan

"Samsung and Facebook are betting that will change"

Well I'm betting it won't.

I've got nothing against the phones, but VR is and always will be a niche product that will appeal only to a few percent points of the population.

And Glass was a brilliant demonstration of how acceptable it is to walk around with a Borg attachment.

Secret UN report finds against controversial WIPO chief

Another bloody arsehole

who obviously thinks that DG means "Designated God".

Icon represents the what's under the stake he should be tied to.

Intelligent Energy secures $7.5m to develop smartphone fuel cell

"the biggest limitation we have in achieving true connectivity"

Is not actually battery life - it is security at the hardware level.

Battery life (or lack of) is a nuisance, to be sure, but everywhere you can hope to get a connection, you generally have access to a wall socket or a USB charger. If you go out of range of either, there's a good chance you won't have connectivity either.

What we really need is secure-by-design IoT. Another thing would be IoT that is actually useful and not just for hipsters, but that can wait until security is baked in from the start.

UK court approves use of predictive coding for e-disclosure

"until an acceptable level of accuracy is reached"

More like an acceptable level of loss.

Yeah, 3 millions documents - and that's not pages - is a lot to review. Maybe we need to pare down the discovery process to allow for a restricted number of document submissions, instead of trying to find a way to skip analysing every one of them ?

Because if the 3 million are relevant, then what ?

D&D geeks were right – their old rule books ARE worth something now

What ?

You are asking me to mutilate my treasured AD&D collection so that you don't have to go through the trouble ?

Or am I supposed to believe that WoTC doesn't have some copies lying around to do the job ? Or original prints ? Or any sort of archive ?

My books are mine. I'll agree to digitizing them with a hand scanner if it helps, but no way I'm destroying them because you couldn't be arsed to preserve your own publications.

Microsoft hoses down Windows Server hardware support change fears

Microsoft still thinks it holds the PC market in its hands

Microsoft can keep pushing all it wants, at some point it is just going to push people away from Windows.

The upcoming generation barely knows Windows. Teens today are on Android or iOS, or wasting time on tablets that don't have Windows either. They are used to Gmail and Google Docs. In the next decade, they're not only going to enter the workplace, some of them will end up IT managers.

I'm betting that, come that day, they'll look at Microsoft licence costs, upgrade treadmill costs, service disruption and risk of data loss and they'll say "What the hell?" and move everything to Linux.

So keep pushing, Satya. Microsoft has always been the best reason to go to Linux, one day people will listen.

FBI says it helped mess up that iPhone – the one it wants Apple to crack

Re: longer passcodes?

Obligatory xkcd reference.

Clear and easy to understand.

Re:"On death doesn't the contents of account become owned by Apple?"

I should bloody well hope not, but thanks for the heads-up. One more reason for me not to post anything on "the Cloud".

Software, not wetware, now the cause of lousy Volvo drivers

Could we please stop this hands-free-everywhere nonsense ?

Convenience is a good thing, but not when it is tied to a platform as insecure as a mobile phone.

Oh well, I know I'm pissing in the wind, so I'll just wait for the inevitable massive phone hacks followed by a rash of stolen cars with insurances refusing to pay because car was not locked. That's when people will get the pitchforks out and cry about how they didn't know. Then they'll have learned a lesson.

Until next time, that is.

Ransomware scum add Joomla to their list

"a script injection [..] with the JavaScript files [..] carrying appended malicious scripts"

Once again, Firefox + NoScript stops an attack vector stone dead.

Man am I glad I use IE only for specific, known sites. Anyone know if this attack could work on Edge ?

Even Google is abandoning Google+

Replacing one ad-flinging, privacy-mining abomination with another one that does the same thing is not an improvement.

"Be careful from wild deadly animals"

And scores of grammar nazis have just keeled over from massive heart attacks. This from a developer for whom English is likely the native language. Oh well, it's a living language (meaning that it is defined by all the morons who don't know how to speak it).

By default I stay away from all privacy-mining social platforms, so I gave Google+ a miss as soon as I heard about it. I never missed it.

Comodo's 'security' kit installed a lame VNC server on PCs on the sly

Well whaddya know ?

With all the news about AV products revealing the stupendous stupidity that is lurking in their code, it would seem that Microsoft's Windows Firewall is actually not a bad product - provided you don't poke it full of holes with some so-called "security suite".

So Comodo joins the Symantec club of AV products I will never use. Another tear is shed on what Comodo used to be before it bloated itself beyond all usefulness. And life goes on.

519070 or blank: The PINs that can pwn 80k online security cams

Re: I wonder how many purchase orders for their products have been cancelled

Maybe none. Probably none, even, if the amount of people handing over their privacy to Facebook is any indication.

But seriously, this hack can only take place if the camera is connected to the network. That means all CCTV purchases are not at risk from the Internet. Of course, they are perfectly at risk from physical tampering, but if your threat is already that close, it's not the camera that will deter him.

As for me, I'm done even thinking about buying security cameras until an official rating has been created, implemented and can be verified stating that the hardware is secure and as tamper-proof as possible without any backdoors or root access or hardware-coded passwords.

I'm not holding my breath.

LISA Pathfinder drops its gravity-wave-finding golden boxes

@Ru'

Unless I made a mistake, a nanometer is apparently 0.00000000714 linguine.

At your service.

billionth-of-a-metre accuracy

Isn't that a nanometer ?

Nanometer accuracy a million clicks away ? In space ?

Count my mind boggled.

2016: The year IT sales will go sdrawkcaB

"new toys will be few and far between"

Good, we need a breather. And a decrease in the shrill shrieking of the hype machine will not be a disappointment.

Your anger is our energy, says Microsoft as it fixes Surface

"I read the blogs, I read the comments, I read social media, I read the forums"

Maybe if you spent less time reading, you'd spend more time making sure your product works ?

Okay, cheap shot, I agree. Hardware is finicky enough, add software and you can really find yourself in quite a bind, I'll easily admit that. But trying to do the "we're listening" act when you work at Microsoft, well, let's just say that it's going to be a while before that approach is taken seriously.

And really, guys, was it so hard to put one of your new Surfaces in sleep mode and test before shipping ? Or have you actually been in frantic mode on this issue since before release ?

China wants to bring home moon rocks in moon vacuum

Re: How do they get the vacuum in there?

Shouldn't be that difficult : bring the container to the Moon surface, open it and woosh!, air gone.

What will be a bit more difficult is preparing the vacuum examination chamber, but that will be on Earth and, therefor, a pump will be available.

ESA's Sentinel satellite to ride converted ICBM

Converting war tools into science tools

I can only applaud the Rockot program when it takes decommissioned ICBMs - the Armageddon's lance - and uses them to further Science and human understanding.

I do wonder what fuel they use though. I am under the notion that Soviet rockets used pretty nasty stuff. I wonder if that has changed.

The Nano-NAS market is now a femto-flop being eaten by the cloud

You say that as a Linux expert. In your case, I obviously agree.

Most people are not proficient with Linux. For those who still need NAS functionality, a dedicated vendor box is not all that expensive and has all the functionality required in a simple setup screen - no Linux knowledge needed.

Given that 99.9% of the population does not have the skills to tackle Linux on their own, NAS boxes are a good alternative.

Better than setting up yet another bug-ridden Windows box anyways.

Agreed on all counts

I have a Synology 4-bay NAS where I put 4 3TB disks (three WDs and 1 Seagate). Why 4 ? Because I wanted to use RAID-5.

I have ripped all my DVDs to it, so that my TV can access it for film viewing without hassle. I do not consider that replacing that with my Internet connection as an improvement. First, I'd be using up my bandwidth for something I already have locally. Second, I'd be limited to 10Mbps instead of 100Mbps on my LAN. Third, TCP is a lousy streaming support under 30Mbps. And I hate screen tearing when I watch a film.

Finally, I can watch a film whether or not I have Internet connectivity. I'll be damned if I have to depend on Internet to do stuff with MY data.

GitHub to devs: 'We ignored you but we never stopped caring'

Re: "back in the day there were many interesting websites written by authors"

Um, just out of curiosity, where are they now ?

Bomb hoax server hoster reportedly cuffed in France

Pushing it ? Why ?

If he's not actually logging anything useful, then why refuse to hand over the keys ?

If you witness a crime and have firsthand information on it, then refuse to tell the police when asked, you are bloody well complicit.

He has information that can help the police in bomb threats. I'm all for anonymity, but when lives are threatened fuck anonymity. I want the bastards caught and removed from civilization.

He hands over the keys to prove his innocence. When the kerfluffle is over, he changes keys.

You operate a site promising to look the other way, you takes your chances. He took them and it blew up in his face. Now he must face the consequences.

Metel malware pops bank, triggers 15 percent swing in Russian Ruble

Seems like banks are going to have to beef up at last

The entire banking industry has been surfing on security principles that date from last millennium.

Looks like a few hundred million are going to have to be removed from bonuses and go to actually securing hardware and transactions a lot more than they are now.

Maybe even ATMs will finally be upgraded from Windows XP Embedded to something secure, like a version of Linux.

In any case, I'm shedding no tears for them. This is a much-needed learning experience, and ATM security has been neglected for far too long.

Roses are red, violets are blue, Valentine's Day means DDoS for you

The scum obviously have no girlfriends

I understand the criminal approach of maximizing revenue : squeeze the victims that are most likely to pay without fuss.

I also think that paying them is a major mistake. Blackmailers will always come back to a victim who paid before. Unfortunately, that is not really an option for commercial sites, since they lack the means to change domain name or IP in a reasonable amount of time.

The only thing left is tracing the money, and that means paying, then waiting a long time before getting any hope of results.

What I don't understand is the betting sites. Betting has always been rather close to the criminal side of affairs - it seems to me that criminals are often behind those activities in the first place. So how is it that betting sites are targeted ? Shouldn't they be able to phone somebody and "get the message across" ?

Boffins' gravitational wave detection hat trick blows open astronomy

Re: I find gravity rather attractive

Oh yeah - she's got some wicked curves, doesn't she !

Uber, Taskrabbit, other Silicon Valley darlings urge Europe not to screw their business

47 sharing-economy outfits ask not to be limited by local laws

So that's 47 companies whose business model is :

- use poor schlubs to do someone else's job and skim your profits off of their work while claiming that they are not employed by you

- remain based outside of the country and claim that your revenue is not taxable because "Internet"

- avoid any and all liability by claiming that you have nothing to do with any issue that can arise since you are just a "facilitator"

In other words, 47 sleazebags who take the money and refuse all responsibility. They actually make Ebay look good again.

Putin's internet guru says 'nyet' to Windows, 'da' to desktop Linux

@Philip Clarke

Could you please explain how the US - or anyone, for that matter - can impose sanctions on open source software ?

Or do you think that deciding sanctions will magically make people in those countries not able to go to the web page and download the code ?

No, HMG, bulk data surveillance is NOT inevitable

There needs to be a debate

No there does not.

Not when there is a Constitution that guarantees individual privacy and freedom from unwarranted search, and bulk surveillance is - by definition - unwarranted search.

I find it curious to the extreme that nobody challenges the whole house of cards on those grounds - but then I remember that the media is controlled by those who are in charge, and they don't like questions like that.

School network manager wins £10,000 in NCC Group Cyber 10K challenge

Re: Shouldn't be needed

They tried that. It was called Windows Vista.

You might recall that it didn't work out all that well.