Posts by Pascal Monett 19424 publicly visible posts • joined 10 Apr 2007
That is indeed curious. On the other hand, I'm an obedient little cheese-eating surrender monkey ; I set up my Synology NAS with 4 3TB WD Red HDDs (well, there's a Seagate one in there just for kicks).
I check out what WD Black is and find something that really makes me laugh : WD is making HDDs for, get this : CLOUD STORAGE !
If ever there was a "sucker born every minute" product, this has to be it.
That is a requirement that I have only ever witnessed on illegal Torrent sites. And it always makes me laugh before I go download somewhere else.
Okay, I do not download copyrighted material I don't have the right to, but if I have bought the official CD or DVD, I consider that I have the right for backup purposes (T&Cs be damned). So I go find a torrent to download. Then I stumble across these sites. I know why they do it - they think it fosters a "sharing community" by blocking the freeloaders. In truth, it just gates the community to those who have been there the longest.
So let them have their secure illegal download section. I buy my CDs anyway*.
* Some of you are thinking : but if you buy them, why not rip them yourself ? That's my first try - but some CDs have digital protection. Before bothering myself with cracking that - which is generally a chore that I prefer to avoid - I search for the kind soul that has already done the job and posted the result. If I find nothing, then it's on me. And you'll not find the result because I'm not a pirate, it's for backup purposes as I said.
Maybe we're simply seeing the start of a return to normal operations in businesses that gave 1 0 a whirl to see what if, and decided that no, no if, and back to previous, stable, environment.
If that is the case, I expect to see more of this.
In any case, for a free OS so heavily pushed, the results clearly indicate a failure to impress the masses.
And who can resist "8,000 times better" lead times ?
Certainly not the people who can believe that that is possible.
As far as I'm concerned, the faster you go, the less time you have to "make quality the top priority". There's something inherently in opposition between quality and speed, in my mind.
On the other hand. you'll break things a lot more, so it's a good thing DevOps makes you code like the wind.
The whole cloudy DevOps speedy demon future we're being pushed to just means that a developer's career is going to start in DevOps, constant panic and crunch time, endless releases and starting over, then migrate to legacy when the youngster is burned out and fed up with the commotion, then end with freelance consulting when old enough to enter the fray with a solid, cynical view of the whole process.
Business-impacting technology ? Why don't you ask 123-Reg how well that went for them ?
There's Google, and there's the rest. And the rest need to invest billions in data centers if they want to have a chance. Those who can't become Google-scrapers.
Flash appears to be the same game. The incumbents have the investments made and money to invest more. Newcomers are learning that the entry ticket costs more than they hope to earn.
This is pure capitalism. No amount of lobbying or backroom deals is going to change this market. You gotta come with the billions, or you can leave while you still have a car to leave with.
I can easily imagine that this ASCII/EBCDIC issue is going to take mountains of cash to change, meaning that we are going to be saddled with the problem for decades to come - or until the mainframes start failing (which, due to the mountains of cash already paid for their maintenance, ain't gonna happen anytime soon).
Yeah but cash registers are typically not used by anyone outside of company employees - which makes them a different problem compared to ATMs which are used by anyone.
Also, cash register issues are the problem of the company (as Target found out last year to its great detriment), and its customers, whereas ATM issues are everybody's problem.
Finally, cash registers are generally under more direct surveillance than ATMs (and have never been attacked by backhoes - yet). People standing around an ATM generally do not get noticed by passers-by, whereas Joe Hacker is not going to have much time to muck with a cash register before store security is standing next to him and asking questions.
But yeah, Target is a clear demonstration that cash registers are a weak point whose security depends more on luck than actual defences.
I am in the process of developing the ultimate lecture program. It will be titled 42, and I will systematically be drunk every time I enter the stage.
I promise it will be entertaining, enlightening, and slightly insulting to almost everyone.
Tour starts in Europe this century - watch this space !
How to overcome the nigh irresistible drive to push your company to adopt Yet Another Fad.
It's difficult.
Because managers are very sensitive to peer pressure and marketspeak, and they live with the illusion that they are more enlightened than the keyboard serf that is tasked with solving the issues and dealing with the daily grime.
Because managers are paid more and we live in a society where value must be defined by a monetary amount, so the serfs mathematically have less value - except that managers never solve problems, they only create pressure.
But technology obeys no marketroid. It is possible, or it isn't. If it is, then marketroids can wax lyrical and invest in lexical creation all day, they are not doing the work. If it isn't, well even managers cannot declare the Second Law of Thermodynamics invalid.
In the end, you can slap any currently-trending moniker on it that you want ; developing applications is done one way : the developer talks with the user to determine the real needs, including the unspoken ones, then returns to his cave to hammer out the code that will make it happen.
Software development has always and always will be the same process : someone has a problem, someone else can code a solution. Inventing fancy new names for that changes nothing and is only done by those who do not code solutions.
Now get off my lawn !
I agree with your points about Disney and prison, absolutely. However, the solution to that is not Google, it is voting copyright length back to where it is supposed to be. That is a problem for Parliament or Congress, not Google either.
As for Google, let's not keep wool over our own eyes. Google is a private corporation, and has pushed the law as fast as hard as it could from the beginning. Disney has nothing over Google, but who is keeping Google in check ? Nobody.
Yes, copyright laws need to be reviewed and length of copyright needs to pegged at life of author, max (and no, corporations are not authors). Personally, I think 25 years is long enough.
But what are we going to do about Google's hold on personal information that is OUR property ?
Hear that faint sound of heavy breathing ? That's all the malware scum hyperventilating at the thought of all they will be able to accomplish once they hijack an entry point into there.
Ah, Microsoft. In just two weeks you unveil OS-level QR codes and now an API for One Drive code execution. Really guys, you need to slow down. The blackhats don't have enough time to keep up with you there. Do you intend to drown them in vulns ?
But doing that requires increasing the headcount - supposing that salaries are attractive enough to get qualified people there in the first place (I have doubts on that).
Then departments get criticized for being staff-heavy, so they lay staff off.
Then departments get criticized because they are slow and inefficient, so they hire temps while "a more permanent solution is found".
Now we criticize them for having all those temps. Return to step one and start over again.
There is no way that circle will ever be broken.
We need a merry-go-round icon.
I'm sorry, I thought Uber was just an intermediary and that Uber drivers were not its employees.
If that is the case, then what does surge pricing ability have to do with Uber driver availability ? Am I supposed to think that Uber drivers in India are going to decide not to offer their services because of that ?
Or is it more like Uber is dictating everything and treating drivers like employees on hand, while using wool-over-eyes techniques to avoid supporting the costs of its actions on the other ?
The guy is dead. Whatever he did and whoever he contacted are known elements. What he said to those contacts is probably known as well. Given the care he demonstrated in disposing of his private equipment, it was a million-to-one that he'd be stupid enough to leave anything on the work phone - and now we know he wasn't.
If it had cost $10,000, then fine, I would agree and say go ahead, crack it. If the guy was alive, definitely crack it whatever the cost. But over a million bucks down the drain to crack a dead guy's phone that is virtually guaranteed to not have any info ? That is waste, pure and simple.
The USA has a long history of not implementing anything that comes from Europe.
They laughed for ages at Europe's "monopoly money", ridiculing the colors and everything else. Now, of course, they have grudgingly followed suit because money is everything after all.
Chip & Pin is the same thing. I went on holiday in the US in 2014. When I first tried to pay gas with my card I found that, although the pump would accept my European Visa, it had maxxed the PIN length at five digits. Most people I know only use 4, but I use 6 digits. Without any way to enter the 6th digit, I couldn't use my card. I have no idea if 4-digit PIN cards work either - does it force 5 ? Whose bright idea was it to put artificial limits on PIN length ?
In any case, just like Microsoft's IE, the US has its own implementation of Chip&Pin.
Then, of course, the eternal subject of going metric. I doubt that will ever happen - the US is much to used to imposing standards on everyone else and currently has the tendency of snubbing anything that comes from Europe. Like the Bill of Rights.
This hack is the result of an impressive amount of knowledge of how the inner blocks of Windows fit together, wrapped up in that moment of genius of "hey, what if I tried this ?" and bingo! a new hack is born.
It doesn't feel all that important - until some scum finds a way to use it to download some OS-hijacking malware. The real question is : how on Earth did including the means to parse a URL be considered a good idea when making the functionality list of regsvr32 ?
A part from the obvious "it's Microsoft".
"Since warrantless searches are presumptively unreasonable, and the good-faith exception is inapplicable, the evidence must be excluded."
Can someone make that stick to the current NSA hoovering of everything in order to have a warrant signed afterwards ?
Because in my view, what the NSA is doing is not very different.
Yeah, NOW you do.
But you didn't take it seriously enough BEFORE the brown stuff got widely dispersed, did you ?
And the irony of it all. 67 out of 115000 servers. A 0.0006% mishap that is positively trashing their reputation. I think other hosting services would do well to sit up and take notice. Operating at minimum financial cost is something that can cause great financial cost down the line.
You can go collect your Good Citizen medal. And when you are shot because some spook thought that your habit of smoking on the balcony every evening at 7:45 sharp was the sign that you are in communication with terrorists, you can be consoled by the notion that you tacitly agreed to all this.
Go in peace, citizen: Big Brother is proud to have assimilated you.
I approved of that the first time I heard him say it - and I still approve of it.
And that is something that could actually be made legal. Any donation of above a certain amount and on goes a sticker with the name of the donor (or the org, whichever is paying).
I think that should be mandatory in any country that boasts of being democratic.
This is what it can do :
PWOLauncher : Download/execute file, or execute local file
PWOHTTPD : Spawn a HTTP server on the victim machine
PWOKeyLogger : Log keystrokes on the victim machine
PWOMiner : Mine bitcoins using the victim CPU/GPU
PWOPyExec : Execute Python code
PWOQuery : Query remote URL and return results
This list basically means that are in remote control of infected PCs. They can detect passwords, launch whatever they want and generally benefit from all the resources of the machine.
I rank that as rather serious. I certainly hope it can be detected and blocked by my current AV solution, although I must admit that I tend to not download its targeted carriers (Quick PDF to Word, XoristDecryptor, Easy Barcode Creator, Kingston Format Utility and the others are really not in my interest zone).
And move there personally as well, please.
See how well you do when your HQ is cut off from the rest of the world because the Chairman didn't like a remark you made on Twitter. See how easy it will be to get things running again when you cannot contact any government employee because as soon as you say your name they hang up on you. Try to get a meeting with a high-ranking official and see how it is to be told that he is busy and cannot see you before the end of next month.
You're used to calling the shots around here. I'm pretty sure the first thing Beijing will do is put you back in your place and hard. You'll be begging them to let you run your business again, and they'll keep the leash tight once you've gotten the message.
No, you won't go to China. You're much more comfortable calling senators on a whim.
Sounds great. Any word on security ? Is a single malware going to be able to take over 6000 handsets at that speed ?
No mistake, we are going to need to improve bandwidth, if only because of all the stupid doodads IoT is trying to make us wear (before we grow bored of them). Still, I'd like a modicum of attention paid to keeping things all nice and secure.
Keep this kind of thing up and, sooner or later, a plane will go down in flames. I hope the Police will find him and the judge will make an example of him. This kind of stupidity must stop.
In related matters, it's curious how a journalist coming back from talking with Snowden was detained (however long) under terrorist laws, but in this case nobody is even mentioning the term when lives were clearly at risk.
Well that sounds very professional. We screwed up and we're very sorry that you don't have a backup.
That's not even a Cloud issue, it's a hosting one, but here we go again with the consequences of trusting your data to someone else's infrastructure. Somebody goofed, which happens, and websites were deleted. Okay, human error, statistically unavoidable, but compounded by a total lack of data backup - leaving customers up the creek to provide their own paddle.
Well it's a choice and it was probably in the T&Cs, but I'll wager there are a bunch of websiteless companies that are, at this point, seriously re-examining their level of acceptable hosting costs and guarantees while looking over other hosting companies' offerings.
I know I would be.
I really appreciated that Wozniak clearly stated that requiring a network connection makes things less useful.
At this point in time we are apparently trying to tie ourselves to the Internet for everything we do, and that means that anytime the Internet is not available, we cannot do anything.
In the future, at some point, I am convinced that the Internet will be available everywhere and all the time, with ample bandwidth for all, but right now that is simply not the case. So, while it may be nice when it works, you still need a backup plan for when it doesn't.
I prefer to skip the hassle and go straight to what works all the time, every time.
A hearty congratulations, El Reg, for a very in-depth article on yet more DARPA shenanigans. I do hope that, when the cat is finally let out of the bag, people will remember that it was revealed here first.
Well done. Very well done.
P.S. need a cat icon - or maybe a kilocat one.
"costs of running our services have risen"
Risen is, in this case, a mild euphemism. Tell you what, what would you say if your landlord switched your lease from £200 a month to £180 daily ? Because that is just about what you did.
I do believe you'd tell him to get stuffed and go straight to the beak.
If your costs well and truly have been multiplied by a factor of 10 or more, it only demonstrates very poor planning on your part. Telecoms companies invest billions and raise cents. You may have invested millions, but you are raising fistfuls.
Still, points for wading in and trying to explain without coming off as totally patronizing. I'll check you guys out in a year or so - maybe you'll have learned a few lessons that make you a worthwhile partner by then. For now, I'll pass.
That would have been nice, but history shows that the record company would bill everything to the musicians anyway thanks to contractual clauses concerning advances. I urge you to take a look at the linked article, specifically the paragraph concerning said advances.
Then remember one thing : the majors are not in it for the music, they're in it for the money. Anything they can do to avoid paying, they will.
Correcting recipient addresses does in no way imply that you can read the contents.
What he should have done is set up an application that only shows the recipient list and hides the content. Anyone asking could therefor be shown the application and rest easy that their smutty secrets remain hidden. And he could have lived his life blissfully unaware of the rampant beast lurking below.
