Posts by Pascal Monett 19429 publicly visible posts • joined 10 Apr 2007
Right.
Continue conveniently ignoring the pollution WE have created during the past century at EVERYONE's expense for OUR OWN benefit.
Hint : we live in INDUSTRIALIZED countries. China and India are industrialiZING. You can't seriously expect them to not want what we have, now can you ? Neither can you tell them to not do what we did.
That idea is directly on par with having to send an email to IT support when your PC does not work.
The solution is not always email. The solution I employ, as a contractor, is to go the person responsible for hiring me and telling him that I can't work because I don't have a login. Cue embarrassment and a quick call to some IT person and the problem is generally solved in the hour. If I am told that I can't have login before tomorrow, I then state that I will be back tomorrow and leave because otherwise I have to bill them.
Up to now, I have never met a manager who does not prefer not being billed and getting started the next day. Personally, in these days of cash scarcity, I can't imagine a private company's department manager who would dream of paying me a day to do nothing, let alone a few weeks.
Governmental organizations are, admittedly, different. Wasting a whole morning before finally getting a working login is par for the course. If I don't even have a desk, there's generally some meeting to wait for anyway, so it's not like I don't know how to "look busy" in the meantime.
All its personnel, and board, should be fired and replaced by an entirely new group of people who are actually concerned about making the Internet work correctly.
Burning the bridge is not always a solution, I know, but this is no longer an organization working for the community - it is a group of people systematically subverting everything they consider counter to their private interests, and such behavior should be labelled criminal and pursued as such.
The bare minimum is to get ICANN out of California. Ship them to New York or something, where they won't have it so easy in every way.
But people do expect and demand them - these days anyway. Such is the hoopla around this issue that any company not offering bounty is pointed at and sternly looked at until said company relents and starts a payout plan.
There have been too many examples of bug hunters ignored or taken advantage of to avoid this situation today.
I note with interest that LinkedIn seems to have found a way to retain the talent and avoid the chaff. I wonder if other companies will take note and copy the method - if they aren't already more or less doing the same thing.
Not really.
I think that it is illegal in most countries to hide your face in public.
That is why the bank robbers in films always put on their balaclavas right before going into the bank. If they walked all the way there in public, they'd be arrested long before they got to the bank door.
Why give up one for the other ? With today's prices, I took both.
An Intel i7 quand core is currently 350€, and for that price you can get a nice Intel 300GB SSD to boot your system on.
Add a 3TB spinning rust SATA disk to store you work data and you're good to go.
You say it's easy to fix, then you list a bunch of items and state that it "is doable with a competent IT team" - meaning you acknowledge that all that is decidedly not easy and requires expertise.
If it was easy to do, every company would have it included in whatever OS they use and it would happen automatically - like connecting to the network via Ethernet or WiFi.
But it is not easy at all, which is why most companies, even sizeable ones, do not have an intrusion detection system, do not run vulnerability scans (automated or not), nor do they have the luxury of restricting root access because most of them use IT as they use Word - as long as it works, forget about it. Hell, we can be happy if most of them have any kind of anti-virus installed.
Not that I approve that behavior, but that's what they do.
Twitter is starting to look like a molesting uncle, allowing 140 characters of service provided you accept videos to be automatically thrust down your bandwidth.
I wonder how long it will take for Twitter to decide that you don't get to turn off the auto-run feature because "their customers (ie advertisers) clamored for it".
In any case, I salute the start of Twitter's bold march into oblivion.
Can't wait for it to get there already.
"The update process runs with system-level access. It unpacks the ZIP file without checking the paths of the files inside, and with full read-write permissions on the device's file system."
Um, is there a "malicious file" that uninstalls all the bloody crap that Samsung throws in on top of the stuff I need ?
Because if that's the case, tell me where to go and I'm there.
Not to be nasty or anything, but since when does a company care about ads from other companies ?
If an ad-blocker is deployed company-wide, the only logical setting is to block all ads all the time, with exceptions made for sites that detect that and play coy with their data until you allow ads again.
In that case, the decision should be made as to whether that site is important for the company or not. If not, block that site permanently.
Not knocking the work, and certainly not the results, but when these guys say that this research will be invaluable for future reference, is that really the case ?
We all know about buffer overflows, yet that door is still open in almost every new malware report. Sometimes they even concern products made by big companies who definitely know better.
This new report is bringing to light some new obscure chain of consequences that constitute a vulnerability. Great news, but who exactly is going to pore over this to understand what is going on and how to avoid it ? Security researchers, not application coders.
When I search for "good programming practice", what I find is stuff that generally concerns code clarity and maintainability, rarely security.
In the best case, there will be a mention of using fgets instead of gets in C, because buffer overflow. But the rest is all about indenting, variable name formatting, function wrapping and commenting. Nothing to do with security.
We need an easy-to-read overview of good security practices that does not just say "check your inputs" but details what to check and how to make sure. Is that available somewhere ?
Manager : Um, we're going to need some user data on the survey
Coder : Sure, I can return the IP address, the user name and the account ID
Manager : The name is good, but we'll be needing the account number as well, and the email address
Coder : But I can't hash that data securely on the client side
Manager : no problem, put it in the URL - nobody ever checks that, right ? I never do.
Coder : But that's not secure . .
Manager : We need it yesterday, so get cracking. We'll do security in the next version
Yeah, one or two.
Million.
Or is it billion ?
Because the ESC key is part of the Windows UI. It has a very specific function, coded into the Windows UI and should be automatically understood by every program using said UI - which is pretty much every application ever written for Windows.
We have been using the ESC key since Win 1 and now they want to replace it with a bloody fake helper designed to hoover up even more private information ?
Thanks for the warning - I'm staying on Windows 7.
I have long remarked to everyone that Wikipedia is the encyclopaedia that "everyone" edits.
However, with time I have to admit that it is getting better, and the editor snafus and diva issues have apparently come somewhat under control.
I don't know how cutthroat the wiki editing scene is now, nor do I have any idea if the internal kingdoms are still in place, but viewed from the outside, Wikipaedia is apparently actually useful now.
Of course, I have this opinion only on scientific pages. I still stay away from celebrity pages or pop references as much as I can.
And it is going to borgify all existing anti-virus applications.
Then if will "plug into" any app that starts up, "for security reasons".
Then it will "plug into" your mail, to do preemptive security.
Finally, it will "plug into" your bank account, for your security obviously, but there it can more conveniently send itself money every month. Because it would be so bad if something happened to your data, wouldn't it ?
All of that, of course, at the disposal of any US judge who thinks that the data might be relevant to the case he is presiding.
Only if you think that demonstrating your level of insecurity to the world is silly.
Personally, I think it was brilliant. They got in, lounged around for weeks, if not months, and then finally got detected. They're probably analyzing activity logs now to find out why they ended up begin caught, so as to "survive" even longer next time.
This is pure gold for everyone. For the hackers, who have taken a magnificent opportunity to see their baby operate in what is supposed to be a very secure environment. For Kaspersky, who had the guts to go public on this and now has reams and reams of data to analyze and further lock down their processes and network. For the public, who once more has proof that nobody is "secure". What they'll do with that knowledge is another matter.
You mean Alexander's Macedonian empire, right ? The one he carved out before his 30th birthday, conquering the entire known world of the time, right ?
Seems to me that one was the one fit for your sentence.
Actually, it's reports of its life that are an exaggeration.
Nothing I use anywhere is based on Silverlight. No web site I use makes any mention of it. I'm sure there are some out there, but they're beyond my horizon. It might as well be dead for all I see of it.
Especially UK ones.
Because however bad I mess things up, I always have this kind of thing to reassure me that I'm not that bad.
First day launch on the day that people absolutely needed it ? Very bad idea, and this is why. New launches are never cut-and-dried affairs (ask Blizzard, and they know what they're doing), but timing the launch with mandatory registration is just asking for trouble - which they got in spades.
There is just one thing I wonder about : is there anybody in there that learns anything from these snafus ? Seems to me that UK gov is staffed with a load of Charlie Browns. They never succeed at anything, and never get better even though they continually set themselves up for another go.
Excuse me if I'm slightly confused, but if the same family has the two identical cars, then what's the use of going hog-wild with one of them and getting the other one indicted for it ? It's still them that ends up with the bill (or the Police at their door).
Your second example is better - except that speeding carries a lesser fine than sporting a license number you have no right to. When you get caught for that you're not getting fined, you're going to jail. Not worth it unless you're already a hardened criminal.
No, really. We're heading straight for an energy crises and they want to find a way to pump yet more energy than we already are to power - in the least possible efficient way - stuff that is patently useless and possibly privacy-invading.
I do hope these jokers are getting a good salary out of the moron paying for this "research".
I tried to find out how long this Amy had been in charge, but the website of the BPL mentions no date information for anyone - not the President, not the Board members. No timeline of any kind.
So I am a bit torn when I read that she complains about no records being put in place. Nice to complain when stepping down, dear, but what did you do about it when you were in charge ?
Maybe she did do something, or try to do something, but I can find no record of that either.
In final analysis, however, it is the Board that is ultimately remiss in its duties. Not having a catalog of acquisitions is really a disastrous display of not being aware of their responsibilities.
Unfortunately, every person who buys a new PC will be recorded as buying Win One/Zero.
You do know that that is how Microsoft has been trumpeting the success of every single OS release since the beginning of time, don't you ?
Getting actual usage stats on the different OS versions has always been the province of the Internet, using various unreliable metrics (such as IE11 users have to be post-XP, but nobody knows if Vista or Win7).
Getting the straight dope from Microsoft has been impossible from day one, and for good reason : Microsoft is loath to show just how much every OS version apart from 7 is being treated like the plague.
Yeah, because only actual experts are going to click that button.
I would agree with you, really, and I would dearly like such an option, but I am aware of human nature, and I just know that there is a gaggle of blithering idiots who consider themselves experts because one day they managed to schedule an automatic backup.
So I think I get why Microsoft does not include such a button. If you really are an expert, you know how to get to the proper parameter in the Control Panel or, at worst, the Registry.
So I take it that you think the Ribbon is superficial ?
Well I have to say, given the amount of comments I have personally had in the last 4 years as a trainer, there is a chance you may be in the minority on that point.
Especially when confronted to people who know Office 2000 shortcuts by muscle memory and feel that Office 2013 is literally pulling the rug of productivity from under their feet.
In any case, I have to say that I find all this new UI stuff very amusing in light of the fact that, back in 1996 when I was studying to become a Lotus Notes consultant, we were - in all seriousness - given a copy of a report emanating from Microsoft on the importance of the UI and its stability.
One of the most important points was that, if a menu was more than 3 layers deep, you needed to rethink the menu structure. Three was the maximum admissible. Then there was the color conventions, with alerts to the fact that different cultures viewed alert colors different (red does not always mean danger in every part of the world).
I have the feeling that Microsoft has lost this report. If they need a copy, they should ask me.
And ?
In Linux, even though I am almost a complete n00b on the subject, even I know that you can choose which UI you want if the current one is not to your liking.
I would really like you to show me a site where I can download different Windows shells and try them out as I please.
Actually, scratch that. If that was in any way allowed (note : I did not say possible) then all that hoopla around The Interface Formerly Known As Metro would have been but a footnote in Win8 history.
Holy crap ! The US of A is overrun by terrists and now they have free reign to wreak havoc and mayhem as they please !
The thousands of police, FBI agents and all the US military strength will not be able to do anything unless mass surveillance the investigation is put back in place NOW !
It would appear that issues of privacy are much like insurance contracts in Joe Public's mind : you never understand how important it is until you need it.
I really would like the general public to be a bit more aware of the possible pitfalls of leaving all the details of your life in the hands of a third party which has next to no legal obligation to even listen to your opinion on the use of that data, but, as in everything IT, it would seem that millions of people will have to be bitten hard before any actual measures will be enforced.
In the meantime, I will be avoiding or blocking any and all source of information-gathering that I possibly can.
The problem does not appear to be the amount of time they put into thinking about the program, but how much they forgot to include in the design specifications in the first place.
Apparently, the notion of Privacy did not manage to be even invited to the discussions.
You're entirely right.
Unfortunately, fools make up 95% of the tech market.
This is one bandwagon that is NOT stopping anytime soon and, like blood in the water, the marketing sharks are already in a frenzy. The bonuses will be staggering.
And when the brown matter really starts hitting the revolving blades, they will safely retreat behind the old "but we didn't design the thing !" excuse, keeping their bonuses.
Doesn't matter. This is one game I'll be watching from the bleachers.
Or even not at all.
Well, it never has foreseen any problems, now has it ?
Yet, problems have cropped up.
Maybe nothing will happen - entirely possible that this one second thing is not actually an issue. After all, managing time synchronization across a WAN is an old problem which, I'm sure, has ample documentation. Then again, Apple somehow forgot the existence of time zones not so long ago.
So maybe they need to dust off their crystal ball ?
I don't like it one bit.
Not for whatever reason Microsoft is doing it - I'm sure that somebody over there has thought of some good reason for it.
No, what I don't like is the fact that, if Microsoft can detect that it is running in a VM, what's to stop a virus from doing the same ? And adapting its behavior to try to "break out" ?
Note that I have no idea if this is possible, I'm just worried about the possibility.
Benefits offered :
- false sense of availability (when it's down, you can't do anything about it)
- no sense of security (ahem, NSA, National Security Letters, and any effing judge in the kingdom of USA who decides that the world is his oyster)
General Direction of the Industry :
- aka "herd mentality"
- basis of the availability of all those identity hacks and leaks because actual security is hard and listening to marketspeak is soooo much more reassuring than reality
To clarify :
I am quite sure that the Cloud (ie virtual servers managed by someone outside your organization who is not subservient to you) has its benefits.
I am equally certain that business-critical data has nothing to do on the Cloud without proper encryption and security measures implemented by the business without counting on any promises made by the provider.
And there have already been accounts of cloud providers going down in a day because of hack - and your data goes with it.
So, as far as the cloud is concerned, my opinion is to treat it like gambling : only play with what you can afford to lose.
