Posts by Pascal Monett 19492 publicly visible posts • joined 10 Apr 2007
Yes, building a foundry is costly. Yes, it will take years, maybe a decade before said foundry actually makes a return on investment.
Guess what ?
Some things take time to be realized and, if you can't wait, you won't reap the benefits.
Too bad for you.
The discussion is still open on that point. Maybe when the Sun goes into its red giant phase it will indeed swallow our planet, or maybe the Earth's orbit will have changed because the Sun's gravitational pull will have weakened.
Either way, Humanity will have to have evacuated long before, or it will already be extinct and the fate of Planet Earth will no longer be a problem.
The enemy hardly needs biological weapons. A space-faring civilization capable of spanning the mind-boggling distances between stars will just chuck a 20km-wide asteroid at our planet and wait two (twenty ?) years for the fallout to wipe eveything out.
Then they can colonize and mine our planet for whatever it is they think they're looking for, or just use the planet as another host for their ever-growing population.
I must agree with you. The answer to the question "Why does software require so many urgent patches?" is that the security landscape is continually changing.
Okay, that does not give a free pass to not sanitizing inputs - that should be punishable by a dozen lashings - but you can build a product with care and attention, making sure to protect against all known vulnerabilities, and then bam! A month later, a new type of vulnerability appears and you have to correct for it by patching.
That is the truth, but it should not hide the lazy programming many products are guilty of.
After reading this article, I have the feeling that there are several issues that are at the root of this problem.
First, there's the fact that ServiceNow has had to amend its platform to bolster security. That tells me that their handling of security wasn't properly thought through in the first place.
Then there's the fact that, despite having amended the platform, customers are still getting it wrong, which points to a possible lack of clarification in the documentation. It's difficul to write good security documentation when you're tacking on a new process that changes everything.
Finally, there's the fact that customers don't have time for security, they just want things to work. Maybe some customers gave it a try and found that their new configuration broke their processes and, instead of correcting the processes, they reverted to the old, insecure configuration. Maybe some customers just didn't understand the problem and left everything as is because they had enough trouble getting it working in the first place.
In any case, this whole affair demonstrates just how important it is to establish proper security from the start. Making such corrections after the fact is always a problem in itself.
I wish as well, but enough billions have spent for no result that I seriously doubt that this sudden uprising of virtuous indignation amounts to any meaningful difference with the past.
You'd have to eliminate all current pigs-in-the-trough for this to have any meaning. That means getting rid of Fujitsu, Capita and any other "consulting" firm that has given les than mediocre results.
But of course, that would mean needing to find new companies to arrange brown envelopes and endless budget overruns and delays.
One day, one fine day, you might finally ask yourselves where the real issue lies. Maybe it's not the consulting firms ?
Maybe you need to get rid of the useless cruft that thinks it can make decisions. You can't do that ? Fine, here's another solution : name a responsible for every new government project. If it does not succeed, he is retired and stripped of all his medals and UK whatnot.
Sometimes, the knout is the only answer.
I would hope that is true, but given that the entire project is based on the work of a US Government agency and that there is no reason to not believe that the CIA (or other agencies) is actively involved in it, I somehow doubt that that is entirely true.
I'm sorry, doesn't that mean that AI companies are defending their ability to lie ?
And that has been accepted in a country that continues to endlessly chant God Bless America ?
You guys do know that the Ten Commandments include "Thou Shalt Not Lie" ?
Hypocrites.
You missed this part of the article :
"Binary Defense is due to publish a report on Thursday about the cyber-break-in and lessons learned. "
If they're already writing up a report about lessons learned, it seems to me that the details are known.
Maybe not by you, but they are known.
Just like kidnapping.
It was made a crime to pay a kidnappers ransom, result : no more kidnappings for ransom in the US.
Do the same with ransomware. When there is no more money to be made, the only attacks left will be those of state actors who have other interests in mind (my how that sounds better <shudder>).
Excuse me ? If you're laying me off I will not sign that and I will talk about it. Now what are you going to do ?
How is it that this kind of thing is legal ? At the very least, I would have thought that someone being "forced" to sign that NDA would go directly to court over the matter.
Look, I'm very glad that you dismantled a violent criminal network, don't get me wrong, but I can put 200kg of anything in the back of my Skoda Fabia.
That is not an impressive amount to me. Can't you find anything better ? In the boatload range, for example ? I don't know, a ton or more ?
200kg sounds like a Saturday at Cosco. If these guys were such criminal masterminds, you should be able to find that under the sofa.
Just one question, Nadella : have you planned on shutting down Borkzilla in five years ? No ? Then why is your Long Term limited to five years ? Are you planning on leaving before that and you won't care any more ?
Your customers, the ones who pay for your product, definitely plan to be there in five years and long after. It is exhausting to continually read that software companies are the ones who decide how long their software is supposed to be used. It's not like that. You're a multi-billion dollar company. You put out a critical piece of business software, and YOU FUCKING SUPPORT IT UNTIL BUSINESS DOESN'T NEED IT ANYMORE.
That should be enshrined in law.
I'm glad that industry people are starting to fear that the projects they make money out of and pay nothing for just might end up not being supported any more.
When that happens, maybe industry will think of a remuneration package for new maintainers. Oh, of course, it will be new young maintainers with a vast lack of experience and all the problems that may ensue but hey, you only have yourselves to blame for that.
I absolutely do not approve this internet warfare, but one thing that is apparently even more certain is that critical infrastructure needs to be secured and never has been because nobody ever decided it was needed. So it's been available for attack since forever because who cared ?
Well now, it is needed and everyone cares, so put up the money, get the training, and get those critical infrastructures secured. You've been coasting on ignorance and complacency long enough.
Maybe it can, but if it hands out the same abominable mess that MS Word dishes out when you wish to save in HTML, then I will do fine without it.
That said, I have seen the results when asking ChatGPT for a LotusScript function that checks all the documents in a Notes view and I have to admit, while I wouldn't have written it exactly like that, the code provided does work, so maybe, just maybe, there might be a possible future where you could ask WhateverGPT for a functional Windows kernel without the cruft and get something that actually works and respects your computer (and allows you to play your games).
Here's hoping.
Well it's backed by China, so duh.
It is so duh that experts reviewed it detail because obviously they would.
So I applaud this initiative, but I wonder exactly what good it will do. It's kind of like the wishlist of nice things we'd all like to have but have no way of getting yet.
I hope the ensuing comments will create an outline that could finally become an actual standard. Adding that to my wishlist.
Gosh, it's almost as if Redmond never actually rewrote the Windows Core since XP and just kept piling on the cruft and arbitrarily deciding, via UI "upgrades", which was the next version.
This nonsense with hardware requirements is just the latest in the glaring pieces of proof that Borkzilla is phoning it in rather than actually working on its product.
Of course it wants everyone on Win 11 : that's where The CloudTM is, which means more monthly revenue because nickel and diming functionalty instead of providing it out-of-the-box.
Nobody is surprised. HPE (the Board) is a bunch of vultures. Not taking into account their own due diligence is not something that will keep them from looking into the mirror and finding that everything is fine.
And you can be sure that, at the end of this year, they'll find a good reason to give themselves more humongous bonuses after having tearfully announced yet another round of layoffs.
It works.
And the more IPv6 was foisted upon us, the more we realized how simple (and therefor robust) IPv4 really was.
The academics can bang their IPv6 drum all they want, the rest of us just want to get doing what we need (or want) to do. And, if the IPv4 boot still fits, why change ?
I am adamant about one thing : I do not want to become a full-fledged administrator just to have my home PC, a few laptops and several mobile phones connected to my Orange box and, therefor, to the Internet. With IPv4, it's a breeze. With all I read about IPv6, it would be a nuisance. And I will do well without having to explain to my wife that her normal web sites don't all work today because somebody did something to the IPv6 connection. No thank you.
So I don't want IPv6. Not before you pry my IPv4 NAT out of my cold, dead hands . . .
These days all you hear about is quantum, AI and financial scams cryptocurrency.
And you rarely ever hear any bad things about the first two.
It's good to learn that there are still pie-in-sky ideas that can be shot down by any person with a sane mind aware of the requirements.
Now that I have learned the requirements of QKD, I will know to not be impressed by the next snake-oil prophet that tries to pull a fast one.
Thumbs up from me for this article.
To be sure, except that repayment will not go into Redmond's ample coffers, so why bother ?
I don't know what it will take, but it took over three decades of Windows bugs and snafus to get the DOD to politely hint that enough was enough, so it'll be a while yet before the principle of defensive programming is applied generally (I would say that proper explanatory popups should be included in that method).
So I gather that there is consensual deepfake pornography.
What is that ? Is that when some guy (because of course it's a guy) takes an image with a pornstar and deepfakes his wife's head on it ?
Because if it's not that, then I can't image what consensual deepfake pornography is.
Could somebody educate me ?
Wow. Talk about anthropomorphisizing stuff.
Oh, now I get it : an arrangement that suits Oracle's belly button bottom line ?
Sure. Why didn't you say so ?
