Posts by Pascal Monett

BOFH: Where do you think you are going with that toner cartridge?

Re: Too Often...

That's a ridiculous waste of resources.

What was wrong with just storing it ?

Re: Printer Maintenance Contracts

Nice tactic to never get another contract after that.

What makes you think it's still locked ?

Paper has to be stored somewhere.

Vengeance

The best vengeance is the one that is entirely justified.

Talos names eight deadly sins in widely used industrial software

"Malicious USB devices"

Sorry, but I am less worried about that than I am worried about state-backed miscreants infiltrating and wreaking havoc from afar.

The rule is always the same anyway : once local access is possible, all bets are off and the system can easily be compromised. A malicious USB means some traitor has decided to usurp his position and authority in order to do evil. There are safeguards against that, but the best safeguard is treating your personnel properly and paying them fairly. If they work in a serious branch of industry, they should know the importance of their position and that should be sufficient.

Workday nearly doubles losses as waves of deals pushed back

Re: " Our products are not choices."

Indeed, quite a curious way to say something. Your products are not choices ? What are they then ? Mandatory ?

UK monopoly watchdog investigates Google's online advertising business

We're worried

"We're worried that Google may be using its position in ad tech to favour its own services to the detriment of its rivals, of its customers and ultimately of consumers"

Oh, so you're worried ? Well it's about bloody time. If Alphabet is today's 4th ranking company by value, it's not because it's been playing fair. Google has always played fast and loose with the rules, because it's Google that has made the rules. And now you're worried that Google might not have have established a fair and level playing field when there is nothing in the law that has given it the slightest incentive to do so ?

Duh.

Private companies do not government policy make.

Microsoft slows some hiring for Windows, Teams, and Office

"new hires in that division must first be approved by bosses"

As long as Borkzilla still refuses to have a Quality Control division, I couldn't care less.

This Windows malware uses PowerShell to inject malicious extension into Chrome

More of the usual

"ChromeLoader creates its scheduled task via injection into the Service Host (svchost.exe), using functionality from an imported Task Scheduler COM API"

Typical Borkzilla. More full of holes than Swiss cheese.

GitHub saved plaintext passwords of npm users in log files, post mortem reveals

GitHub stored a number of plaintext user credentials

Oh. My. God.

That is a major boo-boo.

Shame on you, GitHub. You knew better than that.

Spam is back with a vengeance. Luckily we can't read any of it

Thunderbird is indeed pretty good.

That said, I programmed my own spam filter. Granted, all incoming messages hit my Inbox, but then I clicked on Filter and 99% of the time what was left was genuine messages that were for me.

What were my filters ? Check this out :

1) From domain does not match ReplyTo domain - that's pretty simple to check and a golden rule AFAIC

2) From country is not a country I know people from - Russia, looking at you

3) From does not match somebody who I have already accepted mail from - if I don't know you, why should I waste my time ?

4) Subject contains wierd character combinations - nobody puts [(D:!!] in a subject

5) Body contains links to domains other than the From domain - if you pretend to be from Microsoft, your link better point to a Microsoft-held domain

6) Body contains attachments with names that end in .exe - nope, nobody sends legitimate executables by email without prior warning

Ok, there have been a few occasions where a new "colleague" got his mail sent to the spam box, but I can recover that.

More often than not, these rules have been more than sufficient to not waste my time reading a mail with a subject like "Re: <something I've never sent>" and an attachment I wouldn't touch with a bargepole. Or the ever-amusing "Your PayPal account has been locked" when my PayPal account has been unaccessible ever since they implemented 2FA without bothering to cater to the people who hadn't signed up in the 8-day window it was available. Or, another fun one, the urgent mail supposedly from my bank when I don't have an account there.

Thunderbird does a good job, but really, I had something that was almost as efficient and didn't cost me a week of development.

Of course, that was when I still got my mail via Lotus Notes.

Now I have to use Thunderbird. The occasional spam gets through, but I can recognize it almost instantly.

Of course, not using Outlook helps a lot in preventing unwanted hijacking.

Revealed: The semi-secret list of techs Beijing really really wishes it didn't have to import

Western factories ?

Which ones ?

They've all been "outsourced".

Re: "talking about moving to open source software"

Yeah, well that's not new.

Germany is always talking about it, but is mainly using that as an excuse to have Borkzilla lower its license fees.

I don't recall reading about any case where it was done seriously enough to actually allow the project to succeed.

"wishing it had an alternative to Microsoft Windows"

I seem to recall that it does : it's called Kylin. There are apparently already several forks of it.

Kylin is reportedly compatible with "10,000 hardware and software products" and the Android ecosystem.

As far as the chokepoints are concerned, this is the ideal time for China's engineers to rise to the occasion and develop the code to do the job in Linux, which will practically guarantee that their code is what is used in the future where Windows is finally relegated to the games box it deserves to be.

Sure, it'll take some time, but they have the manpower and engineering nous to get it done. A word from Xi Pooh and it's as good as done.

When management went nuclear on an innocent software engineer

"but I would not report the damage back to my head office"

And that is definitely how you get Manglement appreciation - you screwed up, but I won't tell. Thank you ! Thank you !

Recovery from disaster results in ample time to finish the work properly. Well done.

Let's play everyone's favorite game: REvil? Or Not REvil?

"it's most likely a case of using REvil-linked scare tactics to extort payment"

Hmm. What about REvil is starting to feel the summer coming and just wants to lay back and take it easy for a bit with a margherita or two ?

Or maybe REvil is trying a new tactic to find out just how many cowards are going to fork over the moolah ?

Sure, it could be someone else piggybacking on REvil's reputation, but not necessarily.

Twitter founder Dorsey beats hasty retweet from the board

This "takeover" is starting to look like a trainwreck

And Mr Billionnaire apparently can't make enough billions fungible.

I think that should incite into a rethink of a person's personal fortune. You have $100 billion in company assets ? They're not yours until you've sold them and actually converted them into cold, hard cash.

Of course, that would make for a lot less glamorous news titles . . .

World’s smallest remote-controlled robots are smaller than a flea

"The heat is applied remotely through a laser"

So, does that mean that, for this to work, you have to be bathed in laser beams ?

Do sniper scopes apply ?

Ransomware encrypts files, demands three good deeds to restore data

If this was truly a good will operation . .

. . they would just send an email saying "You have been the recipient of a GoodWill message. Do three good things and document them on social media, then send this message to ten other companies. Thank you for your cooperation".

That way, the companies that truly have some good will will be honored for showing it, whilst the other will continue business as usual.

China offering ten nations help to run their cyber-defenses and networks

There are two ways of taking over a country

One is by military force, but that has the bad habit of being poorly viewed on the international scene, and creating resistance on the local scene.

The other is by subverting the country's economy by "helping" with infrastructure, like many of China's "donations" to Africa. Once Beijing has its claws into a strategic part of your infrastructure, you'll find that Beijing's "suggestions" are accompanied by rather obvious implications.

This is the difference between Western politicians and Eastern politicians. In China, they play Go, in the West, they play checkers. Only one of those has long-term implications built in.

UK government having hard time complying with its own IR35 tax rules

"Difficulties meeting the IR35 rules [..] in central government reflect poor implementation"

Given the amount of trouble that these rules are causing at all levels, I would say that that is the wrong conclusion.

To me, that amount of difficulty clearly indicates that the rules are poorly drafted and inherently contradictory, which does not make for easy implementation.

When you've made a square peg to go into a round hole, it's easy to blame the people who can't put it in.

As Microsoft's $70b takeover of Activision nears, workers step up their organizing

"We [..] believe in the right of all employees to decide whether or not to [..] vote for a union"

Right up to the moment some of them decide to actually do that, at which point it's no-holes-barred intimidation and harassment tactics until they abandon that idea.

And I love the argument of "19 employees should not be able to decide". That is a typical strawman argument. You pretend that you want all employees to decide, but that is just an excuse to bash those who do.

And, as far as the USA is concerned, you can replace Activision with any major corporation, they all behave the same on unions because unions will force them to spend more money on their employees and the Board doesn't want to do that (eh Amazon ?).

Now contrast with Luxembourg. In the 1990's I was working my first job as a junior consultant programmer in Lotus Notes. The company was called Computerland Europe, and, at the time, it was going forward in leaps and bounds. New employees were coming in practically every month. It didn't take long for us to reach 50 employees and, when that happened, we were all called to a meeting by top management. In that meeting, we were told that, having attained and exceeded the magic number of 50 employees, Luxembourg law mandated that a union be formed. Our CEO thus told us that we were to form our union right there, and management left the room.

We looked at each other in total surprise and, for some, a little bit of shock. Nobody had been expecting that. So we went about to create our union, electing members (I was one) and following the charter that management had transmitted to us.

And what did this union actually do ? Basically, we made sure that security measures (fire) were known and respected, and being available if any employees had a complaint. I wasn't there long enough for that to happen, the company was still on a meteoric rise. That's not generally the kind of period where employees are unhappy because everything is always changing for the better.

Besides, in Luxembourg before 9/11, if you were unhappy at your company, you could just find a new one, simple as that and almost everybody did it.

So I'm quite happy to work in Luxembourg, because my rights as an employee are enshrined in law and no company can escape that. Of course, there are always the few who try, but they end up against the ITM - l'Inspection du Travail et des Mines and, having done some work there, I can vouch for the fact that they don't pussy-foot around with employee rights. If you have the proof, that company will pay.

Clearview AI wants its facial-recognition tech in banks, schools, etc

Re: Interesting argument

Fines are just the cost of doing business, and that's because the size of the fine does not increase exponentially with repeats.

I would favor a system where, the first time you are fined for a given problem, you get the standard amount to pay. If you are fined again for the same thing (for a relative value of same), the fine is automatically doubled, and so on and so forth.

With that system, the cost of doing business would soon become prohibitive, and slimy gits like Clearview's boss would just have to bow before authority.

Quad nations pledge deeper collaboration on infosec, data-sharing, and more

"the United State in charge of software security standards"

Typical. The USA gets to tell everybody else how to do their job, then sits back and watches the minions scurry.

Why am I not surprised ?

AI-designed COVID-19 drug nominated for preclinical trial

ROTM anyone ?

So it has started. Machines are now designing drugs to be used on humans.

Indian stock markets given ten day deadline to file infosec report, secure board signoff

Re: Shirley...?

There is a world of difference between securing a network and documenting it, and another world of difference between documenting it and writing a government-mandated report.

I take it you haven't written any government reports. I have written a few (unfortunately), and it is not something I enjoy doing in the slightest.

And if it doesn't happen in 10 days ?

What if the companies simply don't respond in the allotted time span ?

Is there any hint of a fine anywhere ?

On the other hand, they could respond with a basic report and mention "See Appendix . . ." for all precisions, the appendices being sent 30 days later.

This whole attitude smacks of useless pressure from administrative busybodies who grant themselves a lot more importance than they have.

Businesses don't want to be hacked. Most of them do want to be secure, and a fair proportion of them actually put money on the table for that. The thought behind this new rule may be commendable, but granting a 90-day delay (given that businesses are already on a 60-day delay for something else) wouldn't kill the donkey.

About half of popular websites tested found vulnerable to account pre-hijacking

The problem is convenience

Sure, it is very convenient to Sign in With FaceBook/Google/Microsoft.

On the other hand, security experts have been constantly repeating for years that you should not use the same passwords for all sites you sign up for.

How does that compute ? It doesn't. Where does that get us ? To this sort of problem.

I never sign up with any 3rd-party identifier. I manage my own passwords and I don't sign up to social platforms (well, Google signed me up for Hangouts when I got my Gmail account, but I'll be damned if I use it).

I'm glad they found solutions to correct the issue, but I still won't use those kinds of services.

Good luck hijacking my 24-character passwords.

Florida's content-moderation law kept on ice, likely unconstitutional, court says

Technically, everyone.

And everyone sees noon at his own door.

That is why these sort of discussions very often result in screaming matches. Everyone believes they are right, but not everyone can listen to someone else's arguments.

That said, not everyone is capable of presenting a reasoned argument either.

AWS puts latest homebrew Graviton3 Arm processor in production

Take that, you x86 dinosaurs

We can take that. The Graviton3 is not the comet to end all x86s.

Don't worry, we'll still be around for a loooong time.

Beijing reverses ban on tech companies listing offshore

Xi Pooh has a big problem

His country needs capitalism to progress, because communism has amply demonstrated its dismal failure, but Xi hates money and the power that goes with it because he wants to be the only one with power.

So he enacts decisions destined to beat down any head that rises out of the ranks, which will keep his country's progress hobbled to a rate that he thinks he can manage.

Nvidia brings liquid cooling to A100 PCIe GPU cards for ‘greener’ datacenters

NVidia has experience with liquid cooling

I have an RTX 3080 and, although you might say that it is air-cooled, there is still a bunch of liquid in there to get the heat from the GPU to the fans.

I wonder how that will work for the datacenter. For the moment, the A100 doesn't seem to be liquid cooled, but it sure is outrageously expensive.

How to find NPM dependencies vulnerable to account hijacking

"an opportunity to preempt this threat"

Here's another one : don't download anything to your production server before validating it on your test server.

Because you have a test server, right ?

RIGHT ?

Beware the fury of a database developer torn from tables and SQL

Re: I've heard all kinds of stories like this

On a much tamer note, I know of a database consultant whe had a thing for the name Alice, and tried to shoehorn that name in somewhere every new job he had. That is why there are a number of servers in the world that are probably still named Alice to this day.

South Korean and US presidents gang up on North Korea's cyber-offensives

"confrontational"

I'll bet he is. He doesn't want to roll over and let the northern lunatic take over the south.

I'd be pretty confrontational too, if I had a dangerous megalomaniac for a neighbor.

US fears China may have ten exascale systems by 2025

"declined to make public any [..] figures that would demonstrate their true performance level"

And why would China make figures public ?

Much better to keep everybody guessing.

Microsoft patches the patch that broke Windows authentication

"patches to fix patches seem to be becoming a little too common"

Okay, I'll be the first to admit that networking is not always easy, especially when you're a vendor with an uncountable number of variations to handle.

Still, I stand by the idea that having a Quality Control team to test and wean out the at least some of the problems would go a long way to make these out-of-band patches rarer than they are.

Microsoft Bing censors politically sensitive Chinese terms

You still can't have your cake and eat it

"an internet platform cannot facilitate free speech for one demographic of its users while applying extensive political censorship against another demographic of its users"

Well, it seems that Borkzilla (et al) must make a choice : either it is for free speech, or it is for raking in the dough in oppressive dictatorships.

It's going to be interesting to see how this goes.

Failed gambler? How about an algorithm that predicts the future

Re: Half full or empty

I reject that argument entirely. As far as I'm concerned, if you're asking the question, the cup needs to be refilled.

US recovers a record $15m from the 3ve ad-fraud crew

Great news

"A little more than half of the illicit proceeds, $15,111,453.84, has since been transferred from Swiss bank accounts to the US government"

So Uncle Sam gets a windfall, but the companies who paid for the non-existent ad views get what ? The satisfaction that that particular crew isn't scamming them any more ?

Cisco warns of up to $720m sales loss: Blames China lockdown, Russia pullout

"meaning a drop of $131 million to $720 million"

I would really like to be able to drop my revenue to 5.5 times its current level.

That's a sacrifice I'm willing to make.

Bing! Microsoft tests search box in the middle of Windows 11 desktop

"while Microsoft plays with the concept"

Microsoft : playing with every single concept it can think of apart from making its OS streamlined, out of the way, functional and fast.

American Airlines decides to cruise into Azure's cloud

Wait a minute

"speed up bag tracking, enable preemptive rerouting based on weather conditions"

Isn't that stuff they're already doing now ? With computers ? What exactly is the improvement AA is expecting after having spect weeks, if not months, handing their current system over to the single-point-of-failure platform that is Azure ?

And when Azure is down, will that mean that pre-emptive routing will not work, or will AA keep the existing system as an emergency backup (yeah, as if that would happen) ?

Landmark case recognizes Bored Ape NFT as an asset

BAYC

Oh, those images I can find in an instant on Google Images ?

And some people paid money for that ?

The depth of human stupidity knows no bounds - especially when they're full of money.

Hot glare of the spotlight doesn’t slow BlackByte ransomware gang

"living-off-the-land binaries"

Now that's new to me. What on Earth is that ? Notepad ?

Google Russia goes broke after bank account snatched

Re: woke-global-climate-change-bullcrap

You can beat that drum as often as you like, the climate is still changing.

Microsoft-backed robovans to deliver grub in London

What's the bandwidth on these things ?

A terabyte of data every minute is a rather tall order to transmit via WiFi, even with 5G. Also, 60TB of data is one heck of stack of hard disks to put in the trunk (or boot), and driving for one hour is not all that uncommon. What is the data retention policy ?

So how is the car linked to the Azure server, and what is being sent/received ?

Also, when the learning phase is over, what kit is going to be left in the cars ?

Voyager 1 space probe producing ‘anomalous telemetry data’

"Voyager 1 is now 45 years old"

Dear me, and they're thinking of doing a software update with 160b/s of bandwidth ?

Yikes.

Some people are really hardcore.

Your snoozing iOS 15 iPhone may actually be sleeping with one antenna open

"wireless chips can no longer be trusted to be turned off after shutdown"

So it is true, the mafia types are right to put smartphones in lead boxes when they meet.

Apple scraps 3-day return to office amid COVID-19 cases

"not everyone is yet ready to return to the corporate altar"

No kidding.

The one good thing about COVID is that it has amply demonstrated that going to the office is not a requirement to being productive.

Oh sure, for the insecure managers who like counting heads, yes, having all your minions on hand must be very satisfying indeed, but unfortunately, your minions have worked off-site for almost two years and productivity has not gone down.

You're going to have to live with that fact now.