Posts by Richard IV

Google guru roasts useless phishing tests, calls for fire drill-style overhaul

Why does phishing work?

The thing that never seems to get mentioned when discussing these so-called fixes is why phishing is so easy.

Internal corporate comms to employees is appallingly bad.

• HR contacting you from 17 different email addresses, some of which are personal.
• "Important" messages from the CxO that could be your pay review or that the company has won an award.
• Messages from third parties like your pension provider that come from random domains that don't look anything like a company that you recognise and have password protected pdfs.
• Newsletters from external domains because the marketing department are using some random tool that looks pretty.
• Surveys on forms.office.com or a shared google doc that could be from goddamned anyone and 50% of the time you'll eventually get nagged about filling it in because the management team want "engagement".
• I could go on...

As much as I hate to say it, the banks are getting fairly good at including "here's how you know it's from us" in their messaging. I want similar cues at work. I want mechanisms to be able to verify that it really is important and genuine:-

• HR messages could be duplicated in the HR system. Email notifications just a courtesy.
• The CxO could have a blog only visible internally - sure, send me email notifications if you like.
• Companies could force trusted third parties to improve their comms. An internal message with an ID that the third party will/has used to back it up.
• I don't think that anyone who has ever been auto-subscribed to a newsletter ever has cared about the prettiness.
• If surveys are _that_ important, then they should be hosted on domains that _you_ control. And no, I absolutely don't mean "yourcompanyname.somerandomthirdparty.com", I mean "somerandomthirdparty.your.domain". It needs to be nigh on impossible that some rando has set it up.

Fix all that and phishing becomes orders of magnitude harder. It's all very well having fire drills to improve the current "fear all burny stuff" approach, but eliminating the combustible material is far more important.

Not only that, but you can then add in extra stuff on the mail servers to do things like blocking "HR" or "CxO" messages that don't meet the standard. If it really is an internal person trying to send the message, train them about the ban hammer and why it's important.

BOFH: Something's consuming 40% of UPS capacity – and it's coming from the beancounters' office

Re: I love the smell of burning beancounter kit in the morning

The Batenburg LeydenJar conjecture is a keeper...

Presumably it's an effect where 2 UPS's of inverted polarity are connected in parallel and partially fail leaking a pale emulsified dielectric material.

Not to be confused with the Viennetta LeydenJar conjecture with many parallel UPS's of matching polarities and the leak is a pale liquid dielectric due to coolant failure.

File Explorer fiasco: Window to Microsoft's mixed-up motivations

Bill Hicks was right about marketing people

Around about the time Tivos became a thing, and the big old media companies were claiming that the Tivo's shiny new ad skipping feature was a form of stealing, someone wrote in to one of the big papers pointing out:

* back in the 1950s and the dawn of commercial television, there were 10 minutes of adverts per hour during the Superbowl, but that was part of the deal to watch it for free.

* now it's $70 per month for a sports package and there are 15 minutes of adverts per hour

* who is stealing from whom?

Twitter CEO Jack Dorsey says Trump ban means the service has failed

Re: No acknowledgement

Quite. They wouldn't be in this position if they hadn't decided to carve out that magical world leaders' anything goes zone because of and for the Insurrectionist in Chief. Their failure is in the belated realisation that some things don't go and, what's more, affect the bottom line.

It's not that the heuristic of what goes is particularly hard. Just as things you wouldn't be worried about your granny seeing form the basis of "safe for work", things you wouldn't criticise as despotism when practiced by (say) Iranian officials feels like a reasonable one for world leader behaviour.

Developers renew push to get rid of objectionable code terms to make 'the world a tiny bit more welcoming'

And yet...

No one is bothered that child processes do most of the work.

I've been known to gob on Lord Londonderry's statue in Durham. (Not recently, for obvious reasons) Amongst many other bits of bumholery he opposed the banning of child labour on account of it being more expensive to build adult sized tunnels in his mines.

The thing that I hate about this particular trend is that people are objecting to new metaphors because the origin of the metaphor is objectionable.

That, though, is precisely what makes them memorable, useful, and a permanent if obscure reminder that that origin was a bad thing. It's a form of cultural appropriation that I very much approve of in the hope that the bad origin will become obscure enough to not be the first thing that is thought of in usage. I don't literally support the tearing of flesh whence comes sarcasm, the forced euthanasia of sardony, or open street slaughter and butchery implicit in a shambles. Nailing ears to pillories is perfectly fine, however, as it's a wonderfully elegant way of having optional early release.

The kind of friendly world _I_ want to live in is one where future generations are surprised and shocked to find that the word slave was ever applied to humans. Attempts to force us exclusively to do so should be actively discouraged.

BOFH: Will the last one out switch off the printer?

Re: Mmmm

The best bit is that gram flour is just about the only flour that no-one seems to be buying... yet.

House of Lords push internet legend on greater openness and transparency from Google. Nope, says Vint Cerf

It _is_ like a recipe

Fine, it's not like a recipe in the computer program sense, but if what if we approach it from the more common cookery angle? There's a list of inputs and amounts, a set of instructions and an end result. Like the food industry, the manufacturer wants to keep the ingredient proportions and their magic method secret but Google and their ilk need to realise that we should be be able to assess their inputs and outputs for regulatory purposes. Ingredient lists and safety checks are mandatory for food; what is the data processing equivalent?

Just as meat content and lack of botulism are important when talking sausages, secret additional data collection and unfair biases are important when talking about search.

Icon as I don't want that in either...

Londoner accused of accessing National Lottery users' accounts

Sketch artistry

They used to. One L.Haines esq. (see https://www.theregister.co.uk/Tag/Playmobil)

We, Wall, we, Wall, Raku: Perl creator blesses new name for version 6 of text-wrangling lingo

Classical shoehorn

I'm rather liking that you found a quote on a metamorphosis by "Ovid"

Hacker House shoved under UK Parliament's spotlight following Boris Johnson funding allegs

It certainly seems to be something to do with Administrative Affairs.

'Cockwomble' is off the menu: Uncle Bulgaria issues edict against using name in vain

Re: Confused

Cockwombles are probably somewhere around the femtoHopkins scale, although it's hard to be accurate with these kind of magnitude differences.

US Republicans bash UK for tech tax plan

Re: An easy solution

Not just intracorporate IP transfer; capital transfer too.

That the bank of Mum and Dad doesn't charge interest and doesn't charge naming rights should be a core principle embedded in the tax system.

Intellisense was off and developer learned you can't code in Canadian

I've never quite understood

... why properties involving color aren't just overloaded with a colour version. Similarly for center.

Mind you, colo(u)r has to be one of the more phonetically incorrect spellings out there. Without the u it's even more so.

Transparent algorithms? Here's why that's a bad idea, Google tells MPs

Re: Cooking instructions are an algorithm?

Taking the cooking analogy further, food manufacturers are required to list the ingredients for their produce in reverse quantity order but not the actual recipe.

The algorithm is thus hidden, but everyone knows the parameters.

This hasn't stifled innovation in the food industry; rather they use a thesaurus for masking the ground-up chicken bones as calcium from avian sources.

Shock! Hackers for medieval caliphate are terrible coders

Re: C'mon, ElReg.

On the plus side, it sounds like they're making quantum leaps in their techniques.

Alternative glosses are fun.

Coulson GUILTY of conspiring to hack phones between 2000 and 2006

Re: Rebekah Brooks innocent?

I'm even more amazed that Brooks wasn't found guilty of conspiracy to pay public officials when she said that's precisely what she did do, in front of a parliamentary select committee, no less, in 2003 (http://www.youtube.com/watch?v=v1AJjnl2y8U)

THE TRUTH about beaver arse milk in your cakes: There's nothing vanilla about vanilla

Re: Clue's in the name, isn't it?

Not to mention the perfumiers' favourite narwhal retchings and excrescence, or ambergris as it's also known.

Or the urea that's the basis for anti-wrinkle creams. Mmm, wee.

Bismarck had an awful lot of choice for his quote: "Laws are like sausages, it is better not to see them being made"

Auntie touts e-babysitting ... and no £15,000 in-app purchase shocks

Re: Digusted

The Torygraph will, of course, be totally ignoring this story as it's the A Level results day special fruity schoolgirl pullout.

Clever Auntie...

El Reg encounters mObi: R2-D2 for retailers

Re: Scene in the aisles of the future Tesco supermarket after a long day's work

All that's missing is a decal of a paperclip on the robot...

Number of cops abusing Police National Computer access on the rise

Re: Telegram from the Queen?

These phrases get set in technological aspic. It's allowed. Commemorative laser printed card from the Queen just doesn't have the same ring. Nor does telemessage from the Queen, which was the system from 1982 to 1999.

PM Cameron calls for modern, programmable computers! (We think)

Lemon juggling

The current GCSE Maths syllabus has 6 key areas: Number, Algebra, Geometry, Measures, Statistics, Probability.

Number and Algebra already makes up just under half of the course in terms of the things that kids need to learn. Measures, Statistics and Probability, when you read the course specifications, are effectively the mathematical foundations of science that aren't included in Number and Algebra. And Geometry is a canter through Euclid with all the stuff that will be dashed useful for this new app-driven economy that will allegedly be the result of teaching kids to code.

What is Cameron saying? We'll do more of the maths that is what people who say they can't do maths mean by maths. We'll do more detail in science, which needs much of that maths that we've just effectively said we'll do less of, and we'll do more coding skillz, which needs the other bits that we've left out.

So, what's the plan? Move Measures, Statistics and Probability into Science, and leave less room for the non-maths but still important detail bits of science - "only a" theories such as evolution? Make "coding" a 2 year exercise in joining the demo scene and have employers bemoaning the lack of algorithm analysis skills before we change everything again? We might have some very pretty apps that don't do much though. And roughly the same maths skills as we ever did.

I'm off to juggle some lemons.

US chief spook: Look, we only want to spy on 6.66 billion of you

Making one wonder...

When it comes to conspiracy theories, I try to work out how much competence the theory requires the {insert shadowy organisation here} to have. High difficulty level means less likely, usually.

This one always had a fairly low bar for competence based on what we already know the various cloudy/massive data gathering companies like to collect. Faking the moon landings still needs you to build a really big rocket and not have it explode on launch.

Graphene QUILT: A good trampoline for elephants in stiletto heels

Pedantry ahoy!

This is patchwork, not a patchwork quilt. Quilts have at least 2 layers plus some downy filler (Iron Man 2, perhaps?) Graphene, by definition, has only one. Beyond that, it's graphite.

My bleak tech reality: You can't trust anyone or anything, anymore

Re: "...a cookie would work just as well"

No he isn't. He's suggesting that the data protected by a password on many sites often isn't worth protecting to that level.

Does knowing "I am the same person that viewed your site last Tuesday" merit the creation of a username and password? The presence of a cookie is just as good a discriminator for tracking purposes as requiring a login.

Stand by for PURPLE KETCHUP as boffins breed SUPER TOMATOES

Re: Carrots

Orange is "new"? It's been a good 300 years since the Dutch pulled off their nationalistic selective breeding coup.

I've found the purpureal varieties of veg tend to be a bit more flavoursome, if more staining, than others but, if I'm reading the article correctly, the JIC are vaunting that they've managed to engineer only the colourant gene in. Here's hoping the actually-tasting-nice code is built into it...

FLABBER-JASTED: It's 'jif', NOT '.gif', says man who should know

Re: Acronymity...

we surrealists pronounce it giraffics.

Soylent Corporation prepares to DEFEAT FOOD

Re: God's own food?

Only if you have 18 pints per day and supplement it with 2 pints of milk and a pint of orange juice.

It's close though ;)

How Google lost the trust of Europe’s data protection authorities

Re: Can I suggest

The suggestion isn't that Google are evading tax, but evading paying a fair share of tax. There's a massive difference in meaning.

No.10 guru: UK tech scene is AN EXPLODING CHEESE

Shoreditch is...

Lymeswold.

And likely to be just as successful.

Mine's the one with the sheaf of Government statements saying "We don't pick winners" in.

John Lennon's lesson for public-domain innovation

Political correctness circa 1937

Oh, the humanity!

A quick etymology search reveals that humankind and mankind have been coexisting since the 17th century, along with earthlings. One day, perhaps happily.

BT copper-cable choppers cop 16 months in the cooler

Re: What's it worth? @El Presidente

I wouldn't be surprised / I have some idea / I overdid a rhetorical flourish.

I'll admit to ignorance of the thickness of copper in the wires involved - @2cm diameter a tonne will be around 400m of wire, which I'd imagine would take up about 1/2 m^3 in volume allowing for insulation and imperfect packing (were it a pure copper ingot it would be approx 0.1 m^3), and a few reels like that is going to start buggering the suspension in the vehicle you use.

It's not as though you can repeat this too often in a given area, and you're sometimes going to yield fibre rather than your planned copper haul, so the risk/effort/reward ratios look way out to me. [Unless you come up with a way of being paid to replace the cable you've just nicked.., ideally with the same cable]

Re: What's it worth?

I've long wondered why the media always insists on reporting the value of drugs seized - "What? A million quid for a few kilos? What proportion gets through? Hmm, so long as I don't traffic somewhere that has the death penalty..."

This is exactly the opposite - even at vastly inflated metal prices, the amount of effort involved hardly seems commensurate to get a few grand at scrap and the risk of a year or so banged up.

The media generally keep banging on about how copper is hitting record prices per tonne. Instead, they should be pointing out that just 1 tonne is a hell of a lot of copper wire, even at whatever wire gauge BT use.

@Psyx "Perhaps" scenarios

We can and do sentence people on perhaps scenarios - attempted [X], dangerous driving, negligence, and espionage to name but a few.

The actual outcome is doubtless of prime importance, but to totally ignore the subjunctive is equally as silly. It's the courts' job to weigh up which risk scenarios were unacceptably brought into play and they are usually quite good at that. I'd be very worried if someone was sentenced for disturbing a butterfly on the basis that it could cause adverse weather elsewhere in the world, but I'd be absolutely disgusted if someone cut the power to a hospital and got off scot free because, by some miracle, no-one died in the time before the emergency supply kicked in.

Public told to go to hell, name Pluto's two new moons

I've gone and submitted Pirithous as an alternative. It's one of my favourite "don't piss off the Gods" stories.

He and Theseus went down to the underworld with the intent of taking Persephone as his wife. Needless to say it didn't end well, what with them both being trapped on the chair of forgetfulness by Hades, and Theseus only being freed at the expense of his buttocks when Heracles harrowed hell to get Cerberus; Pirithous was trapped forever.

3 Brits banged up for £300k VAT scam

Re: or ....

I'm not sure which makes me more annoyed: the £120bn avoided/evaded/uncollected estimate by the Tax Justice Network (which is probably on the conservative side of reality), or that the circles are scaled by radius rather than area (to deliberately and needlessly skew the perceptual effect).

[It's probably the former, but still...]

Customer service rep fired for writing game that mocks callers

It could be a sequitur - if the minister thinks that 11122211 is her SIN ;)

Why did your outsourced IT fall over? Cos you weren't on Twitter

Re: I'm wondering

The gears are metaphoric - their differently sized teeth mean they won't interlink well and will be subject to failure. That's where Gartner comes in - they are a third gear connected to both of the other two...

Another new asteroid-mining firm: 'First commercial space fleet'

Re: Next off the starting blocks...

I, for one, won't be interested until the Post Terran Mining Corporation is formed.

Wanna really insult someone? Log off and yell it in the street - gov

That would be "threatening or abusive words or behaviour"

It doesn't say the words or punctuation weren't changed to make grammatical sense, as the true pedant in you knows they have been.

UK falls behind in global graphene patent race

Instead of an xkcd reference:

An RP Feynman one.

From the story called I want my Dollar in Surely you're joking Mr Feynman, available from all good bookstores.

[D]uring the war, at Los Alamos, there was a very nice fella in charge of the patent office for the government, named Captain Smith. Smith sent around a notice to everybody that said something like, "We in the patent office would like to patent every idea you have for the United States government, for which you are working now. Any idea you have on nuclear energy or its application that you may think everybody knows about, everybody doesn't know about: Just come to my office and tell me the idea."

I see Smith at lunch, and as we're walking back to the technical area, I say to him, "That note you sent around: That's kind of crazy to have us come in and tell you every idea."

We discussed it back and forth - by this time we're in his office-and I say, "There are so many ideas about nuclear energy that are so perfectly obvious, that I'd be here all day telling you stuff."

"LIKE WHAT?"

"Nothin' to it!" I say. "Example: nuclear reactor . . . under water. . water goes in . . . steam goes out the other side . . . Pshshshsht - it's a submarine. Or: nuclear reactor . . . air comes rushing in the front. . . heated up by nuclear reaction . . . out the back it goes . . . Boom! Through the air-it's an airplane. Or: nuclear reactor . . you have hydrogen go through the thing . . . Zoom! - it's a rocket. Or: nuclear reactor . . . only instead of using ordinary uranium, you use enriched uranium with beryllium oxide at high temperature to make it more efficient . . . It's an electrical power plant. There's a million ideas!" I said, as I went out the door.

Nothing happened.

About three months later, Smith calls me in the office and says, "Feynman, the submarine has already been taken. But the other three are yours."

CIOs: Don't listen to tech vendors on ICT skills, listen to US

Re: CIO Agenda

Putting the really cynical hat on, one could argue that for the entire graduate job market...

1) There's a big salary advantage in having a degree. (The argument for student fees)

2) That goes down the more people who have one. (Something to do with supply and demand)

3) Profit! (Unless you're funding said degrees, or getting them)

Every year or so the Association of Graduate Recruiters puts out a report saying how phenomenally tough it is. A couple of years back, they attached a graph showing the %age changes year on year since 1989. I ran those percentages through the old calculator and they essentially showed that their recruitment numbers didn't get beyond 1989 levels until 2006 or so. Over that period there's been a massive rise in graduate supply, and demand has plummeted since then.

When business groups bang on about having to import workers to cover skill shortages I start wondering why:

They don't form some kind of cooperative to run a specialist training centre that works to the standard they expect and without them complaining to government about the supply?

Government doesn't give them a _temporary_ import window in which to set up a specialist training centre and start training locally, after which the imported workers are no longer necessary?

Skills "shortages" have little to do with it - it's an abrogation of duty to help develop those skills, and unwillingness to pay above the internationally lowest price one can find workers at.

Opposable thumbs for FISTS, not finesse, say bioboffins

Re: A title should not contradict it's article

I'd claim foreshadowing of Daily Mail mode, but I'd be lying ;(

A title should not contradict it's article

(Unless it's Pretend You're The Daily Mail Day, in which case I apologise)

It's the palm and finger size relative to the thumb that's for fists, not the opposable thumb in and of itself.

Notice how the chimp has opposable thumbs but is rubbish at fists.

Shh! Proxima Centauri can hear us!

Re: Proxies surely.

We don't know their names, so Anonymous Proxies surely.

Search engines we have known ... before Google crushed them

Re: Why no mention of Northern Light?

Gah! Ninja'd!

Anyone remember 10 years or so back when Northern Light was a public search engine and not a fancy dan research portal thingy?

It had this lovely context-aware refinement system so that a search for Dates would suggest adding filters for fruit, calendars or going out and the like. This narrowed the search results seriously quickly rather than seeing it as an opportunity to serve up more adverts. The only search engine I've ever found to be truly intuitive. I was gutted when they went corporate intranet only.

Schmidt 'very proud' of Google's tiny tax bill: 'It's called capitalism'

@GotThumbs: Envious? Moi?

Your solution to childishness seems to be to act like some teenagers think they have to - do anything to be popular, even if that means you end up surrounded by vapid arseholes and become one yourself. To continue the teenage analogy with your argument, it is therefore perfectly OK for someone whom you thought a friend to betray what you thought were confidences on the basis that only a fool would not blab such juicy gossip and, anyway, you didn't say you didn't want anyone to know this one time.

As a teenager, I was bemused at the notion of popularity and the idea that personality faults seemed to be more forgiveable to some if you had improbable hair. Just because Daddy could afford to take you skiing every winter with anyone prepared to brown nose you didn't make you an intrinsically better person.

As an adult, I'm bemused that being able to play the tax and political lobbying game well makes you a successful capitalist and it's all down to your sense/ability, while being able to play the welfare game well makes you a dole scum scrounger who should be shot and it's all down to your substandard feral genes.

I'm at neither extreme. I hope that I have a reasonably adult sense of fairness. This whole letter versus the spirit of the law type argument is akin to a certain kind of notice that I see cropping up from time to time like "no goats allowed in the public bar" or "do not use this drill as a toothpick" where you just know that someone has acted like a dick in the past and used the "it doesn't say not to anywhere" defence. Do we really need to explain to companies how not to be a dick? Is there an adult way of doing so without them throwing a hissy fit? What's the international politics version of stopping the car and telling them to walk home?

There's a rather wonderful opening to a Poul Anderson novella that's rather apposite here:

"Crime is entirely a matter of degree. If you shoot your neighbour in order to steal his property, you are a murderer and a thief, subject to enslavement. If, however, you gather a band of lusty fellows in the name of honour and glory, knock off a couple of million people, take their planet, and hit up the survivors for taxes, you are a great conqueror, a hero, a statesman, and your name goes down in the history books."

The latest tech firm to be accused of tax dodging: Microsoft

Re: Dodgy

"Sorry, but it's a companies duty to act in the interests of it's shareholders. If I was a shareholder, and the company declared a £10m write-off 'because it seems like a fair thing to do', I think I'd be rather miffed."

There's nothing to stop us changing that first bit - to act in the interests of its shareholders and the society it operates within by maximising distribution ie dividends and tax. Apart from the lobbying wails that this would be "bad for business".

Starbucks capitulated on the basis that the £10m sop was cheap to avert a tabloid inspired lynching. It's not the multinationals that deserve the lynching though - it's the idiots who developed and approved the rules and treaties that are so easily exploited by said multinationals. If there's a true IT angle, its the lesson that endless patching can easily leave you with a system that you neither understand nor does what you want. To make matters worse, the developers of this system have a vested interest in it being shit while the approvers will approve nigh on anything if told it's "good for business".

Deputy PM: Rip up Snoop Charter, 'go back to the drawing board'

Re: "You've not needed it for the last 2000 years " @Jedit

"No, we didn't need a law to ensure security on the public internet (est. 1995) for the last 2000 years. By a bizarre coincidence, we also didn't need road safety laws before we invented cars."

*ahem* Speed limits and suchlike have been around since the 1860s, when traction engines were all the rage, while not driving on the pavement, oft quoted to nervous cyclists by the type of driver that you wouldn't want to share the road with, has been around since the 1835 Highway Act.

A better bit of logic on not needing communications data would be the lack of such data collection for non-electronic versions and general distaste towards doing so (even barring the impracticality).

Google's ethics, cosy UK.gov chats under Westminster scrutiny

To properly quote the yanks

No taxation without representation. Where's my Cayman Islands ballot paper? And my Liechtenstein one? And the opportunity to get various legislatures in the Channel Islands to add a law requiring accounts to be filed in Sumerian to their statute books.