Posts by Charles 9

'I feel violated': Engineer who pointed out traffic signals flaw fined for 'unlicensed engineering'

Re: Why is the US having trouble?

Two main reasons:

1) Each state and each locality gets to make the call. There is no uniform federal requirement for roads unless the road has a federal designation (either a U.S. Route or an Interstate), and even then federal proceeds for them go through the states, since it's their respective Departments of Transportation (or equivalent) that actually do the work. Traffic violations and such are normally handled by the municipality in which it occurred and they get the proceeds. For small towns and such, "bear traps" (bear is trucker's slang for police) are about the only things keeping their budgets afloat.

2) The general public attitude towards such laws is not considered very respectable. As far as they're concerned, the rules are made to be broken, and it's hard to make them change their minds (I recently saw a case of a man with at least TEN DUI convictions, and I'm told such repeat offenders are distressingly common; plus it's hard to just throw them in jail because they're the breadwinners, as in spouses and children depend on them). Night racing even gets it's appeal BECAUSE part of the aim is to outrun the cops. To give you a counter-example, here's how a supposedly-typical Bostonian views the traffic lights:

Green = Go as quickly as you can.

Yellow = Go FASTER!

Red = Room for one more!

74 countries hit by NSA-powered WannaCrypt ransomware backdoor: Emergency fixes emitted by Microsoft for WinXP+

"Yeah, Microsoft only supported XP for 13 years (2001-2014)."

And your average large piece of medical equipment stays in use for a minimum of 20 years and often longer than that. Same with other pieces of heavy industrial machinery that could have XP-based computers controlling them.

Re: "took out your video drivers"

"It doesn't have to be like this."

Actually, it MUST be like this, because that's how most people are. You Can't Fix Stupid.

Re: Political SNAFU

"If there was such an attack on the banks, the crooks would be had up against a wall and shot before you could say SMB bug."

Unless, of course, the crooks were found to be protected by hostile governments. Are you willing to declare World War III over a bank hack?

Tell. Us. HOW. Without us falling on our swords first.

The very expensive medical machine you use to save lives ONLY runs Windows. And this is true of EVERY other supplier of the same equipment.

Re: Executive summary

But what if you're up against the proverbial immovable object, when no haggling whatsoever will work, and EVERY supplier's the same way? Remember, medical tech is a very niche industry.

Re: GCHQ and Patches

Unless there WASN'T a choice. If ALL the suppliers (and note that medical equipment is considered a niche industry: few suppliers) shipped their machines with Windows and nothing else, how would you go about with your goal, especially if the machine needs to be obtained in a timely manner because it's replacing a broken unit?

Besides, Linux isn't immune to this, either. Hardware support CAN get borked by a kernel change (because the hardware driver requires something in the part of the kernel that got changed).

Re: GCHQ and Patches

Three words, repeated over and over:

Patches BREAK Things. Do you want the computer controlling the 6-to-7-figure MRI machine to be borked by a patch? Hard to believe, but a VERY real possibility.

Re: Executive summary

So if people have no choice but to use Windows due to contracts or exclusive software, the only option is to bend over?

Unless the BACKUPS got infected, too. That's a known tactic of sleeper malware.

Re: Every day is a learning day

"Yeah, we learned, yet again, that the internet is a playtoy which should be airgapped from critical systems."

Which is countered by the lesson that ANY air gap can be bridged or jumped, especially if someone wants it badly enough (in particular someone UP TOP).

Re: Is there any point in keeping GCHQ?

Yes, because any alternative could be FAR worse. Better the evil you know...

Re: Windows in the NHS

The problem lies when you prerequisite Linux...and get no offers.

Re: Mitigation against ransomware:

But IT doesn't control the budget, and the board doesn't like IT as they're a cost. So now what?

Re: Malwarebytes has a free desktop anti-ransomware available

But doesn't the malware simply target IT first before wreaking havoc. This one is noted to try to disable countermeasures.

Re: Social engineering?

Plus the last bit about not opening attachment from UNKNOWN sources. What if the infection is a spear-phish and the attachment actually comes from a KNOWN source, and in an expected format? Don't forget, infections through image files and PDFs are possible.

Re: Do we need attachments?

(Shakes head) Not practical because medical imagery is a routine attachment to medical e-mail, and some malcontents have been able to cause malware infections THROUGH graphics files. That's right. Files that aren't MEANT to have executable content (by their spec) get mangled to have and execute them anyway.

Now I'm just waiting for the malware that can pwn an e-mail program using nothing but embedded 7-bit ASCII code. Given the world we live in, I'm not holding out hope.

PS. HTML-based e-mail isn't necessarily a bad thing. A little formatting doesn't hurt, but the problem is that HTML e-mail clients throw in too much of the spec. If clients were to instead pare back their HTML e-mail parsers to a spartan subset of the language (basic formatting tags, table formatting, MAYBE support for attached graphics, and NO accessible or inline external links), then it wouldn't be such a big issue.

Why Microsoft's Windows game plan makes us WannaCry

Re: It's more difficult for science

"Just you try convincing a manager in a university/hospital/reasearch institute to replace a perfectly working instrument or PC every couple of years just to keep up with the O/S"

Simple. Just tell him it WILL break very soon if he doesn't AND that ALL the replacements have the same problem. Unless they have the resources and guts to roll their own, the words "captive market" spring to mind.

"A long, long while ago somebody wrote an article on an OS with default-deny as policy, where you (as admin) have to approve each and every bit of software that wanted to run/install itself on your purdy compootah."

You know Windows tried to do that with Vista, with UAC. The end result was exploits STILL going through due to a psychological phenomenon once called "hoop jumping" and now better known as "click fatigue". The problem with default-deny is that it irks users to do it over and over and over again. Make something annoying enough and people either "zombie" their way through it or find ways AROUND it.

IOW, there's just no pleasing some people. Our current situation is untenable, but so is default-deny to the average user. So what do you do?

Re: "Adding to the bottom line"

"If businesses still needed to run XP software (as a stop-gap until application upgrade), Microsoft provided downloadable XP emulation support in proper versions of Windows 7. VMWare and VirtualBox were also possible workarounds (for strictly limited scope use), as were RDP/Citrix if the local machine had limited RAM/Storage, so had to run a lighter secure new OS e.g. an embedded version of Windows 7 or a Linux."

But what about if the thing holding you back is the hardware, such as custom controllers that are ONLY supported up to XP (say because it uses the ISA bus, support of which was dropped in Vista), and the replacement of which is so expensive as to require the approval of the board or whatever? You can't virtualize custom hardware because the VM has no idea what's in it.

DeX Station: Samsung's Windows-killer is ready for prime time

Re: Why would you need a dock?

I stick with S5's and Note 4's because they were the last models to feature removable batteries. No phone without it is a hard point for me because I've personally replaced plenty of batteries from cell phones in my time. Why waste an otherwise useful phone or be held hostage to manufacturer eccentricities?

"Offline working isn't desirable when other team members need to work to changes you have made and vice versa."

But what if you're OFFline more often than you're ON? Say you live in a not-zone?

Re: ORLY?

Call me when it can do Crysis acceptably. Then it'll have the raw horsepower to get most things done, even the occasional game and encoding job. Then PCS will really become a niche item.

PS. You can't RDP to a computer that doesn't exist for you.

Re: Linux

On Macs, it's called the Command key (next to the Alt with the loopy symbol). It's technically different from the Win key, but Linux takes it a six of one and half a dozen of the other.

Ransomware scum have already unleashed kill-switch-free WannaCry‬pt‪ variant

Re: So you're blaming a commercial company for not patching a 13 year old OS?

But I wonder if it's possible to MAKE it exist with something like, "This 8-figure contract will go to the first company that's makes their equipment X, Y, and Z completely."

Re: A dish best served cold

In other words, if this REALLY were a State attack, they'd be going for the jugular: using as as an inroad to permanently borking all the hardware in the machines to make them nuke-proof.

And THEN they'd let them lay low. Perhaps remove the original vector to make things look all hunky-dory.

And then, after a while, start having the borked hardware exfiltrate useful stuff, a bit at a time, encrypted, hidden in actual traffic. Perhaps even to legitimate destinations that have been secretly subverted so they can sniff the packets out in transit or whatever.

IOW, a State attack is one you wouldn't even know it ever happened.

For now, GNU GPL is an enforceable contract, says US federal judge

"If some ex-Microsoft employee (and it would be an ex-employee) put GPL licensed code into Office, and a version of Microsoft containing that code were published, then Microsoft would have the choice of publishing the Office source code, or to pay whatever fine they are given for copyright infringement. Of course they would go to court and argue to keep that fine as low as possible, but they would be ordered to pay."

Whatever happened to arguing that it was not by their hand and simply removing the offending code? Otherwise, what would happen if this were to happen in the Windows kernel?

I thought in the modern sense the Second World represented countries on the rise: having characteristics of BOTH First and Third World countries in terms of industrialization and domestic wealth but definitely on the track FROM Third TO First. For example, would one consider China and India First World (already heavily industrailized) or Second World (in progress)?

Re: That doesn't matter

Doesn't have to. The Berne Convention establishes common ground for copyright law, meaning in many ways South Korean and American copyright laws will coincide, and makes all signatories respect the copyrights of all other signatories. That's what makes licensing and transferring copyrighted works (such as movies and TV shows) from country to country so complicated.

Re: surely the GLP is, first and foremost, about copyright, not contracts

Except we're talking a publisher, a source of copies. Now the copyRIGHT in terms of what you can and can't do in terms of MAKING copies comes into play. The defendant is less a book OWNER than a book MAKER.

Re: That doesn't matter

But it would be unenforceable if the country in question didn't respect the other country's copyright law. Sovereign power overruling a foreign country's law.

But the thing is, South Korea IS signatory to the Berne Convention, MAKING it enforceable.

Autonomous cars are about to do to transport what the internet did to information

Re: Wrong Problem

"The grocery argument against PRT is certainly one I have not seen before, but I don't really think it stands up on examination."

Then you've never seen the parking lot of your typical Walmart on Friday afternoon. There's a reason it's considered one of the worst times to go there unless you really, REALLY have to. Other dates to avoid: the 1st after midnight because military paychecks and EBT benefits drop, the 15th for military payday, and of course Black Friday.

Facebook is abusive. It's time to divorce it

Re: this is the best FB article Ive read in a long time

What about family whose ONLY connection to society is through Facebook because everything else costs money they can't afford (calls and SMS cost per, no e-mail, but FB free from the carrier)? And for some, cutting ties is not an option due to moral and social responsibility (a lot of the bespoke are Asians with very strong sense of family).

Re: A decentralised facebook

Stuff like BitTorrent is selective. People only share what they're trying to collect and what they WANT to share. What you propose is more like Freenet, which demands you keep a certain amount of storage to share. This results in constant churn that eats into data caps. Doesn't BitMessage have the same issue?

Re: Remember

"Chiquita. Quite possibly the world's perfect food." I've seen ads for Del Monte bananas as well, covering most of the banana market.

WannaCrypt ransomware snatches NSA exploit, fscks over Telefónica, other orgs in Spain

Re: Does this mean

I've mentioned this dilemma before? You either get pwned by malware or you get pwned by Microsoft. And if your software has no non-Windows alternatives, it's down to pick your poison.

But what if they WANT to be part of breaking the Internet...or simply don't care?

Re: WTF ..., WT actual F ?????

So what happens when a patch for a Cat I vulnerability broke something critical in the process, creating a dilemma because the critical machine was inoperable either way?

PC repair chap lets tech support scammer log on to his PC. His Linux PC

Re: The beauty of virtual machines

It's called snapshotting. You store a specific state of virtual machine and simply revert to it each time you finish your session. Even VirtualBox has such a feature.

Mozilla to Thunderbird: You can stay here and we may give you cash, but as a couple, it's over

Re: It's the 21st Century: Outside of Work, Email is dead

"Sorry to hear that. I don't use Facebook, Twitter, WhatsApp &c. Period. It's not a "youth thing," it's simple common sense."

The trouble lies with your last two words. They're an oxymoron.

Uber is a taxi company, not internet, European Court of Justice advised

Do hire cars count as cabs for that law?

Oh... (blushes)

Turns out what I'm talking about is unique to my area.

But it DOES exist: http://www.appacab.us/

Re: Remind me again what the ex-labour cabinet are doing now?

"Rather like Turkey?

One of the better reasons for Brexit."

And that's why I say the laws in the end are just ink on a page. If you can amass enough power, you can ignore those laws and replace them with your own.

Re: Remind me again what the ex-labour cabinet are doing now?

Nah, you just end up with a coup as the people in power shoot the shooters and seize power to avoid being shot.

Oz MP flies crypto-kite, wants backdoors without backdoors

Re: Explain it sloooooooowly...

That's the RED Pill. The Blue Pill commits you back into the Matrix.

Re: Explain it sloooooooowly...

And if they STILL don't get it, nor does anyone else you can conceivably elect?

Could US appeals court save us all from 10 years of net neutrality yelling?

Re: "reduce the American life expectancy"

But there's a delicate balance. TOO MANY and you end up with dead-enders, and dead-enders, desperate for bread on the table, turn to crime. That means you need more police presence, which cost money you can't squeeze from the unemployed. Plus police may get honest streaks and turn on you. If you don't increase police presence, you're likely to get more riots and the attendant damages. Not to mention reputation problems if the crime gets more organized. Gang issues are already rampant in parts of the country; no one feels like a return to the Roarin' 20's. And then there's the whole welfare issue. That's why I mentioned Social Security.

Rich professionals could be replaced by AI, shrieks Gartner

Re: AI - No such thing,... yet

Then again, can you expect the same from a meatbag lawyer? That same question could stymie them unless they OWN such a vehicle. Remember, career specialists tend to be one-trick ponies. Some lawyers and doctors can't handle computers decently, so keep that in mind.

Unpaid tech contractor: 'I have to support my family. I have no money for medicines'

That's assuming you HAVE a war chest? What if you get hit hard right out of the gate or due to market pressures have to spend all you earn just to maintain, meaning there's nothing left to build a war chest and you can't negotiate for higher rates because then you get undercut and end up with NOTHING?

Just 99.5 million nuisance calls... and KeurBOOM! A £400K megafine

Re: Can't pay?

Trouble is, those with the money also know how to keep their money: mostly by finding ways around the regulations and rules. Such as changing identities or fleeing to a different sovereignty.