Posts by Mark 65

On the NHS tech team? Weep at ugly WannaCry post-mortem, smile as Health dept outlines plan

Re: SMB

Also a lot of European ISP's will expose 445 to the internet.

At the end of the day you're responsible for your own perimeter defences. Operate a blacklist rather than a whitelist or whitelist something without adequate thought and it's your issue not your carrier's.

I suspect there may be an element of bullying/overriding within the NHS - senior X says this has to work so just get it done geek - and whilst it would not be operationally viable to necessarily go to the other extreme it is clear there needs to be a change. The article mentioned "cultural change" and that is the nail on the head for an incident such as this.

Re: The NHS

Much as a geek i like the idea of using Linux over embedded windows it does nothing to solve the issue of boxes stuck in corners of the network and not being patched for a decade.

and I see little reason for important kit to be widely exposed. Segregated secure networks and all that. My guess is that much of the NHS networks (within and perhaps between hospitals and trusts) are just wide open once you're authenticated on them. Let's be honest here, the *nix/BSD variants are generally more secure by design that Windows. That is just the way it is. Not easily being able to classify your updates is just shitty and unnecessary and it is about time we moved away from vendors that don't give a fuck.

The NHSbuntu (or whatever it was called) was a sound idea and I think, if anything, this whole debacle highlights that the NHS is easily big enough to support a centralised area of IT expertise to ensure some kind of order, security, compatibility, and efficient purchasing. Leaving things to individual trusts becomes an in-built divide and conquer for vendors and has led to a disparate and dysfunctional landscape in the health sector. Who gives a shit whether doctors and hospitals have little whines and bleats about giving up certain aspects of their control or little budget corners of their empires - the whole thing is funded by the tax payer and it is about time it was done properly.

Re: Suits having meetings and producing reports is not going to help...

As previously reported by El Reg and noted in previous national reports, unpatched Windows 7 systems, in particular, rather than residual reliance on long obsolete Windows XP boxes (which crashed rather than further spreading the worm) laid the groundwork for the WannaCry outbreak.

I'm not sure what more management will get you when the principle problem was "it doesn't matter how well supported your PC OS is if you don't fucking patch it". Additionally the likelihood of having SMB exposed to the wider internet such that it is the suspected initial attack vector shows you don't really know what you're doing.

If we are talking about managers "taking the time to understand..." we are wasting our time. Anything you try to teach them will always be overruled by an accountant's whimsy or "vendor said X". What you need is a chief architect who has the power to overrule stupid-arsed management decisions. In any business you will always get a shouty twat that gets their own way with a really stupid idea - squeaky wheel and all that.

Dodgy parking firms to be denied access to Brit driver database

Re: Yes, parking debts ARE enforceable !

From the images in that article the double yellow lines are a bit of a giveaway that you cannot park there and her general arrogance (ignore rather than refute the penalties) was likely to have coloured the outcome as mentioned. I think her case was wafer thin at best, especially when she could have parked issue free for £40/mth.

Re: Um...

You need to be able to prove your case of breach of contract. I doubt many debt collectors would pay anything for such debts as the probability of success makes the NPV pretty close to zero.

Re: dodgy parking companies

Do you seriously have to pay any fine a private parking company gives you? I mean, as long as you can leave the car park without paying is it actually enforceable? I can see how a car park owned by a municipal authority may be able to do so through by-laws as they possess law making authority, but a private company on private land?

If it is enforceable then the UK must be one of the most utterly fucked societies on the planet.

I'll torpedo Tor weirdos, US AG storms: Feds have 'already infiltrated' darknet drug souks

Re: The biggest troublemakers are not on the darknet

You'd have to wonder how much street dealer addiction actually started out as prescribed addiction. As you state, they hand them out like sweeties but at some point need to turn off the supply. Then the visibly shady dudes take over.

The problem as I see it with people dealing in drugs, weapons etc on the darknet is that at some point your transaction makes it back into the real world, most likely for the physical delivery but possibly for the payment if you weren't really careful about the trail the coins left.

PC not dead, Apple single-handedly propping up mobe market, says Gartner

Re: " it's moot to only talk about what professionals and enthusiasts use PCs for."

and not, for example, that PC sales reached saturation and replacement cycles got longer (especially since SSDs gave a big speed boost to machine that were only I/O bound).

^^^ this ^^^

I have a 2010 era iMac (2.93GHz i7) that I fitted an internal SSD to as the internal drives are a PITA and it's pot luck which manufacturer you get - I lucked out and got a Seagate which naturally shat itself. That machine is still good for whatever I need to do computationally over 7 years later.

I built a replacement and the end of 2017 for 2 reasons...

1. Tax deductions - may as well have something for the money as it'll be leaving the bank account one way or another.

2. NVMe drive and USB 3 as well as the ability to stuff it full of drives and RAM and easily replace any parts that fail.

3. Heat dissipation when under heavy load. iMacs aren't great when under stress in a hot climate.

You can't ignore Spectre. Look, it's pressing its nose against your screen

Re: Dedicated instances

And they have you to secure it - and you are better at cybersecurity than all the people at Google and amazon.

What makes you think they're so damned good? FFS Google were running non-encrypted comms between data centres and got absolutely fucking owned by the TLAs. Have Google never released security fixes for Chrome? Seriously, your argument is just so weak. They'd need to be orders of magnitude better because

1. The potential attacker is already on the hardware (shared resources)

2. As an aggregator of compute users they are such a big fat juicy target whereas Johnny SME just isn't as attractive.

You are also guilty of making assumptions as to how capable the OP may be. Plenty of talented people would rather not work for companies like Google and by all accounts they seem to have their fair share of chaff.

Microsoft works weekends to kill Intel's shoddy Spectre patch

They could have had patches for compilers, firmware, and BIOSes ready in that time.

They could have, if they gave more of a shit about their customers than apparently the CEO selling down everything he could in the mean time (courtesy of various financial media reports).

Re: The WinTel Cartel...

It is demonstrably not gross negligence and I would expect such claims to be tossed out of court on day one.

*Ahem*. What about continuing to sell new models with the issue still in place once you know about it? They need to be sued into oblivion because they simply don't give a shit.

For negligence, you need to have a situation where a knowledgeable person would, if aware of the action, think that it was careless or unwise.

See the above point about continuing to issue new models with the design fault in place. Any argument about "it takes time to redesign, test, and fabricate chips without the issue" should be met with "tough shit, that's a 'your problem' not a 'my problem'". There are very few industries where you can continue to knowingly sell defective goods. "Not fit for purpose" seems to spring instantly to mind in terms of consumer protection.

Re: "...nobody's explained why..."

I know why...

Intel CEO Brian Krzanich sold off a large chunk of his stake in the company after the chipmaker was made aware of serious security flaws, according to multiple reports

An SEC filing last November showed Krzanich sold off about 644,000 shares by exercising his options and another roughly 245,700 shares he already owned

That reduced Krzanich's total number of shares to 250,000, which is the bare minimum that an Intel CEO should own, according to The Motley Fool

Courtesy of searching for "intel director share sale". That last point tells you all you need to know - bare minimum holding for a CEO says "fuck this company"

Thar she blows: Strava heat map shows folk on shipwreck packed with 1,500 tonnes of bombs

Re: Didn't anybody walk out the outline of a huge... ?

That could be fun. Map out some obscene words.

Or draw in the Superbad style

Re: How accurate are these things?

Fitness tracker stuff is very competitive in my friends circle

We'd rather not discuss your friend's circle if that's quite alright.

Ubuntu reverting to Xorg in Bionic Beaver

Re: I find this slightly embarassing

Even in Windows it's many years a crash of the shell doesn't bring down the whole session. Even the graphic driver can stop and be restarted, at least since Windows 7. If Wayland is way behind, it's far worse than Microsoft as well.

That may well be the result of a "needs must" development ethic on account of just how frequent the blue screen of death used to be.

FYI: That Hawaii missile alert was no UI blunder. Someone really thought the islands were toast

Re: For "omni-shambles" read ...

Was that the title of the video they all watched on pornhub afterwards (according to the site's increased browsership)?

Watchdog: Uh, sit down, AriseBank. This crypto-coin looks more like a $600m crypto-con

According to Bloomberg, another watchdog agency, the US Commodity Futures Trading Commission (CFTC), last week subpoenaed cryptocurrency exchange Bitfinex and Tether, a cryptocurrency company that says it pegs the value of its digital coins to the dollar.

The CFTC has not disclosed the nature of its inquiry.

I believe it is along the lines of the pegging being *bullshit*. I read somewhere there is $2.3bn worth of the shit outstanding. No chance they have that sitting in Escrow somewhere.

I have to admit that I'm left marvelling at some of the shit these con artists come up with and even more so at the FOMO dickheads that buy into it.

Wonder how much I could raise with TwatCoin? Maybe a coin that uses the blockchain to verify that the jazz artists in the video you're currently strumming over have been properly financially compensated. Yep, TwatCoin ensures the egalitarian funding of smut.

Stop us if you've heard this one before: Tokyo crypto-cash exchange 'hacked' for half a billion bucks

Re: Portable gold

Gordon Brown cost us about £5 Billion when disposing of about 395 tonnes in Gold

Maybe he should have ploughed it into BitCoin?

Re: Occam's Razor

Stealing is easy, running away more difficult, but stealing, running away and spending your ill-gotten gains free from retribution/recourse is the hardest of all.

Lenovo's craptastic fingerprint scanner has a hardcoded password

Re: Security is hard.

But how many times does it need to be reiterated that a fingerprint is the user id not the password?

Why can the IT industry not understand this?

NHS: Thanks for the free work, Linux nerds, now face our trademark cops

Re: Shameful

f this is just about the cease and desist then bite back the bile and rebrand as something like Ubuntu for health

Just carry on with the work, rebranding as Medibuntu or something. It's not like there aren't other health authorities around the world, even if you stuck to predominantly English speaking, that would have to solve similar issues and get their systems to work with similar documents/messaging formats etc as well as potentially interface to equipment.

Short-sighted by the NHS on this one as they could have created this for their own use and then looked to sell it to private health and overseas markets.

Upset Equation Editor was killed off? Now you can tell Microsoft to go forth and multiply: App back from the dead

Re: I hadn't noticed.

That statement sounds like the confessions of a sexual deviant.

Airbus warns it could quit A380 production

Re: Capacity

I always found BA to be great short-haul (weekend city breaks to the continent) but utter shithouse for long-haul.

We used to use them over Easy Jet and Ryan Air as:

The cost at the time was not much more.

Greater choice of flight times.

They gave you decent food.

The plane landed at the destination you were after not 100 mi outside in the country somewhere.

If there was an issue with delays etc you lost much less time as a result due to the airline's capacity to put you onto another flight and by them being a more important client of the airport.

Things may have changed since then though (2010).

Re: Shame

Same airline and age of aircraft?

OK, Google: Why does Chromecast clobber Wi-Fi connections?

I think they should just issue a statement calling out Google's shitty coding.

Ohio coder accused of infecting Macs, PCs with webcam, browser spyware for 13 years

Wonder if this malware appears anywhere on the House of Commons network?

Cisco can now sniff out malware inside encrypted traffic

Re: Add randomness

What's the chance of the Cisco kit having a handy zero-day they could use to help exfiltrate their bounty? Not like their software hasn't been full of holes in the past is it?

Transport pundit Christian Wolmar on why the driverless car is on a 'road to nowhere'

Re: They will never work in an urban environment.

The same way we do now. The occupants shout at the kids.

You're neglecting the fact that there is also ambiguity over whether the human driver will stop - elderly or Audi/BMW driver and you're taking a bit of a risk.

FCA 'gold-plates' EU rule, hits BYOD across entire UK finance sector

Re: Not that big a face plant is it?

Surely the key words here are "RELEVANT telephone conversation", which would be reasonable to argue means between traders, sales people senior management etc. (recieving a lunch order in the canteen of X-Bank would certainly not be relevant as far as the regulator is concerned).

I work as a developer on desk X. I hear some really juicy price sensitive information that I then use to encourage trading by a 3rd party. That is clearly a relevant telephone conversation and not covered by your writing.

Recording at the carrier level for a company provided SIM card is irrelevant if I have my own SIM card and phone.

The regulation seems generally unenforceable especially given the need to cover any and all communication devices and methods a user could have access to.

You seem to be missing the most important device when considering BYOD and that is the humble mobile phone. Also, don't forget that there is BYOD as in "do work on your personal device" and BYOD as in "I've got my personal mobile with me".

Ex-ante, how do you know it's relevant? You don't, therefore you record everything save you breach the law by missing one.

I can't see how you can ban someone from bringing their own phone to work. If they need to be able to make private calls after they leave the office WTF are they supposed to do? I also cannot see it happening as I think you would be on legally very shaky ground if you completely banned employees having personal mobile phones without replacing that with a corporate mobile phone and that gets very expensive very quickly as you then cannot ban private calls as you foisted this need upon them. Justifiable for traders, not so much for some base grade non-trading floor admin bod. Grab the pop-corn, this will be fun.

Supremes asked to mull legality of Silicon Valley privacy 'slush funds'

Re: Color me unsurprised

Goes to highlight, for me at least, just how fucked up the USA is as a society. No wonder they ended up electing an unstable wiggy orange muppet in a last gasp act of desperation.

Is the constitution just a token veneer over a turd sandwich?

Big shock: $700 Internet-of-Things door lock not a success

Re: Bah!

You present the dealer with a token you received with the original purchase (NOT the actual key), plus some ID. If you want to have an illegal copy made you would need to pilfer a blank and get (access to) cutting tools.

Or work in the industry. Not entirely unknown for crimes to be committed by insiders.

Apple macOS so secure some apps can't be easily deleted

Broken OS

I normally resist OS major version updates on Apple until the .1 release (much like I used to on Windows) in order for all the beta testers to find the main issues in the OS. I then take a view on whether the issues that occur justify updating the OS major version using the .1 release or adopting a further wait and see approach given they usually go up to a .5 release.

In this case I think High Sierra is just utterly fucked and I'll miss the whole thing. I'm sure, if he were alive, Jobs would have disembowelled someone with magic mouse by now over the shitty quality control that now seems to pervade everything Apple do.

SCOLD WAR: Kaspersky drags Uncle Sam into court to battle AV ban

Best of luck with that

DHS essentially issues a form of "...National Security..." edict and someone thinks they'll win out in the courts. Sorry buddy, but I don't think that will work for you. Not sure in this sort of situation they need to conclusively prove you operate at the behest of a foreign spy agency, or potentially provide any proof at all. "National Security" provisions normally operate within the "better safe than sorry" realm.

We need to talk about mathematical backdoors in encryption algorithms

Re: AES Backdoor...

Question - given the amount of, predominantly US designed, chips containing AES-NI style encryption assisting circuitry is it possible that AES is secure but Intel have kindly implemented the instruction set in such a way to given their buddies at the NSA a leg-up? The management chip and all its flaws also smacks of a helping hand.

Re: National products

When I read

Serious countries (USA, UK, Germany, France) do not use foreign algorithms for high-security needs. They mandatorily have to use national products and standards (from the algorithm to its implementation),” he added.

I wondered whether they use these mysterious other algorithms because they are

1. Stronger, or

2. They have a known flaw in them allowing the country's spy agency to be able to track and decrypt information being leaked to the enemy.

There are valid reasons for both.

US authorities issue strongly worded warnings about crypto-investments

Re: The problems will start

What will make it more interesting still is that we already know the transaction processing part of the scheme does not scale well at all so it will be a sight to behold when everyone rushes for the exits at the same time.

Re: Meanwhile....

Sounds like you might end up with Weimar inflation.

Argy-bargy Argies barge into Starbucks Wi-Fi with alt-coin discharges

Re: You expect this from crooks, aided by lazy corporates.

For more info see...

https://www.cryptocompare.com/mining/calculator/xmr

also

https://www.cryptocompare.com/mining/#/equipment

Disk drive fired 'Frisbees of death' across data centre after storage admin crossed his wires

Yup - have seen a neat(ish) hole punched right through the back of the tailgate of an old Range Rover. from exactly the same situation. Looked like a cannon shell had gone through it.

There are plenty of videos around where people use the tow ball for vehicle recovery rather than a recovery hitch. Some of them show deaths as a result of said tow ball travelling like a cannon ball.

Brit bank Barclays' Kaspersky Lab diss: It's cyber balkanisation, hiss infosec bods

Re: "Definite no no"

Echoing what an earlier user said, by research and by voluntary submission. Default checked options or questions aimed at people that wouldn't have a clue and therefore really cannot provide informed consent really don't cut it. Sending shit home you "think may be a virus" is just spying. We already have agencies doing that thanks.

Crypto-cash souk Coinbase forced to rat out its high rollers to probing US taxmen

I think you'll find that this is the IRS' opening offer and those 480,000 accounts are not safe either. They are likely fishing but with a fair estimation of how successful they will be. If, after investigating these details, they can then persuade the next judge that there is rampant tax evasion going on in this area or with this company based on what they found under this warrant then the flood gates will open. They do have some clue as to what they're up to.

NSA, FBI work on a similar basis. First the overly broad catch-all warrant request. When that is denied refine your criteria to focus in on the information you need but try to still be overly broad to get more information on where to go next. Repeat until warrant is obtained. Use any criminal activity found to show how you were "right all along" and use it to persuade the next judge the activity is rampant and the next warrant needs to be far more all encompassing else they are implicitly condoning the behaviour etc. etc.

Oracle rival chides UK councils for pricey database indulgence

Bloody should do though.

Re: If they really cared about tax payers cash

We don't buy a database first then look for the application to put on it, we'll buy the software service that meets the business needs and go with the supported database from that supplier.

Normally you trade off the closest fit against the lifetime cost and with a lifetime of reaming from Oracle in store I'd say you chose wrong. I'd also seriously question the value and quality of any software that can only run on one database engine unless that database is PostgreSQL or any other free instance. Seriously, "our software will only run on an Oracle DB" has amateur hour written all over it.

Re: "falls to the License Management Services team –.. and the optimization team. "

I'm also left wondering how much of this would actually stand up if actively pushed back on. For example

"It becomes a bit of a horror show in very many cases when customers feel they are compliant [with the terms of the Oracle license] and are not compliant."

Not compliant according to who? Oracle? Please! Independent 3rd party or legal decision else go get fucked.

"If you're using something like VMware, then Oracle doesn't recognize that," he said. So if you're only using four cores to run our app and your organization is using 64 cores with VMware, Oracle will come and ask you to pay for 64 cores."

Cannot see how this could possibly be legal under EU law. In fact I'd wager it isn't but Oracle are yet to have their turn on the judicial circuit but their turn will come. This is like MS enforcing you having to have IE. You don't technically but the punitive financial sanction on offer essentially enforces the user only virtualising on Oracle. That is not legal, it cannot possibly be.

I don't even buy the "Oracle is a very good enterprise platform". It is generally grossly over-engineered for what the vast majority need and likely sub-optimal for those with specialist needs. It seems like a jack of all trades on steroids. Their syntax shits me, not to mention the number of conditions under which it will convert a datetime to a timestamp and then table scan instead of index, and it is generally a massive pain in the arse to use with other systems.

Bigg observed that Oracle often makes demands outside of the scope of contracts. "Oracle will routinely tell the customer they have to license every one of their VMware hosts, even if a only a portion of them run Oracle software," he said.

So, fraud essentially. Fuck me, their time in front of the EU cannot come soon enough.

Foil snack food bags make a decent Faraday cage, judge finds

Re: Playing golf during working hours

Best one still has to be Stan O'Neal. Whilst Merrill Lynch was haemorrhaging billions he improved his handicap...

https://seekingalpha.com/article/51415-while-merrill-was-writing-down-8-billion-stan-oneal-was-playing-golf

Australia to probe Web giants' impact on news, ads, competition

Obviously digital media has been a little slow with the lobbying dollars compared with old media and hence needed a little prompting. Cue increased donations whilst this goes on and a prompt forgetting all about it after the election.

Timeline

It's also a timeframe that will see the final report delivered after Australia's next election

You expected them to not make it someone else's problem or forgettable?