Posts by Dan 55

74 countries hit by NSA-powered WannaCrypt ransomware backdoor: Emergency fixes emitted by Microsoft for WinXP+

Re: so far it's taken an hour and it's still searching

Well so far the computer's been going 24 hours and it's still searching, and that's with the hotfix that's supposed to speed it up applied. Fucking useless.

Re: You are missing the point

You can't see both are related? Not patching on the corporate LAN quick enough means large downloads at home when you do take it home.

Re: You are missing the point

That's why I said 1-2 weeks after the release date. Leaving it two months is too much as we have seen.

I hope your patch management is better and more timely than your reading comprehension.

Re: Every day is a learning day

Many people have already learnt to avoid MS, and I guess many more people are learning at this very moment.

Re: You are missing the point

The ideal thing would be if our corporate patching happened in a reasonable amount of time (1-2 weeks after release), not be so slow as to result in a huge download when you go home.

Re: "Ban Bitcoin!"

It'll certainly be an excuse to tie Bitcoin up in red tape and reduce or remove anonymity. It's been found in 74 countries, I'm sure the English-speaking countries and the EU can think up something.

Re: Solution

@h4rm0ny: Running a thorough fuzz test on a server using the SMB1 protocol should have found this, it is after all a problem caused by a subtraction operation run on a 16-bit value and a 32-bit value. They've had a few years to do it. Same goes for a thorough code review. SMB is a known weak point for viruses.

Re: How bad will it get...?

Speaking of Redmond's incompetence, I manually started Windows update on the other half's laptop this morning and so far it's taken an hour and it's still searching. I'm not surprised this is spreading like wildfire since MS nobbled Windows 7's Windows Update when they released Windows 10.

People aren't going to wait for this update to deign to download and install automatically, they're going to turn the computer on, do something, and turn it off again. This is why the March patch has not been installed yet for home users.

Re: "Ban Bitcoin!"

Underfunding something (NHS, social care, education, police, local authorities) is never the problem, it's always something else.

Re: How bad can it get...?

They have now, because they've been given away for free and everyone's going to be jumping on the bandwagon, this attack is just the first and the next one won't have a kill switch.

Re: You are missing the point

Telefonica R&D... Oxymoron overload.

Where I work has some corporate updater that seems to be designed to keeping updates off the computer and only updates IE once every six months or so. Then people work from home and get a load of updates coming in because IT haven't worked out how to stop them when the computer is off the corporate LAN so you're safer if you work from home. If this doesn't get us it'll be pure luck more than anything else.

A bleary-eyed Microsoft wakes up after its cloud, IoT party, clears throat: 'Oh yeah, so Windows...'

Re: Too little too late.

Symbian Belle also did hamburger menus, but at least Nokia understood that the menu bar goes at the bottom, the hamburger icon goes in the bottom right, and the menu itself popped up at the bottom right of the screen.

It's as if nobody thinks about UIs any more, they just unthinkingly regurgitate bad designs.

WannaCrypt ransomware snatches NSA exploit, fscks over Telefónica, other orgs in Spain

I expect more than one PFY will be unhappy about this, big companies tend to work until 2pm on Fridays in Spain.

Some people maintain it makes up for working till 7pm or later in the week.

Try not to scream: Ads are coming to Amazon's Alexa – and VR goggles

I think they've factored in the cost of a certain percentage of people stopping using it, because they know most will put up with ads for Disney films appearing in replies.

US spymasters trash Kaspersky: AV tools can't be trusted, we've stuck a probe in them

And then immediately did a photoshoot in the oval office with some Russian politicians and a Russian photographer (so we are told), just to show who can grandstand the most.

10Mbps universal speeds? We'll give you 30Mbps, pleads Labour in leaked manifesto

Not that I am particularly pro Labour, but:

Labour governments: more fiscally “conservative” than Conservative ones?

Fact Check: did Labour overspend and leave a deficit that was out of control?

The Conservatives have been the biggest borrowers over the last 70 years

Drugs, vodka, Volvo: The Scandinavian answer to Britain's future new border

Re: Who is going to pay for all this?

Will you be able to switch jobs as easily? Do employers have to prove they've exhausted all host and EU candidates before hiring you? Will you be able to set up a business as easily as an EU citizen? you aren't working, will you still be able to get healthcare and unemployment benefit? Are you sure that the UK part of your pension will rise with inflation? When you retire, who will pay for your healthcare for that part of your working life which you weren't resident in your host country? If you worked in mote than one EU country, will the rest pay your pension? Etc... etc...

I'm glad you're so confident about these things. Perhaps other people in the same situation are just getting bothered about nothing...

Re: Who is going to pay for all this?

Take a look at the difference is between your EU treaty rights now and how foreign residents from outside the EU are treated wherever you are. You wouldn't have the same status where you're resident and you wouldn't have the same freedom to cross over EU borders (on holiday, on temporary work assignment, as a frontier worker, or moving to another EU country).

Re: Who is going to pay for all this?

Why would the tax be distributed differently but remain the same? I can't see any of the EU 27 willing to subsidize the UK.

Even if the UK doesn't charge tariffs on imports from the EU, there still has to be an element of cooperation. The UK has to show where goods exported to the EU came from so they can be checked and the right tariffs can be charged on the EU side, otherwise the EU will just charge the highest tariff it can and/or seize goods.

Re: Who is going to pay for all this?

Indeed. My point was that British expats may be required to pay tax on foreign income like American expats are, given that the present government is so keen to throw them under a bus with regards to Brexit (their proposal to the EU was just convert the status of all EU citizens in the UK and British citizens in the EU to ordinary foreign residents and say 'job done, let's talk about trade').

Re: Narkotikahunden

I think The Narcotics Hound sounds a bit more heavy metal and befits Scandinavia.

Re: Who is going to pay for all this?

I'm fully expecting Mayhem to bring in a tax on worldwide income for Brtiish expats. The cupboard is strong and stable but bare, nobody would give two fucks back in the UK, and the US does it so what's good enough for the US is good enough for the UK.

Train crash Brexit

It's already too late to get a system like that up and running in less than two years from now, especially if uk.gov just gives it to Crapita as they always do. Nobody will even know what they're designing for until it's agreed, which means there's even less time.

LastPass connectivity snafu locks out Brits from password manager

Who's going to take the red pill and run traceroute to LastPass' server?

Mozilla to Thunderbird: You can stay here and we may give you cash, but as a couple, it's over

Re: Apart from security fixes - why change Thunderbird ?

Card/CalDAV. Completed maildir support. Calendar improvements.

Firefox OS actually makes sense on a TV - usable, fast, looks good. Of course it was something they could make money from too if they really wanted to do that so that they stopped developing it.

Mozilla wants EU to slow down its ePrivacy Directive process

Re: Mozilla could already do a lot for privacy

If they prohibit cross-domain JavaScript the whole jquery angular Web 2.0 bollocks would disappear up its own fundament overnight given that web designers are seemingly incapable of copying files across to their own domain and instead find it preferable to include them from elsewhere meaning they are at the mercy of third-parties deleting a left pad function or something.

And advertising and tracking would get killed overnight.

On second thoughts perhaps they should do it.

Android O-mg. Google won't kill screen hijack nasties on Android 6, 7 until the summer

Everybody will have to upgrade to Android O

This is crap (what Google are doing, not the article).

Google care more about the potential lost ad revenue from (malware) apps running on outdated versions of Android than backporting a dialog with allow/deny buttons the first time overpaint is used or whatever it is they're going to do in Android O.

The fix would eventually arrive on many phones, more phones than Android O will.

$6,000 for tours of apocalyptic post-Brexit London? WTF, NYT?

Re: They could do a real brexit tour

The BBC graphic in the middle shoehorns a proportional vote into FPTP by area. When nationally the results were 35% of the electorate voting to remain vs 37% voting to leave, it makes little sense to claim that almost every area of the UK voted leave.

Rich professionals could be replaced by AI, shrieks Gartner

Gartner's already been replaced by an AI

If you can call a random number generator an AI. As they're consistently wrong it's probably rand, not random or rand48, and definitely not arc4random.

London app dev wants to 'reinvent the bus'

Re: Ulsterbus

- Right, brainstorming guys. What can we do before the money runs out?

- I once went on a weekend break to $CITY and saw $THING on a bus. Let's copy it.

- Ok, anything else?

- I once went on a weekend break to $CITY and saw $THING on a bus. Let's copy it.

Ok, anything else?

- I once went on a weekend break to $CITY and saw $THING on a bus. Let's copy it.

Etc... etc...

Realistic Brits want at least 3 security steps on bank accounts

Re: Two glaring omissions

It's possible to refuse all online contactless transactions by checking a flag and not letting them go through. Offline contactless would be more difficult.

Two glaring omissions

I notice they've not given an option to disable contactless or to disable use outside (say) Europe.

If you're going to allow people to lock their cards down you might as well do it properly.

How to remote hijack computers using Intel's insecure chips: Just use an empty login string

Re: noob or arrogant...

And how would a string type fix the fact the programmer used a substring compare function instead of a full string compare function?

In many languages, that bug is simply impossible.

There are languages without substring compare? Tell me which ones they are so I can avoid them.

Re: bloody c language

That is a problem in the compare routine. If the length of the strings is different it should return a mismatch.

Also known as strcmp()...

Re: "It was a very similar bug that lets pirated Wii games to be played on the console."

The Wii's bootloader and OS are run by an ARM coprocessor in the GPU, but the games themselves are run by a PowerPC.

Your last sentence is, of course, correct.

Re: noob or arrogant...

It's purely bad coding, not C's fault that someone decided to use strncmp instead of strcmp. Looking at the code snippet we can be fairly sure that he two strings have already been validated and stored in their own string buffers, so why not use it? You'd get the same error in BASIC if you'd decided to use LEFT$ instead of = for some crazy reason.

And code review and QA should catch it. The fact that it didn't means AMT is probably full of other bugs.

Uncle Sam backs down on slurping passwords from US visa hopefuls

¯\_(ツ)_/¯

Travel history during the past fifteen years, including source of funding for travel.

Address history during the past fifteen years.

Employment history during the past fifteen years.

Well I could get about 3/4 of that right. Maybe. The question is, can I be arsed to jump through all the hoops? No, I can't.

I wonder what the US tourist industry has to say about this.

Today's bonkers bug report: Microsoft Edge can't print numbers

Re: And all the students that get stuck with Windows S!

Oops, so it is completely lobotomised.

Re: And all the students that get stuck with Windows S!

Presumably you can still install CutePDF writer and print to that from Edge, unless Windows 10 S is completely lobotomised.

Leaked: The UK's secret blueprint with telcos for mass spying on internet, phones – and backdoors

Re: Encryption is not made "illegal"

If you're developer in the UK making something that can be considered a telecoms app or service, you need to avoid e2e encryption and build in realtime monitoring otherwise, if you are told to give up data on someone, you won't be able to respond in 24 hours with the data they ask for and therefore you will have broken the law.

They even tell you to consider this law when designing your app or service.

But no, there's no "we ban e2e encryption" clause. Why would there need to be if you end up in a whole heap of trouble anyway?

Re: Encryption is not made "illegal"

He doesn't need to argue, Skype etc... already are covered:

A telecommunication service is defined at Clause 223(13) as ‘a system that exists for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electromagnetic energy’.

Privacy International

Re: Encryption is not made "illegal"

"14. To consider the obligations and requirements imposed by any technical capability notice when designing or developing new telecommunications services or telecommunication systems."

That there looks like banning e2e encryption and building in realtime monitoring.

Re: Encryption is not made "illegal"

If I understand it correctly, any developer who offers an encrypted app or service and is served a notice has 24 hours to decrypt the data they have on someone and hand it over or they are breaking the law.

This is does not allow for e2e encryption. Despite MPs saying it wasn't banned, it was banned.

Has their braindead legislation just made hashed and salted passwords illegal?

Maybe the future for apps is a plugin architecture and open source e2e plugins on github, similar to PGP encrypting email messages despite SMTP knowing nothing about how that's done.

Booze stats confirm boring Britain is drying

"In the 1960s, the authorities declared that a bottle of wine a day was a safe drinking threshold."

So is the article insinuating that a bottle of red a day is real safe limit and the puritans have forced it down ever since?

Some of us have to work in the morning and think with our heads and that, we're not all journos you know.

Windows 10 S forces Bing, Edge on your kids. If you don't like it, get Win10 Pro – Microsoft

The MS spokesman will say something like, "You see, there's a very good reason why we've done this. It's very technical and veeery complicated. It needs Edge because cloud. Only Edge can offer the cloud as it was meant to be experienced."

Looking forward to the registry hack landing about the day after.

Gang-briefed by IBM bosses in Hawaii? Nah, I'll take redundancy

Re: "there was no automatic qualification based on sales quota"

Is it?

The Island with Bear Grylls

Can the IBMers survive on a remote pacific island using only their initiative and key performance indicators? Using some old AS/400s for heat and the staff canteen for food, watch as they try to make it to the end of the month to receive their wages. Their stay could be cut short at any time by an e-mail from HR telling them to relocate to an office 1000 miles away or pack their bags.

Cabinet Office losing grip on UK government departments – report

Re: Obvious, really

Yes, I'm serious. A government should not be able to set a date for a referendum in which nobody has planned for one of the answers and where the immediate aftermath was what we saw in June and July last year (and an early general election this year).

Re: Obvious, really

I upvoted, but then I immediately realised that the OBR is, after all, a government department so would face pressure to not be as generous with other parties as it would be with the government. But I'm unsure as to how it could be done in a different way.

Then there are also the actual manifesto promises themselves - are they politically feasible or is it just made-up shit? The Electoral Commission, for instance, should have had the power to block the referendum until there was a credible contingency plan from the government and a credible exit plan from Leave.