I salute him...
...for having the balls to do it in the first place!
2666 publicly visible posts • joined 4 Aug 2009
"*Some* People in IT rarely seem to be interested in spending time watching what users actually do"
Also, some people, even when told what users do believe them wholly, which becomes their undoing!
20 years ago I was a developer at a company with an educational website. Once, while I was on holiday, one of the junior developers was asked by someone else in the company to produce a specific piece of software to run on the site - the "spec" was verbal only.
When I came back from holiday she told me that what the develope (who apparently hadn't questioned a single thing in the verbal "spec") had produced for her was "exactly what I'd asked for" but "didn't do what I wanted". After that she always came to me with requests so that we could battle our way to a common understanding of what was required and how it would actually look and function.
I suspect there are many of us hoping that "backward" trend continues so that a future version of Windows 10 will have the look and feel of Windows 7, revert an update system that allows us to block individual patches from screwing things up and isn't packed with telemetry snatching crap that phones home every couple of minutes!
OMG Stevie! I remember that exact column. It made me laugh so much I cut it out and kept it for years - not sure what happened to it in the end! Is it online anywhere?
A few years back I did a similar thing regarding the wardrobe in that, just before selling my previous house, I ran out of paint for the wall, so plonked the wardrobe in front of the unpainted bit. As I had no use for the wardrobe in the new house, I asked the new owner if he wanted it. He said yes - I always wondered how long it took him to discover the lack of paint behind it.
I once used one of my cats to help run a new replacement light fitting cable under the floor of the upstairs bedroom in my bungalow conversion. A piece of string was tied to the cat's collar who was then encouraged by my partner to the other end of the 15 feet or so of narrow underfloor passage, which he did quite happily. Once the string had reached the far end it was a simple job to untie the cat and use the string to pull the actual cable through.
My first reaction is to smack my forehead, and think, "What an idiot!"
However, a lot of it depends on the company or organisation that owns/maintains the software/service/device upon which the flaw exists.
If the company is known to be responsible and can indicate privately to the whitehat discoverer that the flaw needs X amount of time to fix (where X might be relatively small for software and probably a lot larger where hardware may be involved) then the discoverer should allow the company that amount of time (+ a bit of leeway) if it sounds reasonable to develop and push out the update. For those companies that are known to ignore such things and only react when the faeces hit the rotating blade type air circulating device then public disclosure should not be held back as that is the only way to get the flaws fixed.
In the end the way a flaw should be reported, patched and eventually made public should depend on an agreed, responsibly thought out timeline for that particular flaw that prioritises public security (and doesn't just pay lip service to it).
With regard to Spectre/Meltdown then El Reg's disclosure was probably timely as Intel has, in the past, been known to downplay things until their hand is forced.
Well then, just empty out their accounts - they might actually start getting the idea then!
It's similar with data backups - people don't do them until they get bitten by losing something essential (though, it does take a couple bites before they really start doing it properly).
I once had a client who thought their "completely original" idea of using "letmein" as a password was extremely neat. Not only had she told me it in the first place, she then took a bit of convincing as to why it wasn't quite as neat and original as she'd thought.
Users... sigh...
When I worked in IT Support back around 1998 we used to get numerous complaints about mice not working due to the build up of crap on the rollers and balls. I used to remove all the balls and take them to the nearest "gents" and give them a soak in a basin of warm soapy water. Other staff entering the loo would ask, "What are you doing?"
"Washing my balls," I'd reply.
I've moved whole web sites to different hosts where the website data contained encrypted passwords and that didn't require any such reset. Properly salted encrypted passwords contain all the information needed to determine the encryption used, even where several are in use on the same set of data. This means that there's no need to force a reset whatsoever.