Posts by big_D

Dishwasher has directory traversal bug

If so-called tech companies give up on patching a smartphone after 3 - 6 months in many cases, what chance does an IoT white good have in 10 to 20 years?

In most cases, there just isn't any benefit to having white goods attached to the internet. What is it supposed to tell me? I can't start it until I have manually filled it up and it already turns itself off, when it is finished.

Mine has a little light for salt and another for clear rinse, which light up when they need refilling... I just don't see the need for these things.

Sources: Misco sold to Hilco Capital, care home for the distressed

There is a name I haven't heard for nearly 2 decades! I didn't realise they were still in business.

UK Home Sec: Give us a snoop-around for WhatApp encryption. Don't worry, we won't go into the cloud

such applications give terrorists a "place to hide".

Such applications give normal people a place to communicate without being overheard by hackers...

And removing encryption would mean the end of the internet. Without it, there would be no online banking, no online retail and no communication tools for businesses or teams.

If they want to go this route, then they need to ban fertilizer, diesel, petrol, alarm clocks, mobile phone, card, trucks, computers, knives, guns and dozens of other every day items that are essential to everyday life, because they could also be used by terrorists.

If a politician doesn't understand a subject, such as the applied mathematics used in crypto, they should not be allowed to make such stupid comments about it. Apply that to all areas where they poke their noses in and the world would be a much more sensible, and quieter place.

'Clearance sale' shows Apple's iPad is over. It's done

Current 13" MacBook Pro with touch strip instead of function keys.

The current Mac Book Pro seems to be making a case for replacing the keyboard with an iPad on their notebooks! The keyboard has to be the absolute worst I've ever experienced!

And I get funny looks, because I still use a couple of older Apple keyboards on my Windows PCs!

Re: Education PC seller says Apple is no good in that market

Having been in education (UK) from 1980 through 1990, kids in education in the 90s and working in education between 2000 and 2007 (Germany), I saw exactly one Apple device during that time, an old Apple II that never got turned on.

When I was learning, it was all Commodore PETs and a few C64s and a BBC Model A, then at college it was PETs again, a handful of BBC Bs, which were then replaced by IBM PC clones.

That remained the status quo, even when I became a guest lecturer in Augsburg, there it was all Fujitsu, with a few convertible Windows XP Tablet Edition devices.

Apple might be big in the USA, but in the educational establishments where I studied / worked, they were pretty much non-existent.

eBay dumps users into insecure authentication mechanism

Re: Sorry...

It would be, if it was a legacy way of doing it, but they are moving users from a safe (but expensive for eBay*) method of 2FA to a "new" method, which was depricated, before they tried to move people to it!

* The eBay "football", I believe, uses a Verisign service and eBay has to pay for each verification of a token. They want to therefore move to a cheaper solution, SMS is cheap, QED.

That SMS was superceded years ago by better methods, such as an authenitcator app on a smartphone, seems to have escaped FleaBay in their timewarped dimension. I suppose we should be grateful that they use HTTPS...

Although 2FA over a phone only works as long as you don't use the service on the same phone that the authentication is running over! E.g. running on a desktop, with authenticator app is fine, using the eBay app on the same phone as the authenticator (or where the SMS lands) negates having 2FA.

SMS is worse, because you can easily subvert SMS.

With Skype, Microsoft's messaging strategy looks coherent at last (almost)

Re: As I suffer with Cisco's Jabber...

We are looking to replace our PABX this year. The main feature the replacement must have is a decent softphone with integration into our contact lists in our ERP solution.

We want to get rid of as many phones as possible - some areas need physical phones, but wherever possible, we want to switch to wireless headsets.

We also did this at my previous employer, using the Swyx solution, which worked very well.

DNS lookups can reveal every web page you visit, says German boffin

Re: Now we know..

Careful now. The advice was sound. Your ISP is, technically, a good place to look for DNS services.

Except in the USA they were given carte blanche last week to use any and all data on their customers and to sell it to third parties as they see fit (FTC ruling).

Re: Dumb question

The problem is, today, that those hosting the DNS are also interested in deep analysis of browsing habits, generally speaking.

In the US, the ISPs have just received the right to sell any and all information gathered about their users, so DNS logging and patterning would make a nice little earner, to bolster profits.

Disk space is cheap and selling browsing habits is lucrative.

Set up your own DNS server and cut them off at the pass.

Re: Simple fix

If your router can't do it, then set up an old PC on the inside to act as your DNS resolver, probably a better bet than using the router DNS cache, long term.

Re: Explanation please?

@Charles9 if you are already using your own home server, add a DNS service to it, to serve local devices, then the problem goes away.

Re: Now we know..

Just use your own local DNS server.

Are you undermining your web security by checking on it with the wrong tools?

Re: Bit disappointed

I would say, at the moment, if you can't do it properly, don't do it at all!

These products ARE creating weaknesses in the chain. Yes, inspecting the traffic is important, but not at the cost of opening yourself up to other attacks.

Google's Deepmind NHS deal 'inexcusable', says academic paper

The software the other trusts use don't link patient data with their advertising profiles... ;-)

Hailing frequencies open! WikiLeaks pings Microsoft after promise to share CIA tools

@Tom Re: Victims?

No, it was pointed at the first comment in the thread. There it was stated that many people don't patch straight away, so information about the bug shouldn't be published straight away.

If the patch is out there and it is a big hole, then it should be published straight away, to try and get people to apply the patch. If there is a patch, many think "oh no, not another patch, f' off." If they know that it fixes a hole that can be actively exploited, they might actually think about applying it.

Re: Victims?

The problem is, the holes are already out there, and if the CIA knows about them, there is a chance that other organisations and criminals also know about them. Keeping quiet, once a patch has been released doesn't help anybody.

The problem is, a flak jacket won't protect you from a head-shot.

Patching is necessary and protects you from the majority of issues, but it can't help against zero-days.

At least with a flak-jacket and patches, you stand a chance of coming out alive.

Germany to Facebook, Twitter: We are *this* close to fining you €50m unless you delete fake news within 24 hours

What constitutes hate speech, I hate the Government ?

It is very clearly defined in the law books (BGB, Bundesgesetzbuch).

Apple urged to legalize code injection: Let apps do JavaScript hot-fixes

@FatGerman

I have only had one product that went out nearly bug free.

We did a multi-national budgeting system for a client. Several hundred users in over 50 countries. The system was used for several years and in the first 2 years of live use, it produced 2 bug reports. One we fixed, the other was a bug in localised versions of Windows running international English - the Win32 call to return the local month names in the current language always returned "January", for all 12 months!

The client told us, that English was the company language and we should hard code the month names.

But yes, such projects are, unfortunately, few and far between. I've worked on many others that had a lot of bugs, due to complexity issues - it gets worse with web applications, because they are also reliant on the client; if one browser displays the app wrong, you have to go back and re-work the CSS to ensure it is displayed on all possible browser combination properly. It is getting somewhat better, but it is still a moving target.

Re: Pretty sure Apple (and Google/MS) never allowed this...

Skype has been going through a change in the way that it works, at a base level. That means changes throughout the whole system.

An application is made up of thousands of subroutines and libraries. If you need to apply changes to a lot of libraries, then the update will be big.

The Linux version of Skype has been neglected for years and got a recent update, so that it could still talk to modern versions of Skype on other platforms.

Whilst it is a pain for developers to go through the review process, it is the proper way to do it and I hope that Apple don't cave on this. I am not an Apple iPhone user, but this is one of the few benefits of their closed ecosystem.

It behoves the developers to use their own in-house testing and review processes, to ensure that the biggest bugs disappear, before the app is given to Apple. If they find more bugs and security issues, before they publish it, that means a safer, smoother experience for their customers and not stressing, because they are trying to rush out an update and having to wait for Apple to green-light the update.

Maybe Apple should offer, as consolation, a fast-track update route for major security issues and bugs causing devices to crash.

Waaaah, we write shite code...

And Apple won't let us fix it on the fly.

What could go wrong?

Can you ethically suggest a woman pursue a career in tech?

Re: "We need to promote women disproportionately, pay them equally or better..."

There should be no discrimination between male and female works, either positive or negative.

They are all part of the team and all deserve the same opportunities. It should be down to individual performance and nothing else.

Force employees to take DNA tests for bosses? We've got a new law to make that happen, beam House Republicans

Re: Unicornpiss @GATTACA

@Oengus exactly. The family car will probably drive 20 - 30,000 miles a year, heck, when I was working in the UK, I was doing around 60,000 a year, as I was always working on client sites a long way from home.

The insurance on my classic car, which did less than 2,000 miles a year (which is a lot for many classic cars!) was a pitance, compared to what I was paying for my "normal" car (VW Passat).

Re: @GATTACA

*cough* Stephen Hawking *cough*

FCC under fire for trying to ditch cybersecurity

Re: They're right

Ever heard of expert consultancy?

And I would say that the second paragraph is exactly what they should be doing. That is certainly what the EU commission is looking at doing.

The problem is, IoT devices will suddenly be priced realistically and people will actually question, whether they need them or not. Maybe not a bad thing.

If the devices have to have enough price overhead included (or a subscription) to keep them safe for a reasonable lifetime (at least 5 or 10 years, depending on the device), the it will make people appreciate just how complex and difficult such things are to make and maintain and it should help reduce network misuse.

Re: The Fall of Rome

I thought politicians are supposed to be there for the best interests of their voters, not to quash anything proposed by the opposition, whether it has merit or not.

If a proposal is really stupid, fine, argue against and show why it is wrong. If it has merit and protects your voters, then have the good grace to acknowledge it and be done with it!

Seagate dismounts Korean design center, fscks 300 workers

Re: Poor people

Agreed. I have been caught out twice by big industry shifts. where my employers had to change direction, or in the second case, were too slow to change. Not a nice situation.

At least my skills were transferable and I could quickly move on. I hope they find new jobs.

Germany to roll out €100bn gigabit internet network

Re: Cable speed in Germany

I thought Germany had dropped analogue years ago. Certainly terrestrial TV switched to digital in 2008 and satellite has been digital since around 2004. DVB-S2 has been the mainstay for several years now, for satellite, and DVB-T will be switched off at the end of the month, being replaced by DVB-T2. We have DAB+ in the cars and in the kitchen, but analogue FM is still widely used here. That hasn't caught on as well - mainly because few car manufacturers offer DAB as standard in their cars, I think.

No idea what cable companies use, I've never had cable. But my youngest daughter has Kabel Deutschland in her flat and that is DVB-C (digital), which the TV receives without the need for a set-top box. But she uses EWE-Tel for her broadband, which is a 50mbps DSL connection. Whether Kabel Deutschland also push analogue alongside the digital, I don't know.

We use satellite (DVB-S2) and normal broadband (Osnatel). In fact, in the UK I used to have Sky, but since moving to Germany, I've never had any subscription TV service, just the freeview channels. With around 70 channels, I've never seen the need for a subscription. Now, with Amazon Prime, I get a lot of films and series to watch as well.

Flensburg is about 400KM from here (Osnabrückerland).

Re: BT vs DT

DT is hurridely swapping customers over from ISDN to VOIP. The hardware suppliers are stopping support for the exchange hardware, so DT are moving away from ISDN.

ISDN was big in the late 90s and through the 2000s. Over here, if you wanted broadband, you pretty much had to have ISDN. BT, on the other hand, were saying that it was impossible to have ISDN and broadband on the same cable... Perhaps if they had used Standard ISDN and not their bastardised version.

We switched to VOIP when we moved to Osnatel, about 3 years ago.

Businesses in Germany will have to swap to VOIP by mid 2018.

Re: Cable speed in Germany

Not sure what the cable offers upstream here. I live in Lower Saxony. But Osnatel offers very good packages here - they rolled out FTTC a couple of years back and they offer good deals here.

I was with DT, but they only offered 2mbps. I looked at Osnatel and got the 50mbps package, it has since been bumped to 100mbps. Having been a long term DT customer, I aksed what they could offer, to compete with Osnatel DSL. They offered 3mbps and a satellite TV package! Needless to say, the change to Osnatel was done pronto.

Re: Or is the government listening...

It isn't just DT.

We have EWETel/Osnatel cables at home (FTTC) and at work the cable is from Inexio (FTTP). There are lots of suppliers around the country laying fibre.

Re: Government Investment

On the other hand, Germany is fighting to reduce its loans at the moment.

All local councils now have to be in the black. It meant a couple of years of lower service from the councils, the roads have suffered, for example, but now that those around here are no longer in debt, they are investing again.

I live in a semi-rural area of Germany and we have 100mbps down, 25 up for 49€ a month, with VOIP flat rates in all German networks.

If I switched from DSL to cable, I could get gigabit, but the cable provider is a bit of a bandit and accused my wife of stealing cable at her last flat (she had satellite TV), so she won't let them within spitting distance of our property.

100mbps is more than adequate at the moment.

Brit ISP TalkTalk blocks control tool TeamViewer

Oh, oh, cars are used by criminals, quick, ban all cars on UK roads!

FBI boss: 'Memories are not absolutely private in America'

Re: Er ...

Comey is living Bush's words - he is harming his own country.

Google, what the hell? Search giant wrongly said shop closed down, refused to list the truth

Re: What about the postcard thing?

Because it takes too long. If they have mistakenly marked a business a permantently closed, then they should immediately revoke that status, THEN send out the postcard and if it isn't replied to within 14 days, re-apply the permanently closed status.

Two-thirds of TV Licensing prosecutions at one London court targeted women

In Germany the licence (GEZ) is pretty much the same as in the UK, except that it applies to anyone who has a PC or mobile device with an Internet connection, as well as TV owners. You don't have to watch the state sponsored networks, just the fact you have a device capable of watching TV or streamed video is enough to warrant paying for a licence.

At least they have stopped charging for each invididual device and person in the house. You now pay a flat rate for the house.

$310m AWS S3-izure: Why everyone put their eggs in one region

Re: "companies should consider building redundancy into their cloud instances "

Exactly, the marketing for moving to the cloud has always been: "your data isn't in one place and if one server/location fails, you just keep on working."

Never having trusted the cloud, I haven't any real experience of using it - other than the likes of GDrive/OneDrive for private use.

New prison law will let UK mobile networks deploy IMSI catchers

Ah, now Brexit makes sense... No more goody-two-shoes sticking their oars in.

Ad men hope blocking has stalled as sites guilt users into switching off

Re: You can remove my adblocker

I have no problem with adverts per-se. But until the ad-slingers guarantee me, that they will not serve me malware - and that if they do, they will take responsibility for the clean-up, then I will not allow them to execute ads on my machine.

In Firefox I use NoScript - they can serve me static ads, but no animations or scripts. Unfortunately Chrome doesn't seem to allow this level of filtering, so I am stuck with using uBlock Origin.

EU privacy gurus peer at Windows 10, still don't like what they see

Re: What information does Win 10 slurp?

At the most basic level, if you turn on all privacy settings, about the same amount of data as Windows 7.

If you want to use Cortana and search, then you give away more data.

If you want personalised advertising, then you give away more data.

If you want Edge or IE Smartscreen to protect you, you give away more data (same as Windows 7).

etc.

Ditching your call centre for an app? Be careful not to get SAP-slapped

Re: This behaviour

Not neccesarrily opensource, but it will make people look more closely at their contracts and maybe walk away from such per-named-user contracts.

It might make room for smaller companies to establish themselves with more "sensible", Internet orientated licensing.

At the end of the day, something as complex as an ERP system isn't going to be easy to make in an open source world. It needs dozens or hundreds of full time developers to keep it up to date and to fix bugs. It also needs to be very carefully defined and the specs adhered to, otherwise chaos will ensue.

If there is a bug in a graphics program or a driver, it isn't too serious. You patch it and carry on. If an ERP program has a bug, it is very likely that not enough material is being ordered, too much or that different production steps are being held up, that can cost serious money. And often a simple patch isn't enough to correct a problem, the data will also need to be corrected.

We are starting to see big open source projects come to fruition, but I don't know of any successfuly open source project on the scale of SAP HANA.

Another point is, the supplier of the software will often need certifications, like ISO 10001, for example. I doubt any open source project would be able to pay for, let alone gain such a certification.

I don't mean to belittle open source, I use a lot of open source software and I have helped out on some projects over the years. But at this level, I just don't see open source being an acceptable alternative, at least not at the current time.

Google bellows bug news after Microsoft sails past fix deadline

Re: ...the company all-but-accused Google of...

In this case, it looks like MS had problems with the patch generation infrastructure that was causing problems with the quality of the builds, so they delayed the patching until they can clean up the build system and generate patches.

If that really is the case, then Google should have given them the benefit of the doubt. If MS had released a bunch of patches this month and ignored the Google bug, then I would say, fair game, Google should let users know.

If however there is no known zero-day and MS are really having problems (which the complete absence of patches would seem to illustrate, then I think it would have been better to sit on it for a further month, or until a zero-day appears.

Smash up your kid's Bluetooth-connected Cayla 'surveillance' doll, Germany urges parents

Re: @ Dwarf

@John Brown exactly. If her eyes lit up red, when she was listening, then it would be fine.

The other services mentioned all make a tone, when they start listening and give a visual clue to the fact they are recording voice.

That said, Alexa has only just started shipping over here, in Germany, and it is likely to meet some resistance. Certainly my wife won't let anything like that into the house.

Munich may dump Linux for Windows

Re: Replacing Linux with Windows, based on *cost*?

@serendipity yes, I was on PCPro. I've been posting here since the late 90s. The silver medal next to my moniker means I post here a lot, so you haven't been looking hard enough. ;-)

Re: Replacing Linux with Windows, based on *cost*?

@Doctor Syntax

That could be part of the problem. Their preferred distribution is Linmux, an in-house concoction, as you say, which means that their IT department is busy packaging it, testing updates, checking software compatibilities etc.

No just chucking Ubuntu onto a PC. They are writing scripts to set things up and configure the environment themselves. I would guess that that is pretty much a full-time job for several people, just keeping the patches documented, integrated and tested.

Standard Windows 10 + WSUS would probably save a lot of time and money. They just need to test the patches, before they roll them out.

That is just supposition, but running standard Windows 10 is going to be simpler than rolling your own distro.

Re: Replacing Linux with Windows, based on *cost*?

Licensing makes up a small part of the TCO. Once you take into account roll out costs, maintenance, support and training over the lifetime of the machine, the cost of the licence usually works out to be a small part of the TCO.

Given that most people are familiar with Windows, support costs might be much lower - we have 200 users and we have so few calls, that we don't even have a ticketing system.

Kids these days will never understand the value of money

Re: The problem with this is spending discipline

The bank automatically attaches the credit card (Visa or Mastercard) to your current account and they take 100% of the balance at the end of the month. No option.

I also have a debit card, which works like it should. I only use the credit card for online purchases.

Re: The problem with this is spending discipline

I was brought up with pocket money, and what I didn't have in my pocket, I couldn't spend.

That carried over to when I started earning and, apart from 2 occassions, where I was travelling and didn't get the credit card balance paid off in full in time, I have never paid interest on my credit card - in fact, between 2003 and 2008 the card had a balance of +42UKP on it, because I overpaid and then didn't use the card for a couple of years. Unfortunately, they don't pay interest back, if you are in credit.

Now, the credit card I have in Germany is directly linked to my bank account and is always paid off 100% at the end of the month, if I don't have the funds to cover the balance, then it goes on my overdraught. That is the way credit card work over here, for the most part.

But the discipline I learnt as a child means that I don't spend money that I don't have. I don't pay for anything without first calculating, whether I can afford it and that I won't slip into the red at the end of the month.

The only thing I have paid for on credit is the house.

My wife grew up the same way and her children have also learnt the same lesson, so they are very careful in what they pay out and make sure that they never go overdrawn and always have a small reserve for emergencies.

I feel that this lesson is being missed out on by an ever larger part of the population.