Posts by ACZ

Copilot invades Microsoft 365 Personal and Family for an extra three bucks a month

And this will be appearing when my kids are doing their school homework?

I'm a bit pi**ed off about this. My kids have to use Word to do school homework. I don't know if it's just the desktop version or the web version as well (my kids have to use the web version to prepare homework submissions), but I really don't want Word offering to do their homework for them.

As much as I love LLMs/AI (and my kids' school encourages the use of AI as a learning tool), I do need my kids to be required to use their own brains.

:(

Apple and Meta trade barbs over interoperability requests

Re: Metà are the scummiest

Absolutely. A fundamental thing here is GDPR, and whether compliance with it can be guaranteed using rh information which would be made available if these requests (whatever they are) are allowed.

Given that Apple have zero control over the third parties who are requesting access to APIs/interoperability features, I could easily (and understandably) see Apple arguing that where allowing any request could result in personal information being made available (particularly about people other than the device user) then the GDPR provisions require them to refuse the requests.

QNAP NAS users locked out after firmware update snafu

If only they had said to do that in their instructions which instead say at step 3:

"3. Log in to the NAS web interface."

Doh...

ESET denies it was compromised as Israeli orgs targeted with 'ESET-branded' wipers

If emails are passing SPF and DKIM then *something* has been compromised - DNS control, outgoing mailserver, AD, etc etc

The statement from ESET says that "ESET was not compromised and is working closely with its partner [the Israeli partner company]". So basically the partner company in Israel was compromised. What does the partner company do? - just sales, or R&D etc. as well? And was the Israeli partner isolated from the main ESET network? Possibility of network traversal?

Hold my Pimms! Wimbledon turns to tech for line-ball calls

Good question - given that precision is the key thing here, that's a potentially big issue. I'm wondering if e.g. they have got some kit (for example, a calibration/mapping device that can trundle along the court lines and gather relevant data) to ensure that court markings are precise, or at least so that they can include the exact position of all markings in the mapped "virtual court".

Yes - I agree that it must be a 3D flight path model. There presumably won't be any sudden changes during the journey, which will make that bit relatively easy.

Once the relative position of all of the cameras is known and mapped (e.g. self-calibrate using lasers for exact positions), the positions of the lines can then be mapped (there will be small variations in court dimensions/line positions).

With that done, you then have the court markers in a 3D volume against which you can map ball movement.

Presumably flight path modelling just requires identification of the position of the centre of the ball (multiple cameras covering multiple planes, cross-reference obtained data), and then fit the obtained data against a suitable model.

With mapped ball and surface characteristics, it should then be possible to determine whether a ball will touch a particular line.

Just need to reluably do all that in a fraction of a second with some fault tolerance/error correction, and on robust kit. Simples! ;)

Oh my goodness that one in the video is close. I don't know if it actually *slides* a full 10cm though. It looks like it descends into the (artificial) grass and compresses before sliding (a bit) and then bouncing up out of the grass.Really interesting to see it all in slow-motion. However, that is *not* a Hawkeye camera running at 300fps - see the numbers below. That camera has got a much higher frame rate - I'm guessing well over 1,000fps, maybe up to 10,000fps.

Just doing some example numbers on this one: A service ball travels at 130mph = 209,205m/hr. That's 3,487m/minute = 58.11m/s.

The centre serviceline is 5cm (0.05m) wide (Rule 1, ITF Rules of Tennis - https://www.itftennis.com/media/7221/2024-rules-of-tennis-english.pdf). So at 130mph, the ball will cross the width of the centre serviceline in 0.05/58.11 seconds = 0.00086 seconds (well, slightly more than that - the ball is travelling at an angle to the line).

300 fps (for the Hawkeye cameras) is one frame every 0.0033 seconds (and they don't say how long it takes to capture each frame). That's almost four (0.0033/0.00086 = 3.88) times slower than the period taken for the ball to cross the line.

So what are the Hawkeye line cameras actually capturing? It doesn't seem like it will be an image of the exact moment the ball touches the line - at that kind of frame rate/capture speed, it will be more of a blur.l

ULA nears second launch of Vulcan Centaur in pursuit of US Space Force approval

So "payload mass simulator"?

Feds put $5M bounty on 'CryptoQueen' Ruja Ignatova

Re: "Ignatova remains at large"

The BBC podcast series on her (linked in the article) is great - do have a listen

Microsoft disarms push notification bombers with number matching in Authenticator

Re: Security vs Convenience

Exactly - if I'm logging into a system then just present me with a screen asking for a one time passcode from my authenticator app. It's not difficult and only takes a couple of seconds. The system should fail safe, and push notifications requesting approval are the total opposite.

The problem here is push notifications per se, not user fatigue.

Ireland to develop datacenter powered by fuel cells

Wind would definitely be nicer - actual renewable power. However, I suspect that one of the big wins with the fuel cells will be the relatively short delivery timescale and the stability of the power supply - you can have as many wind turbines as you like, but if there's no wind then you'll be sharing the same very finite grid resources as everybody else.

Lawyer's Microsoft email snafu goes from $1.75M lawsuit to Ctrl+Alt+Settle

Maybe helped with court submissions?

If he was without email for 14+ days, that's a big risk in terms of missed deadlines. By initiating proceedings against MS, I'm wondering if that gave him some useful leverage with courts/tribunals to say that not responding/missing deadlines was the fault of MS (despite him making all reasonable efforts and some more) and please can he have an extension on that deadline.

A toast to being in the right place at the right time

Re: He's toast

Hate to say this, but I suspect that the fire wardens may have been holding the fire doors open for everybody *because* of the high security entrance.

Modular finds its Mojo, a Python superset with C-level speed

Static typing in Python

As much as I appreciate the ease and convenience that can come from dynamic typing, I do *love* static typing (not just type hints, but actual static typing). Bring it on!

Semiconductor world in for a rough ride as chip bubble bursts at the high end

Re: Semiconductor world in for a rough ride as chip bubble bursts?

Try buying a Raspberry Pi at the moment - lead times are about 12 months, and 2nd hand kit on eBay is going at silly prices :(

Where are the (serious) Russian cyberattacks?

Re: The SATCOM network was taken down (mostly in Ukraine and Germany) (...)

Here's a link to the detailed technical write-up:

https://www.reversemode.com/2022/03/satcom-terminals-under-attack-in-europe.html

Note in this thread reference to a Der Spiegel article on this as well with an alternative explanation.

It's primed and full of fuel, the James Webb Space Telescope is ready to be packed up prior to launch

Re: New! Improved! oxidiser!

And includes a few words at the beginning from Isaac Asimov, including these two fabulous paragraphs:

"Now it is clear that anyone working with rocket fuels is outstandingly mad. I don't mean garden-variety crazy or a merely raving lunatic. I mean a record-shattering exponent of far-out insanity.

There are, after all, some chemicals that explode shatteringly, some that flame ravenously, some that corrode hellishly, some that poison sneakily, and some that stink stenchily. As far as I know, though, only liquid rocket fuels have all these delightful properties combined into one delectable whole."

;)

Raspberry Pi Zero 2 W: Nippy stocking filler for the nerd in your life – if you can get one

Re: Nice

I keep on meaning to try PiHole - currently pointing LAN DNS at an ad-blocking DNS server, but getting PiHole on the LAN would be much nicer.

Android OS vendor variants transmit data with no opt-out

Re: Ok, I have a question

Or it might just temporarily enable wifi to phone home...

It's time to delete that hunter2 password from your Microsoft account, says IT giant

No GPS required

You don't have to use the MS authenticator app - Authy, Google Authenticator etc all work as well - IETF RFC 6238, I believe. The only permission that Authy has got on my phone is Camera, so no GPS.

Home Office slams PNC tech team: 'Inadequate testing' of new code contributed to loss of 413,000 records

Re: Realities

Next, you'll be telling us that you include comments in your code so that it's easy to understand and review ;)

Lessons have not been learned: Microsoft's Modern Comments leave users reaching for the rollback button

Re: The best product doesn't always win

Ahhh..... WordPerfect 6.1 - it was absolutely magical. Reveal codes to show what was going on under the hood, a couple of minutes spent deleting unwanted bits and pieces, and job done - perfect. Small docs as well, which was helpful back when a 1GB drive was expensive.

Oh... and the document indexer was great as well - we had a structured file system for all our documents/correspondence, and the indexer ran every night. Ended up with a searchable index of >100,000 docs and it only took a second or two to find what you wanted. Not bad for the 90's :)

Google to bury indicator for Extended Validation certs in Chrome because users barely took notice

Re: Security is hard

This hits the nail on the head. Unfortunately, the vast majority of people are lazy about security. And even if you're not being lazy, how many people actually double-check the URL of a link before clicking on it? How many people check the SSL certificate on their email provider when it changes? How many people check the issuing CA on a certificate before deciding to trust it?

I suspect that even if you tried to block people from entering card details (i.e. recognisable patterns of information corresponding to a card), the workarounds employed by bad actors wouldn't deter people. In fact, the workarounds would probably be dressed up as being *extra* security to encourage people to trust the site...

This is an issue of human behaviour, a subconscious desire to conform, and a generally irrational desire to complete something once we've decided to do it. Especially when it's a really good deal and somebody else might beat us to it - quick - buy buy buy.

The simple fact is that people want to enter their card details and complete their purchase :(

Re: This is hilarious.

> Greedy, lazy and careless humans are the weak link... Unfortunately they're in charge of many areas of technology.

FTFY :)

Talk about unintended consequences: GDPR is an identity thief's dream ticket to Europeans' data

Re: A solution?

I hate to stir the hornets nest that is UK Gov IT projects, but wouldn't the Verify service https://www.theregister.co.uk/2019/07/18/verify_to_be_flagged_undeliverable_by_gov_projects_watchdog/ do the trick here?... ;)

WTF is Boeing on? Not just customer databases lying around on the web. 787 jetliner code, too, security bugs and all

Re: How many networks?

Exactly. This sounds like security through obscurity. It's really simple - either (a) there are *physically* separate networks for the avionics and other systems, or (b) they share the same network.

If it's (a) then great - just tell us. If it's (b) then it's open to attack and it is impossible to guarantee that there will be no access to the avionics network portion from the entertainment/crew info network portions. Somewhere there will be a bug/issue with a protocol, API etc. etc. that can be exploited. Difficult to exploit is not the same as impossible to exploit.

And, yes, passenger info systems need access to flight info, but that doesn't have to come from the avionics network portion - just include additional sensors.

Eggheads confirm: Rampant Android bloatware a privacy and security hellscape

Surely there's a big GDPR angle here?

These folks need to team up with a consumer rights advocacy group who can initiate some GDPR proceedings - sounds like it should be an easy win, and could be a very significant shot across the bows of device retailers and software companies.

Humanity gazes into the abyss to get its first glimpse of a black hole

Re: "Rather like a black hole for dollar bills."

Given the science that they did and the cost of the hardware (everything from hydrogen maser atomic clocks to thousands of helium-filled HDs - too much heat/friction from air-filled HDs), it's an absolute bargain.

Fantastic Horizon program on BBC 4 about this last night: How to See A Black Hole: The Universe's Greatest Mystery

There's also a series of six papers published in a special issue of The Astrophysical Journal Letters.

Stunning work.

Beers (just not up at telescope altitude ;) to all those involved

Stop us if you've heard this one: IBM sued after axing older staff, this time over 'denying' them their legal rights

Re: Why are these even legal ?

Like people have said above, it's a compromise agreement/settlement agreement, i.e. we are sacking you but want some additional undertakings (e.g. that you won't sue us for age discrimination, or won't engage in a class action). You don't have to give them to us, but if you do then in exchange (as a compromise) we'll give you some extra benefits (e.g. cash / pension etc. etc.). There's no requirement to sign it, but people often do because they want the additional benefits.

However, the issue here is that IBM have allegedly failed to comply with the statutory requirements which make such an agreement legal i.e. have withheld the age data.

Chinese biz baron wants to shove his artificial moon where the sun doesn't shine – literally

Re: Drag

The gyroscopes can maintain the angular orientation of the satellite. However, this (giant) mirror will still act as a solar sail - radiation pressure from reflection - https://en.wikipedia.org/wiki/Radiation_pressure

So what happens to that radiation pressure? In order for the satellite to remain in its orbit, something has to counteract it. The maximum radiation pressure would presumably be 9.08N (see link above) per square kilometer of mirror, although in reality it would presumably be somewhat less depending on the angle of the mirror to the sun. Not an insignificant amount of force to counter, particularly given its continuous nature, and it will have to be countered.

HMRC contractor scores IR35 payout after yet another taxman blunder

Re: "HMRC settled the tribunal case immediately before it was due to start"

Here's the decision... https://www.gov.uk/employment-tribunal-decisions/ms-s-winchester-v-commissioners-for-hm-revenue-and-customs-and-others-2207946-2017 - brief, but an indication of the time and money that will have been spent on this.

I suspect that it's the (unfortunately) regular occurrence where it's only when somebody who actually understands the law (so in this case, clearly not HMRC themselves) gets hold of the case that the right thing finally gets done. Let's hope that the whole court proceedings process hasn't been too much of a toll on Susan Winchester or her business. Could this be the death knell for CEST?...

Canny Brits are nuking the phone bundle

Telefonica own O2 and GiffGaff, so this is nothing new for them

GiffGaff and O2 are both owned by Telefonica, and GiffGaff runs on O2, so they've had their toes in the water for ages here. The market changes (and what O2 is currently offering to customers) reflects that. It will be interesting to see how both O2 and GiffGaff develop their offer.

Don't know if other major telco-owned MVNs like GiffGaff are running in the UK, but I wouldn't be surprised to see others popping up to try and capture that growing part of the market whilst the mainstream brands are used to service the customers who are willing to pay premium prices and/or want premium services.

Connected car data handover headache: There's no quick fix... and it's NOT just Land Rovers

Re: This needs some input from the DVLR

Yes... there are some convenient online systems from uk.gov (fx: dons protective headgear... ;)

When a car is purchased with all this internet connected stuff, is the data controller identified to the buyer? Is there a way for the new registered keeper to notify the data controller to revoke all third party access (including previous owner/registered keeper access)? Is there a way for the registered keeper to verify who has access to data associated with their vehicle?

Surely we just need a system where (a) the DVLA issues the registered keeper with a time-limited single use code specific to the vehicle, (b) they can then go onto the data controller's website and use it to associate the vehicle with them, and then (c) they can access the full list of connected devices/accounts and modify as appropriate.

Place a statutory obligation on anybody who sells a vehicle to notify the buyer of all data controllers and you're sorted.

Simples :)

'Facebook takes data from my phone – but I don't have an account!'

Re: host file?

I'd definitely suggest giving dns66 (https://github.com/julian-klode/dns66) a tryt - it'll set itself up as a VPN on your phone so all traffic is routed through it, and then just black-hole ad sites. Don't know whether the domains the FB app is talking to are blocked by it, but it's worth a try. If the problem app is installed as a system app then you might have to go into the dns66 "APPS" settings and toggle it to show system apps since dns66 is set up so that traffic from system apps is (by defaut) not re-routed.

If using dns66 then you can also get it to use a chosen DNS server, e.g. an ad-blocking DNS server.

Microsoft: Yes, we agree that Irish email dispute is moot... now what's this new warrant about?

I seem to recall that part of the reason why MS were able to resist the original warrant (and why e.g. Google weren't in other cases) was that they had compartmentalized things and that MS (USA) wasn't actually in control of the data.

Irrespective, the Data Controller at MS (Republic of Ireland) is responsible for safeguarding the data located in the RoI under local (EU) laws, and so they should be able to block any request for the data from the US Gov via MS (USA).

It'll be interesting to see how this one pans out...

NHS Digital heads accused of being 'suppliers', not 'custodians' of UK patient data

Re: Patient data is a national asset

They're already doing that with allowing the likes of Google to access patient data on NHS Spine and do analytics/ data mining on it. At a fundamental level, that kind of thing (subject to *proper* data protection) has a real potential to deliver clinical benefits for patients. However, for that to happen the data custodian must guard the data and ensure it is properly protected. Without that, nobody will trust the NHS and, hey presto, a large group of patients (inevitably including some who are highly vulnerable) won't engage with medics / the NHS.

Didn't install a safety-critical driverless car patch? Bye, insurance!

Re: So...

Erm...the bill says that insurers don't have to cover you if there is "a failure to install safety-critical software updates that the insured person knows, or ought reasonably to know, are safety-critical".

So if there's no "safety-critical software update" then you're still covered by your insurance policy. If the manufacturer EOLs the vehicle and stops supplying patches then the insurer can't dump the liability on you. Then again, it might not be possible (or might be very expensive) to insure vehicles (which drive themselves) when the manufacturer decides that they have gone EOL. Then again, you won't actually own a car anymore will you? Odds are you'll be in an Uber (or suchlike) vehicle.

:)

Re: Safety-critical updates?

Remember - this bill primarily deals with (a) liability of insurers, and (b) EV charging. Current draft is: https://publications.parliament.uk/pa/bills/cbill/2017-2019/0112/cbill_2017-20190112_en_2.htm#pt1-l1g4

Doesn't mean that it will illegal not to install a CarOS patch or root/install a custom firmware, but it might mean you're not insured.

Big thing is that this is enabling legislation, and is therefore intentionally broad, so that it works now and decades into the future - fundamental principles are in there to provide stability/certainty, and then it's up to insurers and courts to deal with the real-life scenarios.

So this will all come down to the insurers, who will in turn force the hand of manufacturers as per AC's comment above. Insurers will also have to come up with some good standard T&Cs, e.g. requiring patch installation within a "reasonable period" which they define e.g. no more than 7 days of public release by the vehicle manufacturer. Manufacturers will presumably have to push delivery of OTA patching on release, and force install within a given time period, e.g. at the end of the period preventing new journeys until the patch is installed. Manufacturers might also have to e.g. provide very clear and prominent notifications about CarOS patch status before commencement of a journey.

Rooted CarOS - probably wave goodbye to being insured, at least with any conventional insurer. Rooted entertainment system - might still be insured *if* it doesn't have any impact on vehicle safety, but read the fine-print on the insurance contract. Might encourage a truly hard (physical) divide between car-critical systems and entertainment, but that's going to require the manufacturers to go for safety over shiny things, convenience and cost, so odds of that happening?...

123-Reg customers outraged at automatic .UK domain registration

Or did the .co.uk domain owner register the .uk and then transfer it?

The real battle of Android's future – who controls the updates

Physician, heal thyself

So does this mean that Google will support devices for longer? Will this mean that they end-of-life devices after *more* than 3 years?

https://www.theregister.co.uk/2017/05/01/google_eol_for_nexus_phones/

I know it's been said (many) times before, but this is something that Apple have got right. If this means that Android devices are supported longer then that would be great.

Samsung Galaxy S8+: Seriously. What were they thinking?

How much?!? Just get a OnePlus 3T

Seriously, that's a truly stupid amount of money for a phone. A dual-SIM OnePlus 3T is £399 all-in for the 64GB model, £439 for the 128GB model, and their current production OS build is at Android 7.1.1 and is basically stock Android with no manufacturer cr*p to remove (*no* Bixby or anything like it), can be easily rooted if you want to go that way, and doesn't have a fingerprint sensor in a stupid place.

I know the S8 comes with a curvy screen but is it worth £400?...

</utterdisbelief?

Apple fans, Android world scramble to patch Broadcom's nasty drive-by Wi-Fi security hole

Re: That's not how that works

http://standards.ieee.org/news/2011/80211z.html -

"1. IEEE 802.11z reduces the number of times a packet gets transmitted over the air from 2 to 1."

"3. If client devices are perhaps newer and capable of operating at data rates or in frequency bands not supported by the access point they can do so."

:)

Re: Full list?

Just working my way through Gal's Project Zero article (which is absolutely excellent - do read it), he says when searching for possible vulnerabilities to exploit:

"Broadcom provides many features which can be licensed by customers -- not all features are present on all devices"

However...

"Searching through my firmware repository I can see that the vast majority of devices do, indeed, support TDLS. This includes all recent Nexus devices (Nexus 5, 6, 6P) and most Samsung flagships.

"What’s more, TDLS is specified as part of the 802.11z standard ..."

So basically, if the Broadcom WiFi SoC is 802.11z compliant, his TDLS-based attacks will work on it.

He hasn't given a list of all affected devices, but clearly "the vast majority of devices" isn't good news.

Go read the article - it's absolutely excellent :)

Do the numbers, Einstein: AI is more than maths as some know it

Nice intro - thanks

Nice intro to graph theory and graph databases, thanks. Might go and do some more reading - would love to understand *how* nodes and edges are expressed/stored within graph databases, how the graph database engines work, and how that can then facilitate insight into large complex datasets

@AC - thanks for the Numberphile video link

Customer: BT admitted it had 'mis-sold' me fibre broadband

Re: Cable?

@Phil W - which takes us back to the whole question of the package being mis-sold. OFCOM said to El Reg that the ISP are not at fault for selling a package when on the day of activation there isn't capacity on the cabinet/exchange. That's very different to a situation where the cabinet/exchange is not capable of delivering the service at all (i.e. where FTTC doesn't exist). If FTTC doesn't exist then surely the ISP is at fault for accepting an order for a service it absolutely cannot deliver.

Yahoo! halts! email! forwarding! to! outside! email! addresses!

Re: At least it stops the hackers setting invisible forwarders

Ahhh... that brings me to my my slightly angry and possibly OTT wishlist (similar thing with a family member's hacked Yahoo account).

I would love to see... mandatory 2FA at login, a single use PIN code required from your mobile before a forward address is set up, a one-off re-validation of all existing email forwarding, a BIG CLEAR MESSAGE every time you login if any email forwards are set up on your account, and an easily accessible "delete all email forwarding" button.

Obviously, might get in the way of pushing Yahoo! news at users, but surely that's got to be more important than click-through advertising income. What? It isn't?... ;)

Cracking Android's full-disk encryption is easy on millions of phones – with a little patience

Re: inevitably weak pin/password

Exactly. Just need to know what kind of screen lock is enabled (pattern, PIN, password, fingerprint) and in most cases the set of combinations to brute-force reduces very significantly. So, effectively, pattern, PIN, are now totally compromised on most devices (well... they weren't exactly strong in the first place). Most passwords will be similarly compromised.

Don't know how fingerprints are processed to convert across to a numerical form for the crypto, but I do wonder whether fingerprint or an appropriately long/complex password are the only realistic options now.

Also wonder how this affects Blackhone etc.

French privacy cops snarl at websites over crap EU cookie warnings

Really pleased to see this

I'm really pleased to see that they are doing this - the EU law is clearly written to require informed consent before dropping cookies on browsers, but clearly websites drop cookies on browsers anyway and the pop-up is just to tell you that they have done that, not to obtain positive consent first (as opposed to e.g. some kind of passive of implied consent).

As per other earlier comments, the current click-through warnings are utterly pointless and just seem to be done to provide a veneer of "You must have consented because we told you that we had done it."

If this causes websites to actually do what the law requires them to do and obtain positive consent before dropping cookies on browsers then that's great. If websites want to block access to people who don't consent then that's up to them, but the point is that they have to obtain positive consent first.

'Millions' of routers open to absurdly outdated NetUSB hijack

Re: Nope

Yup. The security advisory says that "NetUSB suffers from a remotely exploitable kernel stack buffer overflow."

My home router model is listed, but I'm running DD-WRT on it, so hopefully that avoids any issue with this...

So where's all these digital services GDS promised us?

Re: The Companies House site is now a worse experience

The CH website used to better in 2004 - back then, they had static URLs for individual companies i.e. you could bookmark the information page for individual companies. Unfortunately, a year or two later they started including session IDs in URLs, and that borked bookmarks.

I use UK Gov online services fairly frequently as part of my work, and the primary difference I have seen is a re-skinning of the service home page. The web pages for the actual services themselves haven't changed.

As ever, delighted to see my taxes being spent well...