Posts by ACZ

Callous crims break into preschool network, publish toddlers' data

Re: Well...

I hate to say this, but I suspect that the day-to-day reality for many/most organisations is that they don't have (or won't allocate) the budget necessary to do that properly, let alone continue to do it properly over many years. Mission creep... :( In fact, they probably won't have the technical knowledge or competence to do it or realise that they need to do it. Just don't store non-essential information electronically, and document the fact that it's official policy to reduce risk in the event of a digital heist.

Re: Well...

Hybrid solution - absolutely. If site-specific sensitive information is stored on paper in an office then that can minimise the risk profile.

Physical security (locked safe, locked offices) might be a bit inconvenient at times, but it's a whole lot less inconvenient than having all of your confidential information (special needs observations/records, child protection notes etc.) held to ransom and made public.

At the end of the day, what did they *really* need on a centralised system, other than basic account and attendance information for billing purposes? Group management reporting doesn't require confidential detailed information on every child.

OpenAI's GPT-5 looks less like AI evolution and more like cost cutting

Re: Consistency

Exactly - any model changes (even a version change of an existing model) can cause significant (and potentially undesirable) changes in output.

We all know that 4o is far from perfect. However, stable, predictable, tested and validated output is essential. Any model update requires careful testing with predefined sets of inputs and detailed analysis of the resulting outputs to ensure that they are acceptable - can take many days of testing, especially if you've got additional functionality (using newer models) hanging off initial output from an older model e.g. 4o. It's often better to just pay for the older models than have to go through an upgrade/update cycle especially since the required end result is zero change/improvement in output.

So long as there is e.g. six months notice of deprecation of a model from the API then that's fine and it can be built into the work schedule.

Hacking US crosswalks to talk like Zuck is as easy as 1234

Conversation when the new crosswalk buttons are delivered

Manager: "We've got some new talking crosswalk buttons that we're going to deploy. The instruction guide says that we should change the default management passcode, so we should probably change it - we don't want them getting hacked."

Team member: "We could set a different passcode on each one."

Manager: "Great idea. But we'd need to record that somewhere. We could try our asset management system, but each asset requires an asset code which we'd have to permanently mark on the asset and we don't have the budget to do that for a crosswalk button.

And anyway the asset management system would need a custom field adding for this and we don't have the time or budget to have that done.

And we would then need a special "Crosswalk button deployment procedure" which would have to be written, reviewed and approved.

And then we would need an on-site post-install check to ensure that the new procedure had been followed for each new crosswalk button.

And we'd need an annual audit to make sure that all procedures were being followed properly and consistently, and we really don't have the time or budget to do any of that.

So let's just change the code to '2345'.

Or we could just leave it at '1234' - nobody's going to want to hack a crosswalk button..."

Trump's tariff turmoil leaves IT projects in deep freeze

Re: A solution for US multinationals.

Forgot to say - the alternative of course is that the US economy will crash, there will be wage deflation (together with the price inflation) and the US will end up worse off relative to the RoTW. Ho hum...

Re: A solution for US multinationals.

Slightly more long-term, there's going to be a big inflation issue for the US. The whole point of a global supply-chain is that you source goods at the lowest price and then provide your own premium goods/services in return.

The stated intention with the tariffs is to favour US-manufactured goods. However, the price (excluding tariffs) of the US-manufactured goods will inevitably be higher than the imported alternatives, so for folks in the US there will be price inflation for those goods. Additionally, new US manufacturing jobs will put a squeeze on the labour market and cause wage-inflation which will affect the whole economy. There's also the basic question of whether there are enough people available to fill the jobs, especially the highly-skilled jobs, even more so with the US not looking like a nice place to emigrate to.

As per previous comments, one solution for manufacturers may be to isolate the US from the rest of the global supply chain and increase prices as appropriate for the US. The US then gets an inflationary spiral and US-originating goods which are currently shipped to other countries will then have to be manufactured outside of the US to bring costs down.

*IF* enough countries do new trade deals with the US that the supply chain can re-open with zero/minimal tariffs then maybe the US might see an overall benefit, but the odds are looking very low and I suspect that China *will* be willing to take a hit and play the long-gane if it has to.

Datacenters near Heathrow seemingly stay up as substation fire closes airport

Re: Questions will doubtless be asked

Yes - it is surprising that Heathrow isn't able to withstand this kind of event, especially given its nature as a piece of major national infrastructure and the fact that any disaster management planning must have covered this scenario. The TFL website is showing underground trains on the Piccadilly Line running to Hatton Cross (a 4 minute walk from the Heathrow T2/T3 tube stop). As other commentards have said, why not have a load of generators ready to fill the gap in the event of a power failure? - the capital/operational cost would be minimal compared to the cost of Heathrow being shut for a few hours, let alone 24 hours.

HP deliberately adds 15 minutes waiting time for telephone support calls

No need for stamps/labels nowadays

No need for labels or stamps nowadays with https://stampfree.ai/

Copilot invades Microsoft 365 Personal and Family for an extra three bucks a month

And this will be appearing when my kids are doing their school homework?

I'm a bit pi**ed off about this. My kids have to use Word to do school homework. I don't know if it's just the desktop version or the web version as well (my kids have to use the web version to prepare homework submissions), but I really don't want Word offering to do their homework for them.

As much as I love LLMs/AI (and my kids' school encourages the use of AI as a learning tool), I do need my kids to be required to use their own brains.

:(

Apple and Meta trade barbs over interoperability requests

Re: Metà are the scummiest

Absolutely. A fundamental thing here is GDPR, and whether compliance with it can be guaranteed using rh information which would be made available if these requests (whatever they are) are allowed.

Given that Apple have zero control over the third parties who are requesting access to APIs/interoperability features, I could easily (and understandably) see Apple arguing that where allowing any request could result in personal information being made available (particularly about people other than the device user) then the GDPR provisions require them to refuse the requests.

QNAP NAS users locked out after firmware update snafu

If only they had said to do that in their instructions which instead say at step 3:

"3. Log in to the NAS web interface."

Doh...

ESET denies it was compromised as Israeli orgs targeted with 'ESET-branded' wipers

If emails are passing SPF and DKIM then *something* has been compromised - DNS control, outgoing mailserver, AD, etc etc

The statement from ESET says that "ESET was not compromised and is working closely with its partner [the Israeli partner company]". So basically the partner company in Israel was compromised. What does the partner company do? - just sales, or R&D etc. as well? And was the Israeli partner isolated from the main ESET network? Possibility of network traversal?

Hold my Pimms! Wimbledon turns to tech for line-ball calls

Good question - given that precision is the key thing here, that's a potentially big issue. I'm wondering if e.g. they have got some kit (for example, a calibration/mapping device that can trundle along the court lines and gather relevant data) to ensure that court markings are precise, or at least so that they can include the exact position of all markings in the mapped "virtual court".

Yes - I agree that it must be a 3D flight path model. There presumably won't be any sudden changes during the journey, which will make that bit relatively easy.

Once the relative position of all of the cameras is known and mapped (e.g. self-calibrate using lasers for exact positions), the positions of the lines can then be mapped (there will be small variations in court dimensions/line positions).

With that done, you then have the court markers in a 3D volume against which you can map ball movement.

Presumably flight path modelling just requires identification of the position of the centre of the ball (multiple cameras covering multiple planes, cross-reference obtained data), and then fit the obtained data against a suitable model.

With mapped ball and surface characteristics, it should then be possible to determine whether a ball will touch a particular line.

Just need to reluably do all that in a fraction of a second with some fault tolerance/error correction, and on robust kit. Simples! ;)

Oh my goodness that one in the video is close. I don't know if it actually *slides* a full 10cm though. It looks like it descends into the (artificial) grass and compresses before sliding (a bit) and then bouncing up out of the grass.Really interesting to see it all in slow-motion. However, that is *not* a Hawkeye camera running at 300fps - see the numbers below. That camera has got a much higher frame rate - I'm guessing well over 1,000fps, maybe up to 10,000fps.

Just doing some example numbers on this one: A service ball travels at 130mph = 209,205m/hr. That's 3,487m/minute = 58.11m/s.

The centre serviceline is 5cm (0.05m) wide (Rule 1, ITF Rules of Tennis - https://www.itftennis.com/media/7221/2024-rules-of-tennis-english.pdf). So at 130mph, the ball will cross the width of the centre serviceline in 0.05/58.11 seconds = 0.00086 seconds (well, slightly more than that - the ball is travelling at an angle to the line).

300 fps (for the Hawkeye cameras) is one frame every 0.0033 seconds (and they don't say how long it takes to capture each frame). That's almost four (0.0033/0.00086 = 3.88) times slower than the period taken for the ball to cross the line.

So what are the Hawkeye line cameras actually capturing? It doesn't seem like it will be an image of the exact moment the ball touches the line - at that kind of frame rate/capture speed, it will be more of a blur.l

ULA nears second launch of Vulcan Centaur in pursuit of US Space Force approval

So "payload mass simulator"?

Feds put $5M bounty on 'CryptoQueen' Ruja Ignatova

Re: "Ignatova remains at large"

The BBC podcast series on her (linked in the article) is great - do have a listen

Microsoft disarms push notification bombers with number matching in Authenticator

Re: Security vs Convenience

Exactly - if I'm logging into a system then just present me with a screen asking for a one time passcode from my authenticator app. It's not difficult and only takes a couple of seconds. The system should fail safe, and push notifications requesting approval are the total opposite.

The problem here is push notifications per se, not user fatigue.

Ireland to develop datacenter powered by fuel cells

Wind would definitely be nicer - actual renewable power. However, I suspect that one of the big wins with the fuel cells will be the relatively short delivery timescale and the stability of the power supply - you can have as many wind turbines as you like, but if there's no wind then you'll be sharing the same very finite grid resources as everybody else.

Lawyer's Microsoft email snafu goes from $1.75M lawsuit to Ctrl+Alt+Settle

Maybe helped with court submissions?

If he was without email for 14+ days, that's a big risk in terms of missed deadlines. By initiating proceedings against MS, I'm wondering if that gave him some useful leverage with courts/tribunals to say that not responding/missing deadlines was the fault of MS (despite him making all reasonable efforts and some more) and please can he have an extension on that deadline.

A toast to being in the right place at the right time

Re: He's toast

Hate to say this, but I suspect that the fire wardens may have been holding the fire doors open for everybody *because* of the high security entrance.

Modular finds its Mojo, a Python superset with C-level speed

Static typing in Python

As much as I appreciate the ease and convenience that can come from dynamic typing, I do *love* static typing (not just type hints, but actual static typing). Bring it on!

Semiconductor world in for a rough ride as chip bubble bursts at the high end

Re: Semiconductor world in for a rough ride as chip bubble bursts?

Try buying a Raspberry Pi at the moment - lead times are about 12 months, and 2nd hand kit on eBay is going at silly prices :(

Where are the (serious) Russian cyberattacks?

Re: The SATCOM network was taken down (mostly in Ukraine and Germany) (...)

Here's a link to the detailed technical write-up:

https://www.reversemode.com/2022/03/satcom-terminals-under-attack-in-europe.html

Note in this thread reference to a Der Spiegel article on this as well with an alternative explanation.

It's primed and full of fuel, the James Webb Space Telescope is ready to be packed up prior to launch

Re: New! Improved! oxidiser!

And includes a few words at the beginning from Isaac Asimov, including these two fabulous paragraphs:

"Now it is clear that anyone working with rocket fuels is outstandingly mad. I don't mean garden-variety crazy or a merely raving lunatic. I mean a record-shattering exponent of far-out insanity.

There are, after all, some chemicals that explode shatteringly, some that flame ravenously, some that corrode hellishly, some that poison sneakily, and some that stink stenchily. As far as I know, though, only liquid rocket fuels have all these delightful properties combined into one delectable whole."

;)

Raspberry Pi Zero 2 W: Nippy stocking filler for the nerd in your life – if you can get one

Re: Nice

I keep on meaning to try PiHole - currently pointing LAN DNS at an ad-blocking DNS server, but getting PiHole on the LAN would be much nicer.

Android OS vendor variants transmit data with no opt-out

Re: Ok, I have a question

Or it might just temporarily enable wifi to phone home...

It's time to delete that hunter2 password from your Microsoft account, says IT giant

No GPS required

You don't have to use the MS authenticator app - Authy, Google Authenticator etc all work as well - IETF RFC 6238, I believe. The only permission that Authy has got on my phone is Camera, so no GPS.

Home Office slams PNC tech team: 'Inadequate testing' of new code contributed to loss of 413,000 records

Re: Realities

Next, you'll be telling us that you include comments in your code so that it's easy to understand and review ;)

Lessons have not been learned: Microsoft's Modern Comments leave users reaching for the rollback button

Re: The best product doesn't always win

Ahhh..... WordPerfect 6.1 - it was absolutely magical. Reveal codes to show what was going on under the hood, a couple of minutes spent deleting unwanted bits and pieces, and job done - perfect. Small docs as well, which was helpful back when a 1GB drive was expensive.

Oh... and the document indexer was great as well - we had a structured file system for all our documents/correspondence, and the indexer ran every night. Ended up with a searchable index of >100,000 docs and it only took a second or two to find what you wanted. Not bad for the 90's :)

Google to bury indicator for Extended Validation certs in Chrome because users barely took notice

Re: Security is hard

This hits the nail on the head. Unfortunately, the vast majority of people are lazy about security. And even if you're not being lazy, how many people actually double-check the URL of a link before clicking on it? How many people check the SSL certificate on their email provider when it changes? How many people check the issuing CA on a certificate before deciding to trust it?

I suspect that even if you tried to block people from entering card details (i.e. recognisable patterns of information corresponding to a card), the workarounds employed by bad actors wouldn't deter people. In fact, the workarounds would probably be dressed up as being *extra* security to encourage people to trust the site...

This is an issue of human behaviour, a subconscious desire to conform, and a generally irrational desire to complete something once we've decided to do it. Especially when it's a really good deal and somebody else might beat us to it - quick - buy buy buy.

The simple fact is that people want to enter their card details and complete their purchase :(

Re: This is hilarious.

> Greedy, lazy and careless humans are the weak link... Unfortunately they're in charge of many areas of technology.

FTFY :)

Talk about unintended consequences: GDPR is an identity thief's dream ticket to Europeans' data

Re: A solution?

I hate to stir the hornets nest that is UK Gov IT projects, but wouldn't the Verify service https://www.theregister.co.uk/2019/07/18/verify_to_be_flagged_undeliverable_by_gov_projects_watchdog/ do the trick here?... ;)

WTF is Boeing on? Not just customer databases lying around on the web. 787 jetliner code, too, security bugs and all

Re: How many networks?

Exactly. This sounds like security through obscurity. It's really simple - either (a) there are *physically* separate networks for the avionics and other systems, or (b) they share the same network.

If it's (a) then great - just tell us. If it's (b) then it's open to attack and it is impossible to guarantee that there will be no access to the avionics network portion from the entertainment/crew info network portions. Somewhere there will be a bug/issue with a protocol, API etc. etc. that can be exploited. Difficult to exploit is not the same as impossible to exploit.

And, yes, passenger info systems need access to flight info, but that doesn't have to come from the avionics network portion - just include additional sensors.

Eggheads confirm: Rampant Android bloatware a privacy and security hellscape

Surely there's a big GDPR angle here?

These folks need to team up with a consumer rights advocacy group who can initiate some GDPR proceedings - sounds like it should be an easy win, and could be a very significant shot across the bows of device retailers and software companies.

Humanity gazes into the abyss to get its first glimpse of a black hole

Re: "Rather like a black hole for dollar bills."

Given the science that they did and the cost of the hardware (everything from hydrogen maser atomic clocks to thousands of helium-filled HDs - too much heat/friction from air-filled HDs), it's an absolute bargain.

Fantastic Horizon program on BBC 4 about this last night: How to See A Black Hole: The Universe's Greatest Mystery

There's also a series of six papers published in a special issue of The Astrophysical Journal Letters.

Stunning work.

Beers (just not up at telescope altitude ;) to all those involved

Stop us if you've heard this one: IBM sued after axing older staff, this time over 'denying' them their legal rights

Re: Why are these even legal ?

Like people have said above, it's a compromise agreement/settlement agreement, i.e. we are sacking you but want some additional undertakings (e.g. that you won't sue us for age discrimination, or won't engage in a class action). You don't have to give them to us, but if you do then in exchange (as a compromise) we'll give you some extra benefits (e.g. cash / pension etc. etc.). There's no requirement to sign it, but people often do because they want the additional benefits.

However, the issue here is that IBM have allegedly failed to comply with the statutory requirements which make such an agreement legal i.e. have withheld the age data.

Chinese biz baron wants to shove his artificial moon where the sun doesn't shine – literally

Re: Drag

The gyroscopes can maintain the angular orientation of the satellite. However, this (giant) mirror will still act as a solar sail - radiation pressure from reflection - https://en.wikipedia.org/wiki/Radiation_pressure

So what happens to that radiation pressure? In order for the satellite to remain in its orbit, something has to counteract it. The maximum radiation pressure would presumably be 9.08N (see link above) per square kilometer of mirror, although in reality it would presumably be somewhat less depending on the angle of the mirror to the sun. Not an insignificant amount of force to counter, particularly given its continuous nature, and it will have to be countered.

HMRC contractor scores IR35 payout after yet another taxman blunder

Re: "HMRC settled the tribunal case immediately before it was due to start"

Here's the decision... https://www.gov.uk/employment-tribunal-decisions/ms-s-winchester-v-commissioners-for-hm-revenue-and-customs-and-others-2207946-2017 - brief, but an indication of the time and money that will have been spent on this.

I suspect that it's the (unfortunately) regular occurrence where it's only when somebody who actually understands the law (so in this case, clearly not HMRC themselves) gets hold of the case that the right thing finally gets done. Let's hope that the whole court proceedings process hasn't been too much of a toll on Susan Winchester or her business. Could this be the death knell for CEST?...

Canny Brits are nuking the phone bundle

Telefonica own O2 and GiffGaff, so this is nothing new for them

GiffGaff and O2 are both owned by Telefonica, and GiffGaff runs on O2, so they've had their toes in the water for ages here. The market changes (and what O2 is currently offering to customers) reflects that. It will be interesting to see how both O2 and GiffGaff develop their offer.

Don't know if other major telco-owned MVNs like GiffGaff are running in the UK, but I wouldn't be surprised to see others popping up to try and capture that growing part of the market whilst the mainstream brands are used to service the customers who are willing to pay premium prices and/or want premium services.

Connected car data handover headache: There's no quick fix... and it's NOT just Land Rovers

Re: This needs some input from the DVLR

Yes... there are some convenient online systems from uk.gov (fx: dons protective headgear... ;)

When a car is purchased with all this internet connected stuff, is the data controller identified to the buyer? Is there a way for the new registered keeper to notify the data controller to revoke all third party access (including previous owner/registered keeper access)? Is there a way for the registered keeper to verify who has access to data associated with their vehicle?

Surely we just need a system where (a) the DVLA issues the registered keeper with a time-limited single use code specific to the vehicle, (b) they can then go onto the data controller's website and use it to associate the vehicle with them, and then (c) they can access the full list of connected devices/accounts and modify as appropriate.

Place a statutory obligation on anybody who sells a vehicle to notify the buyer of all data controllers and you're sorted.

Simples :)

'Facebook takes data from my phone – but I don't have an account!'

Re: host file?

I'd definitely suggest giving dns66 (https://github.com/julian-klode/dns66) a tryt - it'll set itself up as a VPN on your phone so all traffic is routed through it, and then just black-hole ad sites. Don't know whether the domains the FB app is talking to are blocked by it, but it's worth a try. If the problem app is installed as a system app then you might have to go into the dns66 "APPS" settings and toggle it to show system apps since dns66 is set up so that traffic from system apps is (by defaut) not re-routed.

If using dns66 then you can also get it to use a chosen DNS server, e.g. an ad-blocking DNS server.

Microsoft: Yes, we agree that Irish email dispute is moot... now what's this new warrant about?

I seem to recall that part of the reason why MS were able to resist the original warrant (and why e.g. Google weren't in other cases) was that they had compartmentalized things and that MS (USA) wasn't actually in control of the data.

Irrespective, the Data Controller at MS (Republic of Ireland) is responsible for safeguarding the data located in the RoI under local (EU) laws, and so they should be able to block any request for the data from the US Gov via MS (USA).

It'll be interesting to see how this one pans out...

NHS Digital heads accused of being 'suppliers', not 'custodians' of UK patient data

Re: Patient data is a national asset

They're already doing that with allowing the likes of Google to access patient data on NHS Spine and do analytics/ data mining on it. At a fundamental level, that kind of thing (subject to *proper* data protection) has a real potential to deliver clinical benefits for patients. However, for that to happen the data custodian must guard the data and ensure it is properly protected. Without that, nobody will trust the NHS and, hey presto, a large group of patients (inevitably including some who are highly vulnerable) won't engage with medics / the NHS.

Didn't install a safety-critical driverless car patch? Bye, insurance!

Re: So...

Erm...the bill says that insurers don't have to cover you if there is "a failure to install safety-critical software updates that the insured person knows, or ought reasonably to know, are safety-critical".

So if there's no "safety-critical software update" then you're still covered by your insurance policy. If the manufacturer EOLs the vehicle and stops supplying patches then the insurer can't dump the liability on you. Then again, it might not be possible (or might be very expensive) to insure vehicles (which drive themselves) when the manufacturer decides that they have gone EOL. Then again, you won't actually own a car anymore will you? Odds are you'll be in an Uber (or suchlike) vehicle.

:)

Re: Safety-critical updates?

Remember - this bill primarily deals with (a) liability of insurers, and (b) EV charging. Current draft is: https://publications.parliament.uk/pa/bills/cbill/2017-2019/0112/cbill_2017-20190112_en_2.htm#pt1-l1g4

Doesn't mean that it will illegal not to install a CarOS patch or root/install a custom firmware, but it might mean you're not insured.

Big thing is that this is enabling legislation, and is therefore intentionally broad, so that it works now and decades into the future - fundamental principles are in there to provide stability/certainty, and then it's up to insurers and courts to deal with the real-life scenarios.

So this will all come down to the insurers, who will in turn force the hand of manufacturers as per AC's comment above. Insurers will also have to come up with some good standard T&Cs, e.g. requiring patch installation within a "reasonable period" which they define e.g. no more than 7 days of public release by the vehicle manufacturer. Manufacturers will presumably have to push delivery of OTA patching on release, and force install within a given time period, e.g. at the end of the period preventing new journeys until the patch is installed. Manufacturers might also have to e.g. provide very clear and prominent notifications about CarOS patch status before commencement of a journey.

Rooted CarOS - probably wave goodbye to being insured, at least with any conventional insurer. Rooted entertainment system - might still be insured *if* it doesn't have any impact on vehicle safety, but read the fine-print on the insurance contract. Might encourage a truly hard (physical) divide between car-critical systems and entertainment, but that's going to require the manufacturers to go for safety over shiny things, convenience and cost, so odds of that happening?...

123-Reg customers outraged at automatic .UK domain registration

Or did the .co.uk domain owner register the .uk and then transfer it?

The real battle of Android's future – who controls the updates

Physician, heal thyself

So does this mean that Google will support devices for longer? Will this mean that they end-of-life devices after *more* than 3 years?

https://www.theregister.co.uk/2017/05/01/google_eol_for_nexus_phones/

I know it's been said (many) times before, but this is something that Apple have got right. If this means that Android devices are supported longer then that would be great.

Samsung Galaxy S8+: Seriously. What were they thinking?

How much?!? Just get a OnePlus 3T

Seriously, that's a truly stupid amount of money for a phone. A dual-SIM OnePlus 3T is £399 all-in for the 64GB model, £439 for the 128GB model, and their current production OS build is at Android 7.1.1 and is basically stock Android with no manufacturer cr*p to remove (*no* Bixby or anything like it), can be easily rooted if you want to go that way, and doesn't have a fingerprint sensor in a stupid place.

I know the S8 comes with a curvy screen but is it worth £400?...

</utterdisbelief?

Apple fans, Android world scramble to patch Broadcom's nasty drive-by Wi-Fi security hole

Re: That's not how that works

http://standards.ieee.org/news/2011/80211z.html -

"1. IEEE 802.11z reduces the number of times a packet gets transmitted over the air from 2 to 1."

"3. If client devices are perhaps newer and capable of operating at data rates or in frequency bands not supported by the access point they can do so."

:)