Posts by KitD

IBM highlights real-time fraud detection in z16 mainframe

Re: Fraud Detection

I had a call from my bank

"Are you in India?"

"Err, no. Deepest Surrey"

"Have you just used your debit card?"

"Nope. Been at home for hours" (it was about 10.30pm)

That was also fraud prevention.

UK snubs Apple-Google coronavirus app API, insists on British control of data, promises to protect privacy

Re: Correction

Firstly, no one mentioned timestamps. You don't need them. Only the last 14 days worth of encountered tokens.

Secondly, location & cell data is already happily donated free-of-charge to Google/Apple anyway. If the spooks were that minded, there are much easier ways of gathering it.

Correction

> As an alternative to all of this, the NHS proposes using a centralized approach, in which everyone's whereabouts and any other information is simply uploaded to a government-owned database and analyzed there.

The NHS system doesn't upload your "whereabouts". They were going to use GPS but that was discounted pretty quickly. It uses a very similar system to the Apple/Google (actually D3PT) system, and, in its basic operation, it uploads only the random tokens to the central servers when you get ill. The difference is that searches by other handsets for matching tokens happens on the central servers, not on the handsets. The advanced operation, which is opt-in, also uploads other medical & PII data & (AIUI) location, when you get ill, which is where the privacy worries are.

But the basic operation is really no less safe than normal smartphone operation.

IBM torches Big Tech's get-out-of-jail-free card, says websites should be held responsible for netizen-posted content

Re: Far too many facets

> They should remove it, but they didn't know it was coming.

What's wrong with content moderation? Post your videos/comments but it will only go live when we've checked it out.

Yes, it takes time & resources and cuts into FB's/Google's profits, but the world doesn't owe them an exorbitant revenue stream. They'll have to bloody well earn it by showing they're responsible hosters (which long-term may well be a good business model anyway.)

Why millions of Brits' mobile phones were knackered on Thursday: An expired Ericsson software certificate

Re: Note to self ..

Even better, set up a certbot renew cron job

The only way is up, baby: IBM UK sales down, profit down, headcount down

Re: Do a contract for TSB...

Erm, IBM didn't write the TSB systems. They were acquired by a Spanish bank that did it themselves.

IBM were called in to investigate the mess.

https://www.bbc.co.uk/news/business-44562229

The Java release train is moving faster, but will developers be derailed?

Re: No JWS - Oh Joy...

Have you looked at GetDown https://github.com/threerings/getdown ?

Mixed experiences a couple of years back, but I have heard it is greatly improved since.

USPTO: Hi, Ask Me Anything. Reddit: Can we trademark 'AMA'? USPTO: No.

Re: The problem is people.

Similar position, me.

Problem I have is that my chosen sport sub is overrun with US high schoolers with their 'coach was mean to me and dropped me' posts. *Sigh* Fortunately I have other sources.

I do think that the general level of discussion is very good in the more scientific subs, esp r/askscience which is a great read.

Overall Reddit is about the best you can get while allowing anyone to post anything anonymously.

Learn your way round the Internet of Things in a day? Course you can...

Re: Wow...

2700 secs allocated for it.

http://www.buildingiot.london/sessions/privacy-challenges-with-iot-implementations/

Oracle says it is 'committed' to Java EE 8 – amid claims it quietly axed future development

Re: Die Java Die

You've been reading too much Reddit. Those criticising Java in 2016 tend to be the ones who left it behind at Java 6 and early JEE, or hate static typing in general.

Modern Java doesn't compare. The new closure syntax and streaming API is enough to satisfy 90% of use cases where FP is needed. There are a ton of Sinatra-like libraries for writing small lightweight microservices, and the ecosystem, which was already vast, has only got bigger since v6.

I've had to move to Node/JS. I'd move back to Java in a flash if I could.

Inside Electric Mountain: Britain's biggest rechargeable battery

Re: Great article

A capacitor driven by flowing water = a flux capacitor, right?

And 1.2 jiggawatts in 12 seconds? I assume that can only be achieved by at flow rate of EXACTLY 88 mph,no?

Food for Deep Thought: 42 is IBM's answer to Life, the Universe and Everything...

Re: Screen grabs

Whisper it quietly, but I quite enjoyed the film :)

Managing infrastructure, a newbie's guide: Simple stuff you need to know

@moiety

> I don't trust Microsoft.

To be fair, that is an emotional response like the one you highlighted in point 1.

Pebble axes quarter of its workers after fitness pivot

Re: A shame for those staff affected

This works with apps like RunKeeper, Strava etc

http://www.amazon.co.uk/CooSpo-Bluetooth-Wireless-Monitor-Fitness/dp/B00UADFP16?ie=UTF8&psc=1&redirect=true&ref_=oh_aui_detailpage_o01_s00

and only £20.

IBM open sources its blockchain code – the non-crazy part of Bitcoin

@DougS Re: Solution looking for a problem

> Whether each layer adds their approval into a blockchain, sends an email, signs a piece of paper or sends up smoke signals won't change that.

It will if the blockchain is of the "smart" variety proposed by IBM et al. Approvals like that become part of the transaction handling, with all communication between the parties and the blockchain, rather than each other.

Big, fat fail? Here's how to avoid that: Microservices and you

Re: Every component of the application (should) be retested

"A shell script is bunch of interacting "micro services". This is just the latest attempt to spray fairy dust on the mundane and get the PHBs swooning."

Well, except that your shell script was (probably) only written by one person.

The principal benefit of microservices IME is that it fits naturally with Conway's Law [1] by design, which is generally A Good Thing. Not saying it is all sweetness and light, and yes, conceptually it is very similar to the long list of modularisation techniques that have gone before, but there are certain key technologies in the limelight now (eg Docker, REST, CD) that make it worth pursuing IMHO.

[1] - https://en.wikipedia.org/wiki/Conway%27s_law

For fsck's SAKKE: GCHQ-built phone voice encryption has massive backdoor – researcher

Signal

> There is increasing demand for voicecall encryption. Unlike instant messaging, which effectively allowed companies to start from scratch and so has resulted in a number of highly secure products, phonecalls run over older infrastructure and almost always pass through telecom companies, usually in an unencrypted form (although the information may be encrypted while in transit).

As I'm sure you're all aware, Signal from OpenWhisper Systems [1] is the best answer ATM, folks.

Uses ZRTP which the table shows as ticking all the boxes. Integrates with existing phone/text functionality on your phone, but switches to secure version automatically if the other user is also using Signal.

IME, it just works.

[1] - https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms&hl=en_GB

- https://itunes.apple.com/gb/app/signal-private-messenger/id874139669?mt=8

The Register guide to software-defined infrastructure

Amazon

There's this:

> Also ... if everything can be controlled through an API on your infrastructure, then the first person to happen along who can pwn some app with administrative rights to your infrastructure can tear it all apart.

Then there's this:

> For all the derision of the old guard, Amazon has changed IT forever.

I was under the impression that Amazon originally required all internal infrastructure to be managable via APIs, and then realised the commercial potential of those APIs, turning itself into a $bn business as a result.

Is the argument against APIs? Because having them (or at least properly managed ones) seems to me to be an absolute fundamental requirement for survival if you're going to take your infrastructure management seriously.

Apple had more CVEs than any single MS product in 2015, but it doesn't really matter

Re: What about the CVSS score

Here we go. Top 20 based on weighted average CVSS score:

9.6 Air Sdk

9.6 Air Sdk & Compiler

9.5 AIR

9.4 Flash Player

9.4 Office

9.3 Internet Explorer

9.3 Acrobat

9.2 Acrobat Reader

8.3 Firefox Esr

8.1 Thunderbird

8.1 Windows Server 2003

8 Seamonkey

8 Windows Server 2008

8 Windows Vista

7.9 Windows Xp

7.9 Windows 7

7.9 Windows 2003 Server

7.9 Itunes

Edit: Full list at https://kitd.github.io/CVEAnalysis.html

Re: What about the CVSS score

Found this page which shows how the products stack up by CVSS score:

https://www.cvedetails.com/top-50-product-cvssscore-distribution.php

Analysis

It would be interesting to see some analysis by severity. That may give a better picture of true vulnerability.

Some brief samples showing level 10s / total:

MacOS - 46 / 384

IE - 0 / 231

JDK/JRE - 20 / 80

Flash - 229 / 314

Edit: formatting

NOxious VW emissions scandal: Car maker warned of cheatware YEARS AGO – reports

Common knowledge

I was speaking to an ex-Lotus engineer recently.

With a regular churn of engineers among the main car manufacturers, it is apparently common knowledge on the inside that all makes adjust their emissions according to whether they are being tested. It is part of what their engine management systems do anyway (adjust to the conditions). A bit like MPs expenses, there is some bewildement that this has created such a storm when it was just considered "one of those things that everyone else does, so we should too".

I think the main issue for me is how far out of kilter the VW test and real-world emissions were, not that it was being done at all. You can bet your life they all do it to some extent.

Want to download free AV software? Don't have a Muslim name

Litigious society

This is what happens when your society becomes more and more litigious. Concepts of law and national borders have absolutely no impact on connected bits and bytes. And yet it is the legislators & lawyers that hold sway. They legislate and litigate away and then wash their hands of the consequences. Everyone has to comply, but in an internet-connected world, the gaping holes are so obvious as to make the whole charade ridiculous.

Sophos only care that they comply with some regulation (see comments about CNET and download.com). So long as they avoid litigation, all is well.

Large Hadron Collider gives young ALICE a black-hole ray gun

Re: Not actually new, you know

@YAAC Surely they should all be banana-sized?

Celebrating 20 years of juicy Java. Just don’t mention Android

Re: Facts

> The cross-platform stuff was then, and still largely is, marketing. Sun was a single platform hardware company.

I disagree. When I moved from "cross-platform" C++ to Java in the late 1990s, all of a sudden the sun shone every day and the birds began to sing again.

You also forgot that the ecosystem was developed precisely to run on a variety on consumer devices.

Bridge, ship 'n' tunnel – the Brunels' hidden Thames trip

Re: Don't Forget....

> 1) the GWR bridge over the thames at Maidenhead. Many respected engineers thought that it would fall down

AIUI, it still holds the world record for the lowest height/width ratio for a brick bridge. It also has a fantastic sounding echo underneath.

VAMPIRE SQUID romps stun scientists: Unique sex lives revealed

So ...

where are the Octonauts when you need them?

BAN email footers – they WASTE my INK, wails Ctrl+P MP

Re: Prints .... emails?

Put an image of the EURion constellation in the signature. That should "solve" any printing issues.

Reg Latin scholars scrap over LOHAN's stirring motto

Re: Outstanding

With apologies to the RAF, "Per taberna ad astra" works better IMHO.

Say goodbye to landfill Android: Top 10 cheap 'n' cheerful smartphones

Re: oh dear

Also happy ex-OSF customer here. Only gave it up for a Moto G when I wanted a newer Android and my daughter wanted a cheap smartphone. Didn't take much persuading mind.

Boffins 3D-print biomimetic shark skin

I'm also a rower. Unfortunately, any external substance that alters the hull/water boundary layer (eg denticles) is banned.

Hey ho. Just have to pull harder.

WAIT! What's that sound? It's Intel stomping into the 'Internet of Things'

Re: Stop.

I realise going against the Reg hivemind is risky, but there's a whole world outside the home & kitchen.

Where I used to live, we had new streetlights installed that could be dimmed remotely and report back to base if it failed. That's what's really meant by the Internet of Things, not fridges and toasters which have constant human proximity.

Oil pipelines that actually tell their operators when they start leaking, river sluices that notify of changes in water levels, traffic lights that tell the road authorities when they have stopped working, animal feed troughs that need refilling. It's all the remote stuff that nobody can police 24/7. Management by exception, etc, etc needs the "Things" to be "Internetted".

HTH.

OAR-some! 18ft SEA SERPENT discovered off US coast

Re: Kwazi, Peso, Barnacles, Inkling, Dashi, Shellington, Tweak, Tunip!

You'll be glad to hear today's encounter with the Snot Sea Cucumber had my lot in stitches.

IETF floats plan to PRISM-proof the Internet

Confused

“two layers of public key exchange using the credentials of the parties to negotiate a temporary key which is in turn used to derive the symmetric session key used for communications”

Isn't that DH key exchange?

Bank of Thailand bans Bitcoin

Not surprising since avoiding central financial control is one of Bitcoin's principal raisons d'etre. See the very first sentence in:

http://bitcoin.org/bitcoin.pdf

"A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution"

Apache OpenOffice 4.0 debuts with IBM code side and centre

Re: I'm on it!

"suitable for the most basic of home users"

Ie 95% of typical MS Office users.

"No comment" on Alex Salmond Seaside Shenanigans Ravings?

Severn barrage

"Perhaps he means "world's best site for tidal power where plans for tidal power have not yet been formally scrapped"."

I was under the impression that it was only the full plan for the Severn (ie crossing the whole Bristol Channel) that had been scrapped, and that the smaller options (enclosing smaller areas) were still on the table.

Oh, and good point about why no direct link from the article. Maybe it's because they get a bit worried now when Lewis Page puts out anything about the environment.

BBC suspends CTO after £100m is wasted on doomed IT system

@ShagBag

You've omitted any reference to immigrants and climate change. How can we take you seriously?

IBM puts supercomputer Watson to work in ROBOT CALL CENTRE

Here's one to try:

"Hey Watson! Does computer always say no?"

*silence*

Reddit: So very sorry for naming innocent man as Boston bomber

OTOH

Missing from the article is that while some Redditors were wrongly accusing an innocent man, others were scouring photos from the incident and provided the FBI with far better photo evidence than they had from CCTV.

Firefox 'death sentence' threat to TeliaSonera over gov spy claims

Can of worms

I suspect you're going to find dodgy dealings in the backgrounds of most root CAs. Taking a stand with this one looks a bit dogmatic.

Six things a text editor must do - or it's a one-way trip to the trash

Scintilla

Yes, it's also in NotePad++ which, like Sublime, inherits it from Scintilla which underlies both of them.

Linus Torvalds in NSFW Red Hat rant

Is this really Torvalds' position?

He sounds a bit different here:

http://www.zdnet.com/blog/open-source/linus-torvalds-on-windows-8-uefi-and-fedora/11187

In brief, the Linux world is too disjointed to coordinate their negotiations with vendors. Fedora took a highly ethical approach and decided not to go it alone because of their power in comparison to other distros. So the result is that the MS approach was not only the most cost effective, but also apparently accepted (albeit reluctantly) by Torvalds.

Has he changed his tune?

IBM begs Britain's new top cops: C'mon, set up pre-crime units

Re: They should call the system Sherlock...

They've already had HOLMES (Home Office Large Major Enquiry System)

How to spot a terrible tech boss within SECONDS

LOL

I went to an interview with a manager who didn't show up. I was given the usual test by a couple of the techies and went away. Later I got asked back for a second interview. Again he wasn't there so I gave up and said 'No thanks'.

The firm arranged corporate entertainment freebies. Hmm ...

Nationwide to perform IT equivalent of 'replacing jet engine mid-flight'

iOS maybe?

Uh-oh! Kim Dotcom is back with a brand new Megaupload site

Nice, but ...

"The new Mega encrypts and decrypts your data transparently in your browser, on the fly"

That should stop folks up/downloading full-length films then. The sequel will be out by the time it's finished.

Sex rating Facebook page publishers jailed

Re: Unfortunately,

> Technically you also have the right to shout 'fire' without any evidence of a conflagration being present

This neatly demonstrates the utter pointlessness of 'rights' without 'responsibilities'. To defend and demand the right to shout 'Fire' unnecessarily is to turn ones rights into such a weak and vapid abstraction that it is an insult to those who fight for the right to speak out against REAL oppression.

Really, why demand the right to offend for no other reason than 'because I can'?

Python slithers up Amazon's Beanstalk

Re: Agree with P_0 about PHP

Actually, PHP has its origins in Perl, being originally some Perl scripts to preprocess HTML before serving.

I think PHP is one of those technologies that is being asked to do far more than it was originally designed to do. It was the first server-side language to use HTML templates which IMHO deserves some credit, but the original language was designed to do not much more than that. Now people want to write full-blown enterprise apps in it :rollseyes:

How talent-spotting boffins help Team GB bag Olympic gold

Elite v grassroots

Talent ID for the elite programs and encouraging grassroots sport are really 2 completely unrelated topics. If we are to maintain a healthy position in the medal table, then we must continue the elite talent spotting that is only starting to bring rewards.

Independently, if sport is considered worthwhile, then we need input for all sports at the grassroots. I agree with the poster saying that there should be opportunities for kids to try many sports at school. This requires more funding for local clubs because schools cannot provide the specialist knowledge and equipment needed over many sports. The other change I would like to see is schools not being allowed to make demands on a pupil's time between say 4 - 6pm, freeing them up for other activities.

However the one change that is almost impossible to engineer is the one that values the activities of kids' on the sports field (or any other worthwhile pastime) far above than those of pointless celebs on TV. Then we might actually get people off the sofa and doing something valuable.