Posts by cyberdemon

FTC sticks a probe into 'surveillance pricing' Big Biz uses to gouge us all

Re: FASCISM!

-1: Troll, Offtopic

Do you have any comment on the article, Mr Mangrove? Or are you just being a shit-monopole? (attracting shit from all sides)

EU gave CrowdStrike the keys to the Windows kernel, claims Microsoft

Re: Dave Plummer has a different take on this

Well, evidently it IS trapped by the CPU, but the OS doesn't know what to do with the interrupt except halt and display a sadface on a blue background

Re: WHQL

I wonder if Data Execution Prevention would have helped here? Even if only by forcing CloudStrife to write a better piece of software

Dave Plummer seems to suspect that the update contained executable code, which was pulled into the "signed" driver and executed. DEP should have prevented that?

On the other hand, the file could still have been plain old data that caused the driver to generate a null-pointer.

Apparently the file in question was all zeroes, so they obviously have no input validation whatsoever.

Re: Dave Plummer has a different take on this

Thanks for letting me avoid YouTube, but that summariser needs to learn where to add a paragraph break.

Facebook prank sent techie straight to Excel hell

Re: Correction..?

> Just what is a snark?

It's a pint-sized insectoid creature from the game Half-Life. It can jump to head-height and is very aggressive, but short-lived and explodes a few seconds after it is set free

Curiosity rover is crushing it: Ran over a rock and found pure sulfur

Re: Well...

That would explain what happened to his face when he stepped outside..

Serco appoints former GDS leader Tom Read to digital leadership role

Re: Revolving Door

No relation to Post Office boss Nick Read?

FTC grabs controller as Microsoft jacks up Game Pass price by 81%

Re: I’m shocked.

Steve Ballmer, then?

EU's renewable hydrogen plan needs a 'reality check'

Indeed. And since Hydrogen can't in reality be dyed a colour (unlike red diesel which is literally red), I have no doubt that lesser "colours" of Hydrogen (Black/Brown/Grey/Blue/Turquoise ...) will be passed off as "green" in a similar way as ROCs are used to greenwash electricity. See also: "Sustainable Palm Oil" etc.

Agile Manifesto co-author blasts failure rates report, talks up 'reimagining' project

Re: The more process you have the less agile you are.

> Dead horses left to rot in the streets

They should have been more 'Agile' and flogged the dead horses until they got up and started walking again

Angry admins share the CrowdStrike outage experience

Re: Astounding lack of finger pointing at Microsoft - the real news story

Does repeatedly whacking F8 like a maniac during boot no longer work?

Been a long time since I last used/broke Windows

Re: It wasn't a threat definition file.

No?

What exactly was it, then? Do enlighten us, Mr Dogshit :)

Re: And yet

It's Friday, and it's the latter-half of July, nearly August.

Investors are far too busy snorting cocaine and cavorting with hookers on their private yachts to notice that they might be slightly out of pocket next week.

> The LAST person who should be blamed is

The first person who WILL be blamed. Cynicism is bred from bitter experience

Clearly CrowdStrike believed that any update to a mere data file would be safe, and didn't bother to enforce any testing on them, perhaps believing that it was better to update them quickly to address new threats rather than delay their release due to testing. Personally I think this is a secondary problem compared to the apparent fact that they had never tested a corrupted data file against their system-critical kernel module..

For the kernel module to ingest a bad file and cause a BSOD, it would have to: a) not bother to fully validate the file before ingesting it, AND EITHER b) contain a memory-corruption or similar bug that causes a BSOD when processing a bad file OR c) very poor error-handling such that when a bad file is encountered it BSODs instead of simply logging the issue and rejecting the file

It's Friday.

Pub until it's fixed.. Oh look at the time, 5pm already

Re: Sports Sponsorship

https://www.bbc.co.uk/news/articles/cn4vgq5150qo

That has to be nominated for IT photo of the year....

(look carefully at the screens in the background)

Re: Who, me?

Who will take the blame? The overworked junior tech who pushed a 2am update to a threat definition file without testing it, or the senior developer who failed to implement proper memory-safety and input-validation in a kernel-mode rootkit security module?

CrowdStrike Windows patchpocalypse could take weeks to fix, IT admins fear

Re: Written word

I appreciate the coverage. Both written and spoken.

I've often railed against the morphing of journalism into podcast chatter and u-bend narcissism, but this time we had about 5 written articles and one audio summary (i didn't watch the heads move) which is a good balance IMO, and it was a good summary.

CloudStrife (for that is what I will call them from now on) have perfectly demonstrated how there is "no silver bullet" for infosec, and they have provided me with a plentiful supply of schadenfreude for a Friday afternoon.

Life, interrupted: How CrowdStrike's patch failure is messing up the world

Re: What's worse than...

We might get that extra Bank Holiday after all

Re: WTF?

Oh yes. If you thought "Windows Server" was an oxymoron, check out "Windows Embedded".

Used by many industrial control systems and even PLCs ("Programmable Logic Controllers", which used to use very basic operating systems, but the likes of Beckhoff have gone for Windows Embedded) across the globe

CrowdStrike shares sink as global IT outage savages systems worldwide

> CloudStrike's client list is going to shrink worse than a banana in the desert sun.

And the Client List on the class-action suit will be growing like ... an infestation of Tribbles in the cargo hold

.. Tribbles all-round for the lawyers

Re: Quiet in the comments - is everyone busy firefighting?

> My condolences to those looking at RSI from entering zillions of bitlocker keys.

Wait, the workaround trips BitLocker? Argh

So for some, CloudStrike has turned Microsoft into an inept but large ransomware gang?

Where's my BitLocker key? It's somewhere in AzureAD.. Which one is for this server? Err ..

Microsoft 365 remains 'degraded' as Azure outage resolved

Re: Just goes to show...

Exactly.. What happens when all a world's critical systems are networked and inter-dependent?

The opening episode of Battlestar Galactica springs to mind ...

CrowdStrike file update bricks Windows machines around the world

Re: drivers are not for security

See also: "Rootkit"

Most so-called "anti-virus" software fits the definition of a rootkit. It installs a kernel module "driver" to override system calls, placing a man-in-the-middle to calls like fopen() and read()

It's a terrible security paradigm, because it means that software can be insecure, we will just rely on this rootkit-thingy to protect us when something nasty happens.

It's a bit like leaving all your doors open but instead paying someone from the local mafia to house-sit

Re: Related?

I think the main things we can blame on Microsoft are:

1. The prevailing practice of allowing third-parties to run non memory-safe code in kernel space, and the normalisation of installing a "rootkit" as an anti-virus tool

2. Training users/admins that they must allow all software to automatically apply updates as soon as they are pushed. Anyone who had delayed CrowdStrike's updates for 24 hours would be breathing a huge sigh of relief right now.

Re: Related?

> Is there no way of instructing client machines to boot from an emergency OS over the network?

Maybe on systems with IPMI, you might be able to remotely instruct the BIOS to boot Windows into Safe Mode to apply the workaround, but then you might not get network access to the machine as it won't be running it's VNC service or whatever, so you might still have to go round the racks with a Keyboard and Mouse. I'm not sure if the IPMI itself can provide a remote display

Frankly, I despair that people still use Windows in datacentres. It's never really been designed for remote operation.

> testing is for pussies.

No, I think you'll find on page 94 of the Big Tech Business Manual: Testing is for customers

Sam Altman sues builder over $27M flooded, sewage-hit 'lemon' of a mega-mansion

Re: The builders were the perfect capitalists.

> made a ton of money at everyone else's expense

No no no, that's Sam's job

And the builders could just say they asked ChatGPT for detailed instructions on how to build a mansion

Re: Joyous

The title of a lament composed for the micro-violin?

Tesla sales, market share dip in EU while other EV makers grow

Re: First mover bonus no longer enough

How does this work for companies who just don't make any EVs? There must be some of them, especially smaller firms and racing cars. If I set up a small company and sold one custom combustion-engined car, would I have to bodge together a couple of electric go-karts to avoid a fine?

Could a larger firm simply buy up a manufacturer of kids' plastic ride-on toy cars and count them against their EV quota?

Release the hounds! Securing datacenters may soon need sniffer dogs

Obviously

This is the only way to infiltrate the headquarters of the International Nudist Association

Until they get sniffer dogs, that is

Big Music reprises classic hit 'ISPs need to stop their customers torrenting or we'll sue'

Re: NOW! That's what I call Killing Music!

a) you don't patent a song, you copyright it.

b) The process of production itself doesn't need to be patentable. The RIAA aren't patent trolls, they are copyright trolls.

c) when did common sense ever stop the RIAA?

Re: NOW! That's what I call Killing Music!

Don't forget AI !

I suspect the only reason the RIAA aren't whingeing on about AI actually is because the record companies know they can use it to churn out artless drivel without paying anyone, and then they can sue people for copying it! Chicken Dinner

Imagine being sued for torrenting an AI-generated music album ...

Don’t blame AI for rise in carbon emissions, says Google exec

It's not AI

It's all the gobloads of data that we are slurping up to er, train our AI

Porting the Windows 95 Start Menu to NT

NetBEUI

Argh, that'll be PTSD-triggering for some

Rite Aid admits 2.2 million people’s data stolen by criminals

I suspect because they are legally required to delete it after 7 years, and so they would be ill-advised to admit that any data older than that had been stolen ..

Three words to send a chill down your spine: Snowflake. Intrusion. Alert

Re: For those who like to [read] rather than view

Or maybe, someone might be able to write something for us to read, based on the main points of a discussion that they had with someone. I think it used to be called 'journalism' ..

Now there's just "Watch me talk to someone. Don't forget to like and subscribe to my YouTwat channel!"; "Here's some more videos of Twats you might like!"; <picture of a gormless face and some arrows that people apparently click on>

can AI save us from the scourge of malware?

More like: Can AI automate the hell out of inventing, deploying and exploiting malware at a scale unthinkable to humanity? Yes.

The basic problem is: "AI works 20% of the time."

For a defender, that's hopelessly useless. For an attacker, that's incredibly useful, because even if the true figure was 2%, they can scattergun thousands/millions of targets with zero effort

Microsoft 365's Chinese host uses just four percent renewable energy: Greenpeace

Re: Renewable energy

Or if you're Drax, then you can chop down trees, burn them to produce even more CO2 and particulates per MWh than the dirtiest of brown lignite coal, and claim to have negative emissions deserving double subsidies!

It was interesting to note yesterday on Drax's website that when an Elexon glitch caused all sources bar Wind, Solar and Imports to show as zero, their calculated CO2 emissions per MWh went negative. There's something very fishy about that. Either the data glitch had borked their calculations (which is probably what they would say) or someone is cooking the books and double-counting CO2 savings somewhere.

South Korea orders 'Star Wars' lasers to blast Northern drones out of the sky

Re: In the Future ...

It's illegal to fly them Beyond Visual Line of Sight - so you should have been able to see the operator (or they should have been lurking behind a hill, where they can see their drone, but IIRC they should also be able to see what is beneath their drone)

But I agree - definitely need some kind of portable magnetron to zap drones, boomboxes, e-scooters, etc. Apparently the police are getting them, but they are quite bulky.

Trump threatens to send Meta's Mark ‘Zuckerbucks’ to prison if reelected president

OK, to make it fair, they both get a grenade each.

You brought a grenade to a cage fight? Yes, it's called "Mutually Assured Destruction"

Would Zuck manage to convince Donald to put down the grenade? Doubtful. Would Zuck try to use his martial arts skillz to get both grenades and then beat up trump, before dropping one and blowing them both to smithereens? Probable.

We're out of popcorn. Anyone for pork scratchings?

OpenSSH bug leaves RHEL 9 and the RHELatives vulnerable

> potentially nasty, because it affects a part of OpenSSH that's running with reduced privileges

Er... Shurely it's less potentially nasty than a bug in root-priveleged code? The snippet from the Debian guy seems to agree ..

> "although this is a high-severity bug, it's running in a process with separated privilges. This means that the affected code is running like an ordinary user account, not an administrative account, so the potential attack is more limited."

America's new Sentinel nukes mushroom 81% in cost. Pentagon says it's all good

Re: Cheap commercial off the shelf alternative

> The submarine programed the missile computer to expect a new super fuse. So when the missile exited the water and turned on it detected an error with the arming fuse and self destructed

Is that the excuse they are going with? I thought Grant Shapps just pressed the wrong button

No, I didn't think of balloon-launched nukes

But evidently the cost of the traditional ICBMs is 'mushrooming'.

How low can you go: Tesla's US market share dips below 50% for the first time

Re: I must admit

Not sure about Tesla specifically, but the whole used-EV market has been plummeting for some time: https://www.cnbc.com/2024/06/16/used-ev-price-crash-gets-deeper-with-premium-brand-idea-history.html

What would you expect from a $100k "piece of Tech"? I imagine they keep their value about as well as a pallet of 100 iPads ...

There are some features of a Tesla that don't depreciate on the used market though, e.g. their ability to make you look like a total utter bellend, which for some is apparently a selling point.

Speed limiters arrive for all new cars in the European Union

Re: The devil is in the detail

Presumably in an EV, the cruise control can be an absolute velocity setpoint, and it would hit the hill and maintain its set speed with more rigid precision than a funicular tram

But maybe they deliberately slacken off the control gains to make it 'feel more like cruise control'

Elexon's Insight into UK electricity felled by expired certificate

That was due to "intermittent data" though, and it was visible in their graphs, with some sources spuriously dropping to zero. I don't think an expired cert would cause that? Probably a separate issue.

However, I did notice that Drax Electric Insights (which provides the same data, not as good IMO as gridwatch except that they also have a price graph) was unavailable for an entire month, and that seems more likely to have been caused by this certificate issue.

Gridwatch did not seem to be affected so much, maybe they simply ignored the cert all along?

EV world in serious trouble if China cuts off rare earth materials

> Car makers seem reluctant to wrap the motors around the axels.

One reason for that is "unsprung mass" - the bearings in a motor take a lot of strain as it is. If you have motors on the axles (or in the wheels) then they take an extra bash with each pothole, if they are not protected by the suspension. This can crush the balls in the bearings if it's a particularly nasty bash.

Trains have the rather wonderful advantage of a smooth rolling surface with no potholes. So they can put motors on the axles.

No, SynRM and EESM are different (but both new, interesting kinds of rare-earth free motor)

Synchronous Reluctance (SynRM) use a ferromagnetic rotor (i.e. iron) which is specially shaped so that it polarises like a PMSM rotor with alternating poles. (Reluctance = ferromagnetism) it's similar to a Switched Reluctance motor in the same way that a PMSM is similar but better than a "brushless DC" motor. The difference being sinusoidal back-EMF and smooth electronic commutation.

EESM might be what the OP was referring to? It uses induction to create a current and electromagnetic field in the rotor, but is quite different to a traditional (asynchronous) induction motor..

As both EESM and SynRMs are fairly new (and afaik both need bespoke drive electronics) I can't really comment on their relative merits. But both have the advantage of being easy to maintain - it's quite difficult/perilous to disassemble and reassemble a large permanent-magnet motor

Are you trying to say that an EMSM is an induction motor? It isn't..

The only reason ICEs have maintained popularity is their ubiquitous and energy-dense power source. That and their price, as they are made out of steel and not much else. In most other respects EVs are better.

If you had an electric motor with poor low speed torque, then you'd need a (selectable) gearbox, which adds to weight, inefficiency, cost, and further erodes any advantages your EV has..