Posts by Roland6

HMRC boss defends shift to AWS, says they got 50% knocked off

"or AWS took a large loss on this"

Because the customer is HMRC, the discount will be in lieu of tax.

HMRC are happy because they are effectively getting more out of Amazon and still have an option to go back for more (tax revenues).

Dell forgot to renew PC data recovery domain, so a squatter bought it

It seems Dell has regained some level of control, as the URL is now automatically being redirected to http://www.dell.com/en-us/work/shop/cty/sf/data-protection

Re: How do domain names expire?

Also happens a lot in small businesses.

With MS SMB Server editions (the ones that bundled Exchange) you were effectively limited to 25 user accounts/mailboxes because of the way things had been integrated. So I often came across companies that did have generic mailboxes such as Accounts@, IT@ mailboxes using personal mailboxes.

I'ver seen the same recently with cloud services where people object to paying the additional subscription for another mailbox, spam filter user etc.

The fun and games start when they discover a security breech (typically via an old or little used account for which they forgot to disable login on), among the actions typically taken to clean up the mess is to delete the account, resulting (with one client) in nearly all the third-party IT admin accounts (Microsoft, Dell, ISP etc. becoming locked as the responsible IT person had got into the habit of forgetting passwords and thus relying on the reset your password email...

...and a plan to get it done that is written on something other than a paper napkin.

Up vote for the reference to "The Back of the Napkin" and the management school of thought arising from not reading the book and relying on materials developed by management consultants who also haven't read the book..

>And this is how shadow IT was born.

And how Microsoft grew so rapidly in the 80's and early 90's, which in turn changed the role of IT departments...

Nothing wrong with working in the shadows, just you need to be able to manage the successful (skunk works) projects into primetime IT systems...

National Audit Office: We'll be in a world of pain with '90s border tech post-Brexit

Re: Brexit?

"in the meantime preparing for a no deal Brexit"

It sounds like the UK is finally doing the same. And I am pretty happy about that as its the probable and possibly best outcome.

Well I give you credit for probably having a realistic grasp of the negotiating capabilities of T.May, D.Davis et al !

Unfortunately, it won't be the best possible outcome for the UK or the EU...

Re: Brexit?

At the negotiating table our position is of reducing or avoiding mutual damage.

That might be what our politicians have said, but what of substance has the UK government put on the table?

As you note we are members, hence the easiest way to get your own way is to present a vision and demonstrate how it will be in their best interests to support you! And the best time to have done that was July-Dec 2017 when the UK would have held the Presidency - however, in the interests of Conservative party unity, T.May couldn't wait to start Brexit and so forfeited this opportunity...

The points around the Irish border and the financial settlement are simply responses to specific points.

Like you I would hope that there are some knowledgeable and intelligent people (ie. not politicians) painstakingly going through things line-by-line because clearly, T.May's £20bn offer was just as disingenuous as the £100bn.

From Amsterdam (where I'm currently working with a client) the UK government and T.May and her Brexit team do look like a bunch of clowns. T.May expects the EU27 to agree, yet has been totally unable to get her cabinet of 20 to agree to anything significant... Hence I get the distinct impression that the EU27 are giving the UK plenty of rope and biding their time, hoping that at some point the UK government come to it's senses; in the meantime preparing for a no deal Brexit...

Re: Brexit?

So far we have yet to hear of negotiation

Agree with you on this point - I've yet to see the UK government put a serious offer on the table other than suggest it will do nothing and thus fall off the end of the Article 50 conveyor - which effectively is the default EU deal and negotiating position, namely: it is up to you to come up with and present an offer that is more beneficial to the EU than the default one.

What people are missing is that in a traditional sales negotiation, whilst my intention is to sell as high as I can and deliver as little as I can, my fundamental desire is to get the customer to believe the deal is a good one for them so that they sign up to it as: no signature = no contract = no commission. Simples!

Now if we compare this to the UK-EU Brexit negotiations, I can see no schmoozing, no selling of why an independent UK is good for the EU, hence why they should give the UK single market access etc. on terms very similar to those currently enjoyed but without the inconvenient requirements and most certainly without the cost.

Also, it is clear the UK isn't negotiating like a customer who, having realised they have been shafted, is now trying to extract as much blood as possible from a supplier.

Hence it becomes obvious the only things the EU27 really need to concern themselves with are the implications of the UK falling off the Article 50 conveyor on themselves. The fact that the EU negotiators quite happily use figures of 60~100bn Euros without flinching, tells me that the EU27 can take the hit and have in fact already factored that in and so can calmly play the game of bluff and make their demands. So to them, the UK's threat to walk away isn't a threat, it is merely an anticipated outcome.

Hence putting this into a 1980's context: T.May and the UK are Arthur Scargill and the miners' unions and Jean-Claude Juncker and the EU are M.Thatcher and her government - it is obvious who will finally prevail...

"Can we not just buy this stuff off the shelf? ....

You certainly could, but you may also have to buy the full set of the laws, rules, regulations, and possibly local languages of the originating country."

Well, I'm sure one of our European neighbours could sell us a system as a service (hosted in euCloud) that was a close match to the UK's current laws, rules and regulations. Although last time I looked the version with the ability to participate in the revision of laws, rules, regulations and supported languages was around £350m per week...

[Mine's a pint of bitter.. ]

Viasat: We're going to sue Ofcom over EU-wide airline Wi-Fi network

@AC - you are right and thus Inmarsat's "Plan B" was to either not turn on the functionality or not to offer those services to UK businesses...

>My guess was that Inmarsats lawyers knew damn well Ofcom would have to change their licence being as it transpried EU law was to force their hand, and thus took a calculated risk.

My reading as well, although given satellite lead times, the question does arise as to whether Inmarsat took a calculated risk before the EU final decision.

But I do question just what Viasat hope to achieve. Given Inmarsat is regulated by Ofcom, then strictly by building and launching a satellite outside of their Ofcom licence, they are in breach of UK regulation, so should be fined. However, Inmarsat can take Ofcom/UK government to court for failing to implement EU law and thus gain recompense. Now were in all of this do Viasat gain? The only avenue I can see is this could delay the launch of the Inmarsat service and so enable Viasat to catch up.

HMRC's switch to AWS killed a small UK cloud business

>Maybe HMRC should be running their own cloud and selling off the excess capacity to other government departments.

I thought that was the original idea behind G-Cloud, before the Cabinet Office realised why government departments ran their own IT...

Also by having a third-party operating the cloud, it is harder for the civil liberty crowd to claim government departments are secretly sharing data...

Re: 85% of revenue from a single client?

The trouble is as an IT start-up that is generally the case. You get one customer, bend over backwards to keep them happy in the hope you can use them as a reference to get the next customer.

It is clear that is the case here with DataCentred. The government has been going on about its pledge to award more business to SME's, however, satisfying the entry criteria is neither simple or quick, also G-Cloud is a relatively new and under utilised initiative. So DataCentred would have put significant investment into gaining the HMRC contract and use it to build up both it's infrastructure and track record in government.

It would not surprise me that some in HMRC used DataCentred as a learning exercise and so make appropriate demands on Amazon and AWS and thus it was never HMRC's intent to use DataCentred long-term.

Re: £9 million funding

>So it's central gummint you need to be incensed by.

Agree, however, local authorities are going about things in a stupid fashion.

For example, in my county the decision has been taken to close 8 libraries. We went through the documentation and there are some corkers:

All libraries are open on Sunday, however, it has the lowest footfall (we are talking dramatically lower). The idea that you could close the libraries on a Sunday seems to have not occurred to TPTB: the savings arising are sufficient to fund 2 libraries. I could go on, but there was a really interesting Finance meeting recently, where my 14 yo daughter stood and spoke pointing out the obvious savings that could be made and thus keep all libraries open!

Re: How long UK before tax records taken by the USA

how long before the USA slurps up all UK tax data on some pretext.

Not sure if that really is the main reason to be worried; as a 'sovereign' state, I'd be more concerned about their ability to deny access to my data and hence the 'sovereign' government's ability to collect taxes.

'We've nothing to hide': Kaspersky Lab offers to open up source code

Re: Worth nothing

I still think using Microsoft's AV is the best solution - they already control the OS code so if you can't trust them you're already screwed.

But if your using Win10 (or 7 or 8 with the CEI and added telemetry updates) you've already granted permission to MS and it's selected third-parties to scan and potentially upload the contents of your HDD. So you've effectively agreed to the NSA to spy on you in exactly the same way the US are accusing Kaspersky and the Russian spooks.

Now we can look at the source code of Windows and MS's AV all we want, but as you've already noted it is a meaningless exercise, in part because the hooks necessary to allow eavesdropping by state agencies are already present as they are needed to support the legitimate function of the code.

Unless other companies are significantly faster in updating the signatures I don't see why you'd want to go with a third party for AV software.

Well it is obvious from all the shouting from the US why you should now use Kaspersky! MS AV won't detect the US government malware, whereas Kaspersky will! Which effectively gives us a practical demonstration of security in depth and not relying on a single vendor!

"Make America great again"

This, like other instances smells more about making Amercia great, by firstly discrediting non-US products in the home (US) market and allowing the media to spread the FUD around the world. Secondly, by getting the non-US business to open themselves up to inspection by US 'officials' - who we can expect (as this is what happened in the past) to pass information obtained on to US businesses who would normally have had to compete with the non-US companies. Thirdly, the US companies will, having divided the non-US companies (do you trust critical software from a country other than your own?) be able to reconquer the world...

Following this strategy it won't be long before the US regains its 'lead' and hold on the IT sector...

Re: Broken Clock

Both hands on an analog clock pointing precisely downwards is going to be reading a time of half-past six.

No, on an analogue clock, at 6:30 the minute hand will be pointing precisely straight-down covering the '6', the hour hand will point halfway between the '6' and '7'.

The only time both hands point precisely at the same numeral is 12:00.

All your masts are belong to us outfit Arqiva confirms IPO plan

Re: Maybe they know something...

I wonder what the latency is...

Just that the OTA network is a pre-existing 4G multicast content delivery network. Remember Ofcom are keen for the TV channels to be re-allocated to 4G spectrum and resold to the mobile operators.

There is no real reason why mass consumption streaming content needs to be delivered over the same mast infrastructure as that being used by the handsets in their normal communications to service providers. Hence a question has to be around the viability of telling a handset to tune to a different frequency for the football match, movie etc. than the one used for normal communications. An advantage of this is that the effective cell size of cells receiving such content is much larger and thus your experience of watching a movie whilst travelling could be significantly better than that of the person sitting next to you trying to browse the Internet.

Re: All very well replacing one kind of debt for another

but there is no mention on how (or even hope) of how a shareholder makes a return.

Well, I must congratulate Philip Carse, the analyst at Megabuyte El Reg quotes, for his ability to see through the claims made in the announcement [https://www.investegate.co.uk/arqiva-group-limited/rns/intention-to-float/201710230700042682U/ ] and thus not only fully understanding what is going on here, but to talk about it in public. Because from a casual reading of the announcement you would thing all is roses.

Interestingly, there is one point relevant to the debt repayment, namely only £0.6bn of the £5.2bn of debt is to be repaid to reduce interest costs by £57m pa.

Also El Reg are wrong to say that Arqiva is to sell 25% of it's shares, it isn't. It is creating new shares, as the existing shareholders "intend to only sell Shares through the over-allotment option", thus the IPO is a dilution.

Re: Typical

Oh, and those lease agreements and costs are very tightly monitored and controlled by OFCOM as the business operates in a near monopoly environment.

Err no, Ofcom is only interested in the charges Arqiva levies on it's users. Ofcom couldn't care less about the way Arqiva finances the provision of it's services.

It is noteworthy that as a private company and not a former state monopoly, Arqiva has escaped from Ofcom's "sounding tough" agenda. Look at the shouting about BDUK and BT not doing this or not doing that and not doing it in a timely way. Yet, from the silence, that £150m of public money, could of simply disappeared into a black hole.

Vodafone, EE and Three overcharging customers after contracts expire

Re: Moral of the story

An interesting result of a quick bit of modelling: If a customer stays on for two months extra after the contract expires, the company make more profit in those two months than they did over the entire 24 month duration of the contract.

It wasn't that long ago that Orange gave a 5% discount to those who remained on contract but didn't upgrade their handset, users could accumulate upto 25% discount by doing this...

Didn't install a safety-critical driverless car patch? Bye, insurance!

If the update is released at 3pm and you get a "safety critical update available" message, and you are driving at the time, then you crash at 3:01pm, then your insurer can deny coverage.

Also given the current regime concerning manufacturers recall, I expect a safety critical update to be in the same category and thus the relevant government department will have determined whether vehicles with the defect are or are not roadworthy (until they are updated). If they deem such vehicles to be unroadworthy then no insurance and a fine for driving an unroadworthy and thus untaxed and uninsured vehicle on the road (unless you can show you were driving it to a garage).

NYC cops say they can't reveal figures on cash seized from people – the database is too shoddy

Re: I smell rampant mendacity...

"... but setting that aside, the fact that they thought they needed a z10 ... is scary enough in itself. ...

Either there is vast corruption in the IT procurement department ... or there is vast corruption on the streets"

Or they could have just gone with the equipment supplier with the lowest upfront Capex price. It would not surprise me (having in the past purchased top end IBM mainframes, whilst having Sun quote for Starfires) if the z10 was priced at 1 USD. However, the service contract (Opex) is likely to be a totally different matter and depending on the amount of other IBM kit on site may be very difficult to determine the actual cost...

Re: How seizure laws ever stood --

Cool. I suspect that Mueller already has evidence that Trump's fortune is mainly based on money laundering, so that will be a big help when we start rounding up all the scoundrels.

Seems like reasonable grounds to direct the NYPD to seize Trump towers.

I mean it's not like the administration will have grounds for complaint, given "President Trump's Attorney General Jeff Sessions is a big fan of seizures."

You're doing open source wrong, Microsoft tsk-tsk-tsks at Google: Chrome security fixes made public too early

Re: Does Microsoft's approach not imply...

That open source is insecure and closed source (ie. MS code) is more secure!

What MS are complaining about is a natural facet of the open source development and release process, namely the (public) master source code repository will be updated before a (public) build containing the fixes is made available. Simples!

The only solution to this problem is to make the master source code repository closed - available to the few and only update the public source code repository at some date after the release of a new build...

However, this prevents the timely cascading of source into other projects...

Windows Fall Creators Update is here: What do you want first – bad news or good news?

Re: Windows 7 ... missing features

>But Windows 7 doesn't have many of the advanced security and mitigation features of Windows 10 and never will have.

Just install EMET and a decent third-party firewall/security suite, remember with Win10 MS have, in the main, simply integrated EMET - hence why EMET is no longer supported on Win10 and the Fall update will uninstall it if found...

As for new features, I'll skip on the not-ready-for-primetime VR stuff and all the rest.

A typical business desktop/laptop is running Windows and Office: what new features in Win10 (and specifically the Fail update) improve the operation of Office?

Device support any better than build 1703?

MS finally delivered the 1703 update for my canary Win10 tablet in September, until then it had been on 1605 since March 2017.

I wonder if it will receive this update (1709) before Christmas or it will be receiving it in March again...

Qualcomm takes 5G to spooky millimetre land

Re: Attenuation sometimes a good thing

>Downside - we're back to holding the phone up in the air to get a signal.

I knew we would find a real use for Selfie sticks and bluetooth connected headsets.

uBlock Origin ad-blocker knocked for blocking hack attack squawking

Re: No thanks...

CSP reports don't fix busted webpages...

I thought their intent was to flag to webmasters that their site contains broken/compromised pages, so enabling them to do their job.

Obviously, the implementation of this useful service may have resulted in the original intent being forgotten or simply written out of the specification...

Google isn't saying Microsoft security sucks but Chrome for Windows has its own antivirus

Re: 450MB/sec, 1GB/sec?

@big_D The way I read it, it doesn't scan Windows per se, it is just scanning the Chrome environment and removing dodgy plug-ins.

Given one of the main infection vectors is the browser either visiting malicious websites or accidentally downloading compromised scripts, I would assume that Google with Chrome are doing similar to what Yandex are doing with the Agnitum security suite, namely improving the security within the browser by incorporating features that, currently are provided by freestanding third-party security suite/products such as Kaspersky and MalwareBytes Anti Exploit, or browser plug-ins/extensions such as NoScript, uMatrix.

What is different (currently) is that Yandex took out Agnitum totally, so they now only produce the security extensions for Yandex products - so bye bye Outpost Firewall and Security Suite. Whereas Google have jus ensured that ESET's browser security technologies are tightly integrated into Chrome.

Future of Misco UK hangs in the balance – sources

Re: Advice to staff

"Having been through a corporate insolvency, I have some advice for Misco employees: Get out as fast as you can."

Given how long things have been going on, you've probably left it too late to not be adversely impacted.

I would anticipate the company has in at least the current financial year and if not the previous year:

1. Not paid NI contributions to HMRC (but will have deducted them from your pay).

2. Not paid contributions into your pension scheme.

The absence of NI payments will directly impact your entitlement to state benefits - such as Statutory redundancy pay - and will also mean the months when you thought you were paying NI but weren't, do not count towards your state pension entitlement.

The missing payments into your pension scheme, will have a varying impact:

1. If it is a defined benefits scheme, well the scheme will be even more underfunded than it probably already is - there is a government-backed scheme that may help to cover this shortfall.

2. If it is defined contribution scheme, you've lost a few months contributions.

3. If you have payroll deducted FSAVCs then you've probably also lost these contributions.

By joining the queue of creditors you might be able to recover some of these monies down-the-road, but given the odds against recovery, I would treat any monies recovered as a lottery prize.

Word to those not about to be made redundant: Do your FSAVCs as direct debits from your bank account as that way you know if they have or have not been paid and whether tax rebates from HMRC have or have not happened.

As for PAYE, just as long as you have your payslips showing tax has been deducted, HMRC will not ask you for the unpaid tax...

Remember how you said it was cool if your mobe network sold your name, number and location?

Re: Bring on GDPR - Vive l'Europe

>Unfortunately I can't image that those across the big pond are ever going to come close to establishing honest GDPR laws.

Unfortunately, I can't see the current crowd at Westminster implementing honest GDPR laws either.

Yet, you can be sure they will want to be 'in' the European data market, in a deep and meaningful way, but not held to the rules...

It's 2017... And Windows PCs can be pwned via DNS, webpages, Office docs, fonts – and some TPM keys are fscked too

Re: " I'm pretty certain that x64 has executable and non-executable page flags.."

One issue is compiler have the bad habit to mix instructions and some static data (and sometimes even non-static)

Don't remember having that problem with PL/M, but then PL/M did require the programmer to have some knowledge of segmentation, thus it was the programmer's decision to mix instructions, static data and dynamic data.

I suspect the compiler problem is down to people wanting to use high-level languages and hence their compilers to solve everything, rather than accept that there are times where assembler (and hence some understanding of machine/platform architecture) is the right choice.

>Windows update ... increase our productivity.

Perhaps MS have quietly gone into reverse, with all the claims that people are spending too much glued to their computers, MS, through the Windows Update service, are providing opportunities for people to take breaks and do other stuff...

Outlook, Office 2007 slowly taken behind the shed, shots heard

when in fact they are merely visual distraction from the true power of the keyboard shortcut.

So, given the lack of documentation etc.etc. please explain how firstly you found out about Ctrl-Shift-F and other keyboard shortcuts and then committed them to muscle memory?

This fundamentally is the reason why the Win8 and more recent Windows UI's suck, it is almost as if MS read Donald Norman's book: 'The Design of Everyday Things' (first released as 'The Psychology of Everyday Things') and deliberately decided to reject well-founded design principles.

The Ribbon, was intended to replace keyboard shortcuts, with my children it has been easier for them to get started and produce stuff, by visually exploring the ribbon and clicking on the image of the effect they are desiring, my daughter is starting to get more fluent, but is hindered by the lack of an obvious proficient/expert user option ie. keyboard shortcut.

Interestingly, both iOS and Android also suffer from some of the same brain dead 'designer' thinking, where users have to learn (from other sources or trial and error) to swipe starting from particular parts of the screen in particular directions to achieve certain actions.

Re: No more security fixes from Microsoft

I see in today's (10-Oct-17) update bundle a couple of security updates for Office 2007.

Re: Quite rightly

Personally I'm still crying over the death of Office 2003. ... My productivity rate at the weekends using that is streets ahead of in the week using....

The trouble I have is that whilst I prefer the menu UI of 2003, the 2007 versions of Excel, Outlook, Visio and Project contain some notable functional improvements...

Leaky-by-design location services show outsourced security won't ever work

Re: These billion dollar surveillance phones and app companies....

>... are the retail arm of the NSA.

It is interesting to reread the thoughts of Edward Snowden on security:

https://forums.theregister.co.uk/forum/3/2015/11/12/snowden_guide_to_practical_privacy/

Either Ed, wasn't privy to all that the NSA were up to or they (the NSA) weren't into the collection of this type of metadata.

I get the feeling that we will see more of these accidential/unintentional leaks of metadata that permit inference about a person and their activities that they didn't intend to make public.

Re: Where you see conspiracy, I see a lack of demand for it.

>Ubuntu Phone

Was this ever offered for sale?

I remember seeing various incarnations demonstrated by Canonical either in-person or reviews by various tech publications, but I don't remember ever seeing an announcement that the phone was available to buy...

Boffins' bonkers fibre demo: 53 Tbps down ONE piece of glass

Headline factually incorrect!

Sorry but "multi-core fibres" is not "ONE piece of glass"

The only real question is whether the technology will scale and so support the distances seen in undersea cables.

Microsoft silently fixes security holes in Windows 10 – dumps Win 7, 8 out in the cold

Re: You think that's bad?

>If you guessed XP then you win a cookie.

Interestingly, MS are still issuing security updates for Office 2007 on XP. For obvious reasons, I don't expect this to continue beyond 10-Oct-2017 (today is the 7-Oct-2017), so I expect the set I downloaded last week were the last...

Reminds me to download WSUS Offline Update v11.0.2 - the last version to support Office 2007 and create a full update set.

It's 4PM on Friday, almost time to log off and, oh look, Disqus says it's been hacked

Announcement not particularly clear

Users who created logins on Disqus had salted SHA1 hashes of passwords whilst users who logged in via social providers only had references to those accounts.

I received Troy's email, what bothered me about the notification is that whilst the information may be technically accurate and correct, what does the above statement mean to your average user?

Leicestershire teen admits attempting to hack director of the CIA

followed by the obligatory handwringing by UK (Conservative) government saying there is nothing they can do as it is all in the UK-US extradition treaty and we must honour our treaty obligations, whilst at the same time happily renege on all the treaties the UK government signed with the EEC/EU...

He's no good for you! Ofcom wants to give folk powers to dump subpar broadband contracts

Nothing will change!

When I switched to EE fibre broadband a year or so back, a line test/check was done and the result said that I would get a maximum of circa 35Mps on the 38Mbps service and circa 46Mbps on the 76Mbps service. I decided on the 35Mbps service which came with a minimum guaranteed download speed of circa 14Mbps.. As yet I've not seen line speed drop below 30Mbps, although I regularly experience slow internet access.

If however, I had contracted with Zen, they would have given me a 'normal' speed of 35Mbps with an SLA that if the speed dropped below 32Mbps. I would be able to report a fault and get an engineer to investigate.

I therefore, have to question whether this latest idea from Ofcom will actually change anything, as surely the majors will simply quote a low guaranteed minimum speed.

European Commission refers Ireland to court over failure to collect €13bn in tax from Apple

"Apple complied with all Irish laws."

EU law trumps Irish law.

EU law is incorporated into Irish Law - something the Irish government voluntarily undertakes as part of honouring its membership; so Apple aren't being entirely truthful...

Russian spies used Kaspersky AV to hack NSA staffer, swipe exploit code – new claim

Re: The tag line

>No, I am not going to translate either, they are not translatable as each will take half a page to explain

Not one to turn down a challenge...

Google search and translate are your friends - other search engines and translation services are available. There is a rich seam of resources written by people passionate about making the Russian language more understandable and accessible to native English speakers.

From my research, I would say they are all translatable and more easily translatable than many Japanese sayings, however you are right they all need an explanation of what the literal translation means because they are local sayings or proverbs, and thus are best understood by being translated into your locally equivalent saying/proverb.

Re: The Russians ate my homework

>The US spooks were probably testing their exploits against various AV as they have to in order to use them in the wild

You've picked up a rather important point. I discover an exploit - how do I determine if it really is an undiscovered and thus viable zero day exploit?

There is only one way, to try the exploit on other computers running various security suites. In the (recent) past, such suites used a local DB, hence if my exploit isn't blocked and/or detected then I'm potentially good to go and I've not accidentially alerted anyone to my finding and work. I may rerun the tests at regular intervals, just to confirm the exploit is still 'undiscovered'.

Today however, with online security suites, the first thing a local AV will do is to obtain a hash of my expliot file and upload it, on discovering that it is new, the next action will be to upload the complete executable for deeper inspection.

Thus it would not surprise me, if it was discovered that various cloud services already contain hashes and perhaps archived example executables of "top secret" NSA exploits; just that there has been nothing to cause them to be flagged.

However, by combining metadata from the security upload, specifically IP address and system id, with metadata from other sources, I suspect it would be possible to identify through the known exploits many as yet unknown exploits and thus raise the flag on these currently hidden trojans...

I would assume that NSA would have thought of the above and more and hence it has influenced the final rationale for banning Kaspersky from government systems. Interestingly, it also means the US government can't use any security software who's cloud service is outside of the US and thus accessible to foreign agencies...

And all the methods fall down in this case, as the issue as people had noted isn't necessarily a 'trojan' in the source code, but the use of a system to detect particular files and upload them.

I suspect many Cloud AV products can be commanded on seeing a particular file signature to upload the associated file and suspect that this legitimate operation can be misused by a piece of shell script in the AV Cloud to request the client to upload all files:

While Client finds files to hash Do

Client to Cloud: Here's a file hash

Cloud to Client: Please upload file for deeper inspection

Enddo

Re: Possible ???

Well given all the location tracking, I wouldn't be surprised if some companies have very good idea of who works and live where... Bring back the Nokia 6310i !