Posts by djnapkin

How to stay on Windows 10 instead of installing Linux

Re: There an easier way

How great is the actual danger from not getting those windows updates? I didn't even have anti virus running real time in windows 7 because it slowed things down. That was a hard drive not SSD machine. I did have Malwarebytes installed at the ready to test installation files etc me

There was the Outlook Express bug that ignored the file type and believed the mime type. There was the RDP exploit that was very nasty but I've always only opened the firewall to specific addresses. Can anyone recall actual windows vulns that were remotely exploitable with no klutzy user action required?

Re: No Office 365 or Adobe subscriptions

Good heads-up on those issues with LTSC, I'll give that a miss.

Not come across photopea before but at a quick glance it has mask layers which even paint.net still does not have. Looks very handy. Cheers.

The force is strong in Iceberg: Are the table format wars entering the final chapter?

Re: anyone used iceberg?

"have only used parquet" - you're well ahead of me.

From a Medium article

"Hive keeps track of data at the “folder” level (i.e. not the file level) and thus needs to perform file list operations when working with data in a table. "

Iceberg solves this by"keeping track of a complete list of all files within a table"

Files within a table? Not tables with a file? It's a database, Jim, but not as I know it.

This uni thought it would be a good idea to do a phishing test with a fake Ebola scare

Do they eventually have the desired effect with many members of staff?

All the research I have seen says the opposite.

In practice the reality is that some people are very highly resistant to training in this way. They just will keep clicking the link, or OK'ing if the authenticator on the phone asks them "is this you?".

Keen to see evidence that it works, that is not sponsored by a mob who provide the service for money.

Re: Hmmmm

> “OK, I’ll click anyway….”

Exactly. Some people will always fall for these traps, and can't be told.

Phishing simulations a waste of time

I used to think that phishing simulations were worthwhile. Indeed, they were used in one place i worked.

I've since learnt they serve no useful purpose.

Some people cannot be trained by sending them an occasional phish, to stop clicking those links. Training simply does not work this way.

The evidence suggests there is a sub-section who are highly resistant to learning about clicking on phishing emails.

Rather than waste everyone's time, better to build a working defence against these incoming emails in the first place.

How deliciously binary: AI has yet to pay off – or is transforming business

Shiny

All of the AI hype has proved useful in one way.

It seems to have taken the focus of the "ooh, shiny" commentators away from blockchain. Whether swapping blockchain for AI constitutes an improvement, is arguable.

Microsoft, Google do a victory lap around passkeys

Re: What about your phone breaks on holidays?

> But what about when it happens with a passkey? You have no Authenticator app or anything else, so how to login?

Easy. You just request a reset via email, and ...

Wait, your email account is protected by a passkey, or SMS to your phone that you don't have? Ah well, too bad, so sad. No more fun holiday for you.

They are not cloneable, never leave the device, but just back them up?

Defenders of passkeys in this thread say

* they are not cloneable

* they never leave the device

They also say that you just need to back them up, in case you lose your device.

So, which is it then?

> Verify yourself using the Authenticator App

which was on the device you just lost

> Create a new passkey on the new device.

for every site. So, for the hundreds of passwords I have, I'd have to jump through all of those hoops, hoping I can get through the 2FA, for each one? Something doesn't smell right here. I recently did reset my device, and the 2FA for a stock trading site in the USA, was gone - their app has no backup. That required a phone call to the US based support staff to be able to log in again. Sure hope I wouldn't need to multiply that experience by a hundred.

What can be done to protect open source devs from next xz backdoor drama?

Re: Strengths and weaknesses

Wise words, Bazza. Well said, sir.

> So, how does one tell the difference between an innocent mistake, and a deliberate mistake? One cannot.

And that keads us to, what to do instead. This backdoor was going to open an ssh connection.

Outgoing firewalls? Would that have helped here? It's not a new idea, but seems to have fallen by the wayside in recent years. Perhaps time to bring it back?

What strange beauty is this? Microsoft commits to two more non-subscription Office editions

In the legal field it's comon to have a software package that drives Word. For example customer database entry + word template -> custom word doc. How does this scenario work in a web-only situation?

Ubuntu, Kubuntu, openSUSE to get better installation

Re: Non-issue

Yes, the Windows installer defaulted to preserving the existing data and saving the current OS as Windows.Old when I installed one the other day.

When choosing the 'clean slate' choice, it shows the existing partitions, which I delete one-by-one.

Once they are all deleted, the installation looks after creating whatever partitions it deems necessary.

Ransomware payment ban: Wrong idea at the wrong time

Re: Dont ban paying ransoms, ban Crypto

Much as I hate the waste incurred and so many other things about crypto, banning it won't stop ransomware.

If anonymity was critical, the gangs would be demanding payment in Monero, which is effectively untraceable.

Yet they quite happily ask for Bitcoin which is quite traceable.

If you're in Russia or a part of the CCP, you're untouchable.

Cybercrooks book a stay in hotel email inboxes to trick staff into spilling credentials

Missing the step between the download and the installation

I'm missing a step in the exploit chain here. Once the staff member downloads the google drive file, it wouldn't be automatically installed. I'm assuming the file is a .exe executable? Are the hotel staff double clicking it and clicking Yes on the UAC prompt?

UK officials caught napping ahead of 2G and 3G doomsday

Aussie 3G going down fast

3G is already switched off by Vodafone in Australia and the two other carriers will be switching it off in 2024.

Southwest Airlines lands $140M fine for that Christmas IT meltdown

I'm sure that every airline's needs are so completely different to any other airlines, that custom software has to be written for each one.

Telco CEO quits after admitting she needs to carry rivals' SIM cards to stay in touch

Back in the day, someone would work their way through the organization, learning the ins and outs of telco operarion. They would understand the subtleties and needs of the various departments. This was the way they could lead the operation because they had been there and knew the realities on the "shop floor". .

Now, they fly in someone who has no background in and not the faintest idea of how a telco works. They only know financials and cost cutting.

This is the result.

Re: Gladys Berejiklian

One of the largest by way of corruption, ever since the Rum Corps

Re: DR Strategy

Indeed the other telcos key employees also carry sims for thir opposition, just in case. Makes perfect sense.

Microsoft gives unexpected tutorial on how to install Linux

So I tried their instructions. Quote "Available to those with a Windows machine, this is the most simple way to install Linux. Just run the Linux install command: wsl --install to install the Ubuntu distribution."

According to that, wsl --install will do the job, in reality however, it just displays the help text and does nothing else.

It's a shame they let go their documentation team.

A few months ago she had a look at W10 & decided it would be too different for her to upgrade.

Why not install Open Shell for her? It makes nearly all of the pain of W10 go away.

If you like to play along with the illusion of privacy, smart devices are a dumb idea

Re: Why would a Washing Machine require my Date of Birth ...

> I will give them the same Jan. 1 1900

I hope some data analyst at these sites does a frequency analysis and wonders what on earth keeps happening around 1st April

SAP CEO push for cloud-only 'innovation' shatters users' trust in German-speaking heartlands

Yes! This is effectively exactly the same as Atlassian's removal of on-prem and forcing into vendor-controlled cloud.

SAP's first attempt to implement a web-based ERP was using Silverlight. No idea how much they sunk into that before scrapping it.

For customers, it is hard to imagine a SAP-owned-and-controlled cloud solution being more affordable long term.

Stolen Microsoft key may have opened up a lot more than US govt email inboxes

Where I worked, the Java crew looked to add Navajo Systems technology to encrypt their data while at rest in the DB and seamlessly encrypt / decrypt it enroute between the DB and the application.

The cocept was great - but the obstacles weren't able to be overcome, whatever they were, and it did not go ahead.

MOVEit body count closes in on 400 orgs, 20M+ individuals

Was encrypting the data too hard for them?

What was stopping those who ran these installations of MoveIT from ensuring that the data sent to them was encrypted?

They could have easily used AES-passworded zip or 7z, combining the compression at the same time as the encryption. Different keys for each client, naturally.

Or they could have used PGP, giving out the public key with only the server operator knowing the private key. With this PGP approach, even the creators of the uploads could not decrypt it.

When are we going to start assuming we can be broken into, and working from that baseline?

One of the world's most prominent blockchain apps looks like being binned

I used to work in a firm that runs back-end processing connecting to the current ASX system, and it is well designed and engineered. Not sure what the goal was in this redesign.

Hey, the ASX only had to write off $250 million of investment, and as for another estimated $100 million spent by participants building to this scrapped model, well ...

All seems rather deja vu. Was working in a London software firm in the 90s when the Bank of England scrapped its stock exchange project, I think we lost a million quid on that.

India’s Supreme Court demands government detail internet shutdown rules

When I was in India some time ago there was a prominent story in the broadsheet Times of India. Students at some university were protesting that their "right to cheat" had been taken away for some examinations. Apparently cheating was a time honoured tradition at these exams. Wish I'd kept the newspaper. This was before the web took off. I assume they were using notes on paper?

Older AMD, Intel chips vulnerable to data-leaking 'Retbleed' Spectre variant

Re: worry more about the fixes than the problems

Very good point, and not one I've noticed other suggest, up to now. Makes a lot of sense. And, if we are going to take the usual hit from anti-malware, do we really want a 70% speed drop as well?

Apple Pay bags Cupertino another antitrust lawsuit

Re: Don't get your hopes up.

In the article itr was pointed out that on Android no fees are charged. Therefore I'd reckon your claim that "incumbent payment processors can charge MORE than Apple, not less." has no basis.

Creator of SSLPing, a free service to check SSL certs, downs tools

Pingu

I must be masochistic because I would be interested in the challenge of running such a tool. I've never let lack of prior experience get in the way.

On another angle ... I notice one of the major obstacles was keeping the *nix operating system up to date. If only he'd run it on Windows ... (ducking for cover :-)

Day 7 of the great Atlassian outage: IT giant still struggling to restore access

Re: Ah....remember....."cloud" is cheaper......

We also used to use the commenting when doing a bulk close on tickets. That was in previous job with on-prem. I shake my head that they haven't fixed that in their cloudy option.

Re: But but but....

They are stopping on-prem? I wonder if that will still go ahead after this disaster?

Crack team of boffins hash out how e-scooters should sound – but they need your help*

Until the UK gets up to date and legalises them, they miss the opportunity to regulate them.

Or maybe the UK thinks the war on drugs went well.

Mozilla founder blasts browser maker for accepting 'planet incinerating' cryptocurrency donations

Where are we up to, with Bitcoin's energy use? Last time I looked, it was exceeding that of Ireland, or Croatia.

Re: Expanding horizons and equations

That isn't how I took the comment and comparison at all.

The regex comment is very well known & high profile, but I'm sure I'm not the only person who enjoys it but didn't know who coined it.

The comparsion was purely pointing to Zawinski's excellent ability to turn a phrase - something that is well apprecited by the denizens here, to be sure.

Less than PEACH-y: UK's plant export IT system only works with Internet Explorer

Even in the world of lazy, befuddled public servants, this is egregious slackness.

Web trust dies in darkness: Hidden Certificate Authorities undermine public crypto infrastructure

Well, well, I thought that the root certificates in the browser, for example the 151 built-in to Mozilla browser, were pretty much hard coded in there.

It would be good if the article explains how the browser root store is added to.

Good news: Google no longer requires publishers to use the AMP format. Bad news: What replaces it might be worse

Re: Use Bing!

> If you have a specific fetish that you want to see images of, Bing beats Google hands down.

Absolutely. I reckon if I searched for "turtle" Bing would give me pictures of them humping or whatever it's called with turtles.

Back on topic though,. it really gripes me how much Javascript is in web pages and yes, as a web developer, I agree it is totally due to lazy programmers.

Wi-Fi devices set to become object sensors by 2024 under planned 802.11bf standard

Hmmm, let me check the date on my calendar. Oh, 1st April, well look at that.

Kinda goes without saying, but shore up your admin passwords or be borged by this brute-forcing botnet

Re: My sympathies

I'd love to discover where that surname came from. Perhaps an anglicisation (?) of a European or Russian name.

I recognise my site is too small and not a target for this, but the distributed attack surely would punch a hole in our "five shots and you are out" defence against brute force login attempts.

Darn.

Moore's Law is deader than corduroy bell bottoms. But with a bit of smart coding it's not the end of the road

Re: They shoot themselves in the foot

I had a rather different take on the article to you. I thought it was well laid out and covered the progress of the optimisation, with great clarity. I'd say the results from optimising on a multi threaded CPU were impressive. The overall message of optiising your software was well carried.

Threading is beyond many programmers, and running on a GPU is surely a specialised art - and I am not sure how many servers, either inhouse or cloud, would have GPUs. Perhaps they do. I just have not heard of that being a thing.

Re: C rocks.

Yes it does, until the wrong subscript variable is used for an array index and you can't figure why you occasionally get memory corruption in a large program, causing disaster.

Not that this ever happened to us.

Re: DEC Fortran

512KB? We used to dream of having that much memory around 1980. The Unisys mainframe was as big as several cupboards, and had 192KB of memory. Each memory card was 16KB but was the size of what would be a large motherboard today.

Sure taught us how to make sure our programs were optimised.

JavaScript survey: Devs love a bit of React, but Angular and Cordova declining. And you're not alone... a chunk of pros also feel JS is 'overly complex'

Re: JavaScript is "overly complex".

Re "but I've always written all the JS I use myself, with the exception of the odd tool such as CKEditor" - do you use jQuery? I find it doesn't impact the performance of my sites at all. Plus, the user's browser almost certainly has a cached copy already.

Re: Frameworks

Web pages with all the framework overhead run like dogs. No one ever wants to optimise or cull. We devs only to add more stuff into the page. Performance dies as a result.

Clean CSS, just enough JS to do the job (and no more) - otherwise your pages suck. And you aren't a real programmer if you can't do it that way.

Australia on the cusp of showing the world how to break encryption

This is not intended to break end-to-end encryption.

It is just so they can ask Google/Microsoft/Apple to hand over gmails, hotmails, or whatever is held in the cloud.

Why Firefox? Because not everybody is a web designer, silly

While Chrome is better for web designers (like me), for using the web, Firefox is massively better.

Firefox has features that make using it a pleasure. Whenever I use Chrome to surf the web, as opposed to debugging a DOM/CSS problem, I am reminded of how little attention Google pays to real world users.

Browser history searching and the URL bar are just one example.

Ombudsman slams Centrelink debt recovery system

Will the head of this project be lopped? If not, why not?