Posts by Ken Hagan

User refused to change her password because everyone already knew it

...how fast it was...

That would be similar to the practice of identifying people by their initials (not for logins, but in general discussions and emails, etc) which I assume is widespread. Once the company has more than about two dozen staff, you need to start using the middle initial, where there is one. Beyond about 60 staff, even that doesn't work.

To a mathematician in possession of stats about names, I suppose it is another form of the Birthday Paradox. Same problem, messier calculation, but a very similar answer.

Home Office asylum AI flunks one in five accuracy checks

Re: sensitive information going to azure

I'm sure that HMG have paid extra for the contract that promises not to train on the data and promises to adhere to UK privacy laws even where they conflict with US laws.

Rust upstart reveals 'reimplementation' of Microsoft Office – with Claude on coding duty

Re: Does this not highlight a problem....

" But will this vibe coding by experienced coders not kill these massive software houses? "

Not yet, but if Claude and friends ever live up to the hype, surely *their owners* will use them to wipe every other software house off the map? Why would they (instead) make the option available to rivals?

Too many quantum startups, too little money to keep them alive

Re: Quantomb

I dunno. Forget the "quantum" bit. Surely it is the nature of startups in almost any field that fewer than half of them survive. Gartner is basically saying "water is wet" here.

Ukrainian drone attack takes out Russian datacenter

Re: Yandex has another problem

I don't normally agree with Mr Eel, but it strikes me as perfectly believable that China could supply the CPUs for a rebuild. (If Yandex can't recompile their code for the new architecture then that's a separate problem.)

I think the real reason it won't be rebuilt is that the Russian economy is dead unless you are making weapons (and running on fumes if you are). It seems to me that both sides are now at the point where they are wholly reliant on the deep pockets of their allies to get the population through this winter.

Re: “the source of the drone attack”

Well if a long-serving BOFH had just screwed up big time then destroying the entire data centre to cover their tracks probably makes sense.

I bet nobody described the arrangement as *single-vendor* multi-region cloud when they were talking up the resilience of this arrangement prior to everyone signing on the dotted line.

Security researcher claims to they found KVM guest-host escape flaw

Vercel may not have the kind of pockets to pay more. On the other hand, Google and AWS do. They ought to be queuing up now to boost that payout and prolong the non-disclosure period to give everyone time to fix it.

I won't be holding my breath, though.

KPMG tells staff facing the axe: Here's £100, now zip it

Re: Asking for trouble

It is immensely stupid from a PR standpoint, since presumably everyone has been offered the same shitty terms and so everyone has to accept the £100 or else those terms will become public.

Denmark's ID register spills more people's details than the country has residents

Re: It's not complicated

You are assuming that people have only one position on that plane (but see the 2S, above) and that it is only a plane (and I'm not sure people are even that simple).

Re: It's not complicated

Since the object of adding more letters to LGBTQ+ (and the object of adding the plus) is to keep it inclusive of "everyone except ...", we should probably just come up with a word for the excluded group and put "non-" in front of it.

Unfortunately, I am unable to come up with such a word that won't offend somebody, so perhaps it is simply impossible.

Still, you probably get points for trying, particularly since your point was to highlight how the CPR fails to try.

Microsoft extends the Outlook naughty step with two more file types

Re: Back in the day, we needed to transmit executable files through e-mail...

The risk is not just that some dumb email client will autotune these attachments as part of some "preview" feature. The risk is that some dumb end-user will manually run them once they've arrived.

That's harder to prevent without simply filtering such attachments out of existence during transmission/reception, which is what I understand to be the Outlook behaviour described in the article.

Even then, the "workaround" for the bad guys is simply to put the payload on the web and email a URL. You can't fix Stupid.

Leaked IPO docs: Anthropic tempts investors with existential risk warning

I'm fed up too, but the thing that needs the switch is The World, not The Register.

BOFH: The Helldesk opens its third eye and ascends to a higher plane of troubleshooting

No-one is that ignorant naturally. You have to work at it.

AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom

Re: ALL the major coding agents?

These are people who can't stop their creations from hacking competitors websites or committing genocide. It is not at all surprising that AI opens you up to more attacks than IE6 with default "security" settings.

USA’s Venezuela takeover comes with bonus exposure to Chinese AI surveillance tech

I think it was slightly tongue in cheek, but I don't keep up with the latest from Agent Orange and the Canadians this week were cosying up to those horrid Europeans so who knows what US policy is right now?

Re: Re:colonial era UK, Spain and Portugal

And Belgium and Italy and Russia and Germany and, er, the USA. Colonialism was just what rich countries did in the late 19th and early 20th centuries.

KDE turns 30 and someone's brought an AI-native desktop proposal

What I want from a desktop...

... is to be able to walk up to someone else's computer and still be able to use it. A desktop that deliberately customises itself for each individual user is pretty much the polar opposite of "usable" in my view.

Admins, you've been warned: The clock is ticking on Edge's IE Mode

But I thought the world was going to end in 2030?

Why bother fixing our buggy websites if only a genocidal AI is going to be able to use them?

Ex-FTC boss Khan urges Uncle Sam to break out the handcuffs for AI CEOs, citing 1934 precedent

Re: I’m just happy

We all are, but some of us were hoping the journey might last a few decades and be enjoyable.

BOFH: Oh no! The CMS ate 500 pages of corporate documentation

I think you'll find that the lack of such a mechanism was deliberate and regarded as a feature by the Muppets who laid down the original spec.

There is, of course, only a thin line (if any) between "an idiot can use it" and "only an idiot can use it". Good interface designers know the difference.

Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script

Re: Something tells me this will only get worse ... much, much worse...

It's only automating something that people have been doing for several decades now. And they've been automating much of the process for years before LLMs came along, so it's even less of a change than it appears.

It's kinda funny that US citizens are paying most of the bill for this (since the big players are still not charging the actual costs for tokens) and kinda funny that the much-touted guardrails are equally ineffective at protecting bad guys as good guys, but it's a quantitative change rather than a qualitative one.

Rogue OpenAI agents used dead German web site to communicate in May, months before Hugging Face incident

Not the entire internet

My guess is that no US websites will be "accidentally" hacked apart from other AI companies that also need the publicity, like the recently-sold-for-a-tidy-sum Hugging face.

Unless of course OpenAI actually screw up, in which case they'll be taken to the cleaners in a (US) court.

Nvidia buys Hugging Face for $12.9B, promises not to squeeze too hard

Re: AI foly

I don't buy that theory. A centralised AI can make more efficient use of it's GPUs because it can run flat-out 24/7. If, instead, people all start running local models, that's a less efficient use of hardware and so nVidia need to sell more GPUs to deliver the same AI usage.

So if nVidia expect the bubble to continue then they should favour Hugging face. If instead they expect it to burst, they shouldn't be tossing another few billion onto the bonfire.

CISA: Most exploited vulnerabilities should have been eradicated decades ago

No silver bullet

If the top two bad patterns together account for only one sixth of vulnerabilities, what that tells me is that the situation is complicated and diverse.

Green Party wants to slam the brakes on UK datacenter construction until water and energy use are sorted

Re: Disingenuous

Also, why can't the data centres be built in the parts of the UK where there is plenty of water and renewable power?

LibreOffice 26.8 is out – local first, and with no AI

Re: "Professional Typography"?

Agreed, and on their own press release too?

Microsoft lets you swap New Outlook's looks with the face of Outlook Classic

Re: Worthless without PST's or conversion utility

If you, or a friend, set up an IMAP server then you can copy all the emails in your psts to that and it is usable with any email client.

It's definitely a non-trivial undertaking for the average user, but it is also definitely a long term solution. IMAP isn't going away.

Microsoft gives Task Manager another task: Watching AI workloads

Re: The Fat man cometh

Don't give them ideas!

Almost nobody pays attention to web standards anymore

Re: Errors and warnings? Who cares

Would they feel the same way if they didn't get paid?

Probably not. As others have pointed out, it is utterly trivial to find many of these errors prior to going live on the site, so the blame presumably rests with the people paying for this crud.

Re: Missing a lot of points

"I'm talking not of the 100,000 developers that write HTML, but the 1,000,000,000 users that consume it."

Do any of the 100,000 actually ever look at their own pages? If so, a browser that said "no" would be extremely useful, in the same way that almost any other "developer" finds it useful that their compiler emits syntax errors rather than just quietly making up shit in the object code.

Linux 7.2 debuts, Linus Torvalds says ‘new normal’ means he had to do it now ... or never?

Re: People Can’t Memorize Computer Industry Acronyms

To be fair, the official expansion is just a word salad. The joke definition is much more memorable.

Be a hater all you want, AI's here to stay

Re: Are you sure about that?

"and I think we've probably already hit the limit of what it can practically do, reliably, safely, and effectively"

Certainly. The big players have run out of training material on the Internet. They're digitising old books and trying to persuade businesses to give them old company documents. This is the realm of diminishing returns. (There won't, for example, be anything to learn about software engineering from such sources. The relevant training fodder there is all online and surely mostly already digested.)

Without a breakthrough in algorithms, next year's AI is unlikely to be much better than this year's.

421 bugs in Microsoft's Patch Tuesday release, and the Norks have already attacked one

Re: In a surprise move...

That would make Windows a nuclear-armed OS !!

That can't possibly end well.

The AI bubble is already popping; we just don't know it yet

Re: All I want...

Jensen will be fine. His wealth is in cash, based on physical products that have already been sold.

Altman's wealth is based on promises that he'll have a really great product one day, if only you give him enough cash today. Despite that, there's a good chance he'll be fine too because an IPO effectively passes the risk onto your pension fund and let's him cash out.

Re: The AI bubble is already popping

Have you visited the "third world" recently? A hell of a lot if people there are now better off than the working classes in the "first world". The terminology reflects the state of the world about half a century ago and quite a lot has changed since then, not least the disappearance of the "second world".

Comment in code read 'Dear future me, sorry I wrote this'

Fine. I'll just take that production system offline and do whatever it takes to figure out the bug. You can set up another system if you want to keep production going.

What I cannot do, and what no-one can do, is fix a bug that does not happen on a system that I'm allowed to touch.

Oh, and it absolutely is the job of the tester to produce a repro case, since otherwise their reports are just hearsay.

Dev: But you won't let me put debug code on production servers, so either you come up with a repro case that fails on my machine or you stop whining about it.

Re: Heisenbug

I think Schröding-bug would have been a better name, but it just isn't what popular culture chose. In that sense, it is similar to the use of the phrase "quantum leap" to describe a big change, when a QL is in fact the smallest possible change permitted by the Laws of Nature. It's annoying to those of us who know, but on balance it is probably for the best that everyone isn't forced to learn quantum theory before being allowed to enter adult society.

Millions of California-bought cars can be hijacked via Bluetooth

Re: Yech

So why did I never hear it when I was growing up?

Year-long Russian attacks infect users as soon as they look at an email

"Also, the agencies recommend minimizing employees’ use of the ZCS webmail client until their organizations update to a patched version that is not vulnerable to CVE-2025-66376."

Since the patch exists, it is presumably the same organisation that hasn't updated anything which is being invited to minimise use of the client.

I can't see this happening.

Astronomers spot exomoon candidate that's almost as massive as Jupiter

If only we'd decided to define words like star and planet in terms of what they are rather than where they are. Oh well, maybe the next species to come along will get this right.

The truth nobody wants to admit: Chinese or not, open models are competitive now

Re: There is a horrible 'through American eyes' view in this article

I think the argument is that the AI companies didn't pay for the books (or other content).

China advances plans for national single-stack IPv6 network, and its own surveillance-friendly version of the protocol

Re: Fuck 'em

If so, that's very careless of them, but it isn't my problem.

AI's cheatin' heart will make you weep

How is this different from what most people do?

UK's seventh prime minister in a decade says he'll ditch digital ID scheme

Re: My problem with Digital ID...

Exactly. Describing this as a Single Point of Failure understates the risk, since (to the bad guys, like Putin and Pooh) it is a single target.

But let's play with some numbers. Assuming a UK population of 10^8, you need pretty astonishing levels of reliability in that 1 system to avoid unacceptable risks of people suddenly finding themselves declared non-persons by all branches of officialdom simultaneously. Whereas ... if you keep several forms of ID separate at the implementation level (in the way that driving licences, passports, NHS stuff, increasingly /aren't/) then fairly achievable levels of reliability in each system make the odds of a simultaneous failure of all of them (for the same victim) almost inconceivable.

We know the systems will fail. How hard is it for a victim to recover when they do?

EU lets wearables wriggle out of user-replaceable battery rules

Re: Future proof?

Easy solution: Stop calling it a battery. Call it a very large capacitor or something.

Re: To be fair...

"Payment apps should rightly refuse to run on a non-standard device that could be running anything."

Plenty of pretty important financial transactions can be done on most banks' websites, using a browser built by an end-user and running on an OS built by an end-user.

Law firm insisted on one password to rule them all

Re: Law Firm Logic

Not if I'm on the jury, it doesn't!