Posts by Mixedbag

EU’s cyber agency blames ransomware as Euro airport check-in chaos continues

Re: Criminalize paying ransom

and then the ransomware groups will contract people to kidnap family members of the board.

Thus turning it into Pay and goto jail or don't pay and bad things will happen to your friends and family

Cloudflare fesses up to config change that borked internet access for all

Re: Screwed up but confessed

Cloudflare never fail to impress with how transparent they are when they screw up and how quickly and well written the post incident report is. Very few other orgs get that this is the way to retain trust.

Stuff is always going to go wrong or changes have unexpected consequences, it how you handle it that matters.

Airbus okays use of ‘Taxibot’ to tow planes to the runway

Presumably it will very soon also get certified to tow from the runway to the stand as well which could double those fuel savings

Windows 11 24H2 hoards 8.63 GB of junk you can't delete

Re: Disk is cheap

Just use a Pure or some other 'modern' enterprise storage that auto dedupes and boom, that issue is gone. Well for primary at least. Probably not for backup.

Though 8Gb of bloat still show how little developers care now about resource efficiency....

The fingerpointing starts as cyber incident at London transport body continues

Pick one

If this is true:

An ICO spokesperson wrote in an email, "Transport for London has made us aware of an incident and we are assessing the information provided."

Then this probably isn't:

there is currently no evidence of customer data being compromised or impact to TfL services.

CrowdStrike file update bricks Windows machines around the world

If anybody is struggling to get hold of the fix here is the CS Alert text:

Tech Alert | Windows crashes related to Falcon Sensor | 2024-07-19

Cloud: US-1EU-1US-2

Published Date: Jul 18, 2024

Summary CrowdStrike is aware of reports of crashes on Windows hosts related to the Falcon Sensor.

Details

Symptoms include hosts experiencing a bugcheck\blue screen error related to the Falcon Sensor.

Current Action

CrowdStrike Engineering has identified a content deployment related to this issue and reverted those changes.

If hosts are still crashing and unable to stay online to receive the Channel File Changes, the following steps can be used to workaround this issue:

Workaround Steps:

Boot Windows into Safe Mode or the Windows Recovery Environment

Navigate to the C:\Windows\System32\drivers\CrowdStrike directory

Locate the file matching “C-00000291*.sys”, and delete it.

Boot the host normally.

Latest Updates

2024-07-19 05:30 AM UTC | Tech Alert Published.

2024-07-19 06:30 AM UTC | Updated and added workaround details.

CAN do attitude: How thieves steal cars using network bus

Re: Why

This is mostly true until your driving a vehicle where the driver is low to the ground, like a triumph spitfire and then every dam car light is at about head height.

Oracle really does owe HPE $3b after Supreme Court snub

Open door

I wonder... Does this open the door for former Oracle on HPE Itanium users to sue Oracle for the cost of having to re-platform?

Admins report Hyper-V and domain controller issues after first Patch Tuesday of 2022

reality

Very few have the time and resources to run a test environment that replicates everything in production.

Many don't have any resources for testing unless it's code their company has created or commissioned.

Sure, you don't deploy to every box at once and you start with the most trivial but those aren't going to be DC's and HyperV hosts so you'd not find the issue in a low pain fashion.

We expect for the sums of money that we are paying to MS that they do a reasonable degree of testing.

In this case, it's clear they didn't. The scenarios that seem to result in the patch's breaking fundamental windows components are not rare edge cases.

Offering Patreon subs in sterling or euros means you can be sued under GDPR, says Court of Appeal

Re: Interesting decision

And that is probably the key point of the finding.

I had to go and check my memory as I thought GDPR was actually broad enough to always apply if the data subject or the data controller was a subject of a signed up country but from the guidance there does also have to be a targeting of the individual that had entitlement to those rights. So an incidental customer/user is fine but if you market to a UK/EU citizen then GDPR absolutely applies.

https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en.

The GDPR applies to:

a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or

a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.

If your company is a small and medium-sized enterprise ('SME') that processes personal data as described above you have to comply with the GDPR. However, if processing personal data isn’t a core part of your business and your activity doesn't create risks for individuals, then some obligations of the GDPR will not apply to you (for example the appointment of a Data Protection Officer ('DPO')). Note that ‘core activities’ should include activities where the processing of data forms an inextricable part of the controller’s or processor’s activities.

Examples

When the regulation applies

Your company is a small, tertiary education company operating online with an establishment based outside the EU. It targets mainly Spanish and Portuguese language universities in the EU. It offers free advice on a number of university courses and students require a username and a password to access your online material. Your company provides the said username and password once the students fill out an enrolment form.

When the regulation does not apply

Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

This won’t hurt a bit, says Veeam, as it flags end of socket-based licensing

Convenience

Let's hope that they have changed their approach to converting to per VM licencing.

They tried to get us to convert about 2 years ago but wanted somewhere in excess of £1000 per socket as a 'convenience fee'

Cisco intros desktop switches, one with USB-C to power your laptop

Re: New product? Hardly.

Indeed, not new. Huawei have had a fibre to the back of the desk device for quite a while

UK Cabinet Office spokesman tells House of Lords: We're not being complacent about impact of SolarWinds hack

This sort of thing is exactly why I pay as much attention to managing outbound access from our systems as inbound.

Good services we work with very readily have the necessary documentation to tell us exactly what domains, IP's and ports need to be made accessible.

Poor ones go 'Why do you restrict access out to the internet? I'll have to go and ask some other team if we know'.

Morrisons tells top court it's not liable for staffer who nicked payroll data of 100,000 employees

Re: Depends if decent efforts at data security made by Morrisons

And if as if oft the case your pay role system does not have an inbuilt function to assess pay rises and create a mail merge to print letter for each employee for their revised remuneration?

And yes printing physical letters for such things is still a requirement, in some cases because of what is written in union arrangement but more commonly because not all of your employees will have an email address or at least not one they wish to share with their employee.

£1bn Brit court digitisation scheme would be great ... if Wi-Fi situation wasn't 'wholly inadequate'

Unfortunately, these things need internet to work

Seeing the way government seems to 'work', the solution to the wifi not working well enough will not be to spend maybe £20,000 per building on getting a well engineered wifi solution but will decide that all the buildings are not suited to working with digital technology.

Therefore they will spend several millions per building knocking it down and building a new one.

Er, we have 670 staff to feed now: UK's ICO fines 100 firms that failed to pay data protection fee

Not sure that its been well publicised

I 'm suspecting that a high number of these are because people simply didn't know they needed to, thinking that GDPR removed the need to do so.

However a new bit of regulation "Data Protection (Charges and Information) Regulations 2018" created a new fee to replace the one lost by the superseeding Data Protection Act 1998.

UK privacy watchdog to fine Facebook 18 mins of profit (£500,000) for Cambridge Analytica

Seems inconsistant

Firstly we have to remember here that the incident occurred prior to GDPR so the requirements and penalty's differ from what they would be today.

Regardless of Facebook's ability to pay, the fine seems too high in comparison to other cases.

TalkTalk caused potential harm to a large number of its customers by failing to implement basic security controls, and failed to act on warnings it had previously been given. In other words it was considered to have been willfully negligent.

Facebook is being fined for not being quite clear enough about what data was being shared with who and being lied to by Cambridge Analytica who said they had deleted the data when Facebook became aware it was being misused but in fact didn't.

So they did tell users what they were letting happen with their information, and they did act when somebody did something incorrect with it. Not willful and not negligent and yet they get fined more than they would have done if they had failed to try and protect the information.

Digital version of Universal Credit still pricey, wobbly, failing to deliver – MPs

Er dont they already have a system they could use

Its not the most friendly in the world but it does seem to work decently well and it's called GovermentGatewayID

works perfectly well and robustly enough for dealing with HMRC and that includes functions where they owe you.

Why are they reinventing the wheel, particularity when that already have a wheel that was designed for the purpose?

Austrian privacy chief handed leash to EU's data protection beast

It's a regulation

The EU has two main types of acts. Regulations and Directives.

Directives are instructions to EU states to create their own legislation that meets the intent of the directive.

Regulations are exactly that and are automatically part of the law in all EU states.

However that does not stop states creating legislation that goes further than an EU regulation and that along with ensuring that we already have rules in place that will cause us to meet Data Protection adequacy requirements when we have left the EU is what the UK government are currently doing.

I expect how they will enforce any fines once we have left the EU is the same way as they will for any other non EU country. They will send a bill and if you don't pay it then any official from the organisation setting foot in the EU will be arrested.

Footie ballsup: Petition kicks off to fix 'geometrically impossible' street signs

Re: Progress

Have you been talking to my wife? She is rather fond of that theory though in our case it's usually the M1 and M62 where they are storing far too many of them.

Raspberry Pi distributor Premier Farnell in £792m Swiss buyout deal

Payment terms

I hope they ensure they pay for it on time in full.

Their accounts department are efficient

Go 1 pence over your payment terms by 1 hour and they wont ship you anything until you've settled up.

Blighty's Parliament prescribed tablets to cope with future votes

2 tablets

Don't all MP's already have an iPad thingy:

http://www.telegraph.co.uk/technology/apple/11493656/All-650-MPs-to-receive-iPad-Air-2-and-laptop-post-election.html

HP mashes up ProLiant, Integrity, BladeSystem, and Moonshot server businesses

somebody was thinking about oracle

"since it rolled out its BladeSystem c6000 chassis back in June 2006"

Last I checked HP had a c3000 and a c7000 chassis

And their made from super dense steel, must be they weigh a ton even when empty.

A 6000 would be a Sun Blade 6000 Chassis.

Dead Steve Jobs' patent war threat to Palm over 'no-hire pact'

Did Steves memos look like this?

Dear Patent protection team. We have a corporate dislike for Samsung. Please trawl our patent database and see what can be twisted to fit. Dont worry about any of that prior art stuff, we have a way to make that disapear.

Regards, S.Jobs

Thank BRIT eggheads for new iMac's sexy seamless knife-edge

sealed forever

I would guess that apple like it because once the iMac is assembled its rendered non maintainable. Cannot see any removable doors or panels, so no adding extra memory and no swapping the hard drive if it fails

RISC OS comes to Raspberry Pi

Cracking. Now how do I extract my old 4th Dimension games off their 1.44 Mb disks

AT&T plan: Let content providers pay your bandwidth bill

It does thought increase the incentive of the application provider to be efficient in terms of data

Steve Jobs' last design: New Apple HQ pics

No Windows

Reminds me of the HQ of the hitch hikers guide to the galaxy. It's all fine until the buildings air and thermal management system fails