Posts by Androgynous Cupboard

Nuisance caller fined a quarter of a million pounds by the ICO

I'm a bit rusty on my corporate law, but I think a director is only personally liable if they have defrauded the company or done similar un-directorial acts. Receiving an "unexpected" quarter-million pound bill would shut a lot of small companies, and they would leave a lot of debt.

Whatever assets remain, you an be sure HMRC will get first dibs on them, and they do have a right to go after assets transferred away from the company to directors, shareholders or to linked companies/individuals immediately before insolvency too.

I'm not sure how much of this process will be part of the public record.

Re: Lovely, lovely publically available information.

You can be banned from being a director if the Insolvency Service deems you unfit. There's even a form for reporting such an individual.

Again, a suitably motivated journalist might get some mileage from asking the ICO if they have been arsed to make such a report. I'd be interested to hear the answer.

I had a similar situation a few years ago, when I found my name and address listed in 118800 (another grubby bottom feeder, long since shut down). They'd bought my details from a middleman, Data Media And Research, a subsidiary of known all round good-guys The Daily Mail Group, who had got them from an online car insurance quote company - quotelinedirect.co.uk in this case.

Naturally they were adamant I had checked the "please email me bullshit offers" box, whereas I was sure I had not. Either way, if you've ever applied for insurance online there's a good chance that's where it came from.

A data protection letter is cheap to send and the response might make for interesting reading.

Lovely, lovely publically available information.

Just out of curiousity, I've done a bit of basic digging on this one. The director for the last two years until the time of liquidation was "Hassim Iqbal" - the company went into liquidation on 15 March. A man with the same name and birthdate (born March 1983) and the same service address is a director of three companies, none of which are in liquidation:

Pension Shield Ltd

HS2 Medicals Ltd

Aviya Group Ltd

Pension shield has a website. A quick google shows that they have done this sort of thing before, and presumably will continue to do so.

HS2 Medicals is wholly owned by Hayes Medicals, a medical claims company, who are at the same address as Pension Shield. They're on Linked In, and apparently work "closely with solicitors" on medical injury claims. Hayes Medicals was bought in 2012 by Aviya Group. I imagine a suitably motivated journalist would be able to ask some interesting questions of one of the Solicitors they work with about their connection.

Aviya Group have Mr Iqbal as a director, but not a shareholder. However they're clearly in the same line of business: here is a job advert posted by them for a familiar sounding role.

What a grubby little nest of vipers.

Compression tool 7-Zip pwned, pain flows to top security, software tools

Re: so....

Another option on UNIX systems is to use tar and xz.

Ubuntu kernel patches land

"don't we all just love ALSA?"

Ever tried to get PulseAudio working on a headless machine?

Database man flown to Hong Kong to install forgotten patch spends week in pub

@boltar

Currently the votes on your comment are 9 to 5. Coincidence? I think not.

Google AI gains access to 1.2m confidential NHS patient records

Re: This has health privacy implications far beyond just the affected patients...

Really? I have news for you. You ought to *really* examine US law, and you'll find that there are no real barriers for any random agency to get hold of that data once Google las gotten its hands on it

Before you go off the deep end, try actually reading the agreement from the original article.

Data will not be transferred outside the EEA. The NSA do not have free access to european data centres. If you believe that they do, then the data would be unsafe regardless of whether it was google or not.

Way, way too much hyperbole in these comments.

Re: This has health privacy implications far beyond just the affected patients...

Jeez, you people. At risk of sounding out-of-step with the groupthink here I'm not sure I see the problem.

First, what difference does it make if the researchers are British or not? Second, provided the safeguards on the data are adhered to, then all the big-brother-doom-and-gloom scenarios in the comments just don't happen. The fact Aunty Mabel has a fondness for heroin is not going to wind up in a search engine, because there are specific contractual safeguards on the data to prevent this. If the safeguards are adhered to, it's fine.

If they're not, then there's a data leak then heads will be on spikes, and I will personally help put them there. But that would apply to any firm with any private data for any one of the hundred NHS projects that are running, not just this one. And there's no particular reason to believe it will happen.

There is a lot of data. Properly processed it may help diagnosis, which will keep people alive. This is a good thing. The NHS doesn't have the expertise for this in house so hires in outside consultants with expertise in managing large datasets. This is OK, provided the data is properly safeguarded. You might well object to your data being used like this, fine, but I don't see why this project gets your hackles up any more than any other.

If this article were rewritten with Fujitsu or HP instead of Google, would there be as much outrage? I doubt it. If anything Google are less likely to run five times over budget and not finish the job, which is what you'd expect from a normal NHS IT project.

Colander-wearing Irishman denied driver's licence in Pastafarian slapdown

Shurely he should point out that the ultra-orthodox pastafarians believe the holy colander(*) is only to be worn at home?

* works on many levels.

(edit @kryptonaut: snap)

Quite right too. Everyone knows Saturday is the only acceptable day for a religious holiday. Or maybe it's Sunday? I'm not sure if I'm honest, but whatever it is I am certain that Friday is completely unacceptable.

Ad-blocker blocking websites face legal peril at hands of privacy bods

Re: This FF22 guy/gal

Tell you what Alexander, as you are clearly very busy and important., I'll save you the effort and quote this for you:

"(22) The prohibition of storage of communications and the related traffic data by persons other than the users or without their consent is not intended to prohibit any automatic, intermediate and transient storage of this information in so far as this takes place for the sole purpose of carrying out the transmission in the electronic communications network and provided that the information is not stored for any period longer than is necessary for the transmission and for traffic management purposes, and that during the period of storage the confidentiality remains guaranteed. Where this is necessary for making more efficient the onward transmission of any publicly accessible information to other recipients of the service upon their request, this Directive should not prevent such information from being further stored, provided that this information would in any case be accessible to the public without restriction and that any data referring to the individual subscribers or users requesting such information are erased."

I presume this is the definition of storage you refer to?

Perhaps you could share some of your wisdom with us on paragraph 25?

(25) However, such devices, for instance so-called "cookies", can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose.

Maybe I just can't be arsed again, but it looks like that could apply to JS used to "analyse the effectiveness [,..] of advertising", and that allowance is specifically made for "website content may still be made conditional on the well-informed acceptance of a cookie or similar device".

Asking the user to remove an ad block is asking for consent to show ads, wouldn't you agree?

If I understand your argument, you say the storage of the script which asks the user to remove add blocking itself requires consent? But surely asking for any form of consent requires a script, which requires storage, which requires consent? I refer you to my reductio ad absurdum argument above.

If you could spare a minute to enlighten us hoi polloi further that would certainly further the conversation, don't you think?

Re: This FF22 guy/gal

Given this topic is now four days old, and that the same point has been made several times already, perhaps you would consider sharing with us great unwashed the benefit of your many years of experience on this topic, and provide us with links to some of these answers you cite?

After all this is your area of expertise, and they are fairly central to your argument. You probably have them to hand, as no doubt you will need to cite them as part of your impending challenges.

Until then you are very welcome, and I anticipate once again basking in the warm glow of your haughty response.

Re: This FF22 guy/gal

I'm not sure that's fair actually. Regardless of personal distaste for online advertising, I think his point is sound.

The letter states that "storing of information of gaining of access to information already stored is [..]. allowed if the user has given his or her consent".

FF22 is making the point that if you consider the caching of the ad-detection script to be "storage", and therefore requiring consent, then logically this requirement would then apply to everything in the cache.

Visit a page that loads an image? The image is stored in the cache, so you have to give consent. And so on for every resource on the page, including the HTML itself. I'm no great fan of advertising online, and run an ad-blocker for most sites, but I have to agree with this assessment.

Whether it's true or not will hinge on two things.

First, the definition of storage as it is used in the directive. This is not simply a matter of quoting a dictionary definition: there must be exemptions for temporary storage required to facilitate the transaction, otherwise your SMTP server would not be able to accept your mail for further transmission, for example. I think the browser cache would fall into the same category.

Second, the definition of consent. Perhaps you could argue that by typing a URL in your browser you have given informed consent to the display of that page and the resources you would reasonably assume to be a part of that page - stylesheets, images and so on. From there it's not a great stretch to argue that a script which checks whether the adverts are displayed properly is reasonably part of a website that depends on ad revenue.

In short, if you assume Hanff is correct that explicit consent is required and applies to all storage, then it's reductio ad absurdum to the point where your browser is unable to function. I have no doubt he will take this to court and I'll be intersted in the result, but I think it's not as cut and dried as he makes out.

Ubuntu 16.04 LTS arrives today complete with forbidden ZFS

Does btrfs still decide the disk if full when it's not?. And then continue to maintain it's full after you delete some files?

Honestly, having tried both btrfs (and run into this problem) and zfs, there is just no comparison. There's a reason people rave about it.

Re: Priorities?

> It looks to me many complains about systemd is from people who wish to manage

> systems as if it was still 1970 and nothing changed in the past forty years.

The complaints are from people who didn't think the old system was that broken, and question the need to throw it out for a new and relatively untested system, designed by a guy who has a track record of designing for quite a narrow segment of the Linux market, of not listening to criticism, and failing to fix bugs. Having tried, and failed to get pulseaudio working properly on numerous headless boxes I have run into enough incorrect or incomplete documentation that I distrust his approach and dislike his hubris. Especially for an init system.

NZ Pastafarians joined in noodly wedlock

Re: >something to tell the grandchildren

> Instead opting for a promise to salt the pasta water. That seems... sad

I disagree. Salting the water is very important, and people do forget over time.

NZ hotel bans cyclists' Lycra-clad loins

Re: @x 7

At risk of dragging this one out, you've missed an important half of the point I'm trying to make.

If sitting still on the bike at the lights and trundling forward in traffic it goes green was a zero-risk option, I would agree with you. But it is demonstrably not. Cyclists are at risk at lights, this is a statisticlly undeniable and self-evident truth for anyone that has ever ridden a bike once in heavy traffic. They're at risk because

* they're slower to accelerate than the vehicles around them

* they have less rubber in contact with the ground, making them more sensitive to surface conditions (manhole covers, drainage grills etc)

* because they wobble at low speeds due to, you know, the laws of physics

* because god didn't see fit to bless us with crumple zones

* because traffic lights are a great place for drivers to catch up on their texting or breakfast

* and because plenty of otherwise decent folk seem to think that cyclists are vermin and all should answer for the sins of the few. "lycra-clad lunatic", very good pompous git, thank you for underlining my point.

It's all about reducing risk. On a bike, rolling slowly through a red to turn left (to repeat, after a careful look, a feat which I have to tell you is not actually impossible), my carefully considered judgement is that it raises the risk to no-one and reduces the risk to me. If that makes me self-obsessed, I can live with that.

Re: @Commswonk

And incidentally, there are some (not many) pavements in London which are dual use for cyclists and pedestrians. Here's one on Chelsea Embankment (zoom in on the blue sign). Again, this is not a license for cyclists to behave like dickheads, and nor is it a license for pedestrians to "swing a big stick" or push it in their spokes (that last one @x 7).

As always it comes down to the golden rule: don't be a dick. Play nicely with others, and don't assume they will play nicely with you.

@x 7

> you dickhead

Care to expand on exactly why you think this? Did you note that I ensure no-one else is put at risk before doing so? So what exactly is the nature of my dickheadary: that I am prioritising my safety over the law? Does flouting the law make me a dickhead regardless of circumstance? Would your opinion still apply if I was cycling in paris?

Re: @Commswonk

> It is also worth remembering that London cyclists* have a fearsome

> reputation for scattering pedestrians by "furious cycling" on pavements,

> which is quite simply against the law in the first place. Oh and ignoring red lights...

Meh. I drive a car, ride a motorbike and ride a pushbike. Every day I see others doing one of these things who are acting like dicks, for some reason or another. But I don't wax on about "car drivers" as a group doing this or motorcyclists as a group doing that. Maybe the clue is in the numbers - 2% of journeys by cycle, it's just a small enough segment that cyclists can be classified as "them" by the rest of the population.

In 20 years of riding in London I would say I see cyclists on pavements rarely. It's rare because it's inherently slower - if you are commuting from A to B then the pavement is the slowest place to be. Sure, it happens, but it's the exception rather than the rule, and as I said there are dicks on all forms of transport.

As for jumping red lights - absoutely, if the situation calls for it and it can be done without endangering anyone. My primary goal whenever I get on two wheels is to get to where I'm going alive. If that means clearing the lights before everyone starts to accelerate around me, or when they pull 5m ahead then hard turn left, then damn right I'll do it. Note this is a "look, ensure it's clear then go", not a "plow wildly through a pedestrian crossing" type of light running. Yes, again, that happens, and I refer you to my above comment about dicks.

US congresscritter's iPhone hacked (with, er, the cell networks' help)

Re: At least

> there's quite a bit of neat kit on the market that allows anyone with some technical abilities to hijack your Wi-Fi connections.

Reference please, to something that will hijack WPA2-AES not WEP.

Go nuts, brother: Ubuntu 16.04 beta – no more auto data-spaffing

Re: It's the server version that got my attention

LXC is the bees knees - we switched from KVM a while back, they're noticably lighter on the server. Can't speak for LXD, I gather it's largely polish for LXC but the underlying tech is great. As is ZFS, of course. Couldn't give a rats about the desktop and I agree it's a shame the server-side aspects where dismissed with a handwave in this article.

Whatever happened to ... Nest?

Re: Positive Input Ventliation (was Software will eat everything... sometimes)

Thanks for the tip, very timely. Looks interesting, with caveats: http://projects.bre.co.uk/positivevent/

Hands on with the BBC's Micro:Bit computer. You know, for kids

It's a syntax error, not a peanut allergy. And what's wrong with a gentle introduction, exactly? You don't teach kids to swim by throwing them in the deep end.

Infosec bods pop mobile money crypto by 'sniffing' e-mag radiation

Wow

This is potentially very significant.

EC is pretty much the standard for new cryptosystems designed with mobile in mind, due to shorter key lengths and less computation when compared to RSA. For instance, the Austrian (and I think German) ID card schemes are build on EC - this stuff is now baked in at a very deep level. I realise these attacks are against software-based implementations, but the fact they they're done with relatively cheap hardware (impressive), against EC on relatively recent mobile devices is, I think, quite a big deal.

It's been years and we're all still running crappy, outdated crypto in our browsers - well imagine how long it's going to take to upgrade mobile infrastructure. There are hardware implementations of ECDH and ECDSA too, a successful TEMPEST attack against those would be huge.

'Just give me any old date and I'll make it work' ... said the VB script to the coder

Re: Effing 'Merikans

ISO8601 or GTFO

7,800 people's biometric data held on police anti-terrorism database

Irony Detector overload alert

> As a law-abiding, non-paranoid individual, I have nothing to fear.

Hmm, what's that phrase.... ah yes. Wake Up Sheeple!

Java evangelist leaves Oracle to save Java

Re: a platform for easy to deploy cross platform applications

Bless. Docker and LXC are a way of compartmentalising software run on Linux. Java is a programming language. But well done for trying.

Yelp-for-people app Peeple is back – so we rated Julia, its cofounder

UK libel law

Many years back I ran a website that libelled a very large number of organisations (a recruitment consultant review site). Fun as it was, it got a bit hot and I let it lapse, but the legal advice I got at the time was that in order for it to be libel it has to be

1. untrue

2. published and communicated to a third party (i.e. someone other than you)

3. Must be defamatory - that is they must refer to them directly, and cause damage to their reputation amongst their peers.

In your defence you can argue one of those points, or you can argue it was "fair comment" (as in it''s an oipinion based on true facts made in good faith and without malice, and is in the public interest).

In the UK at least, the law that covers this is the Defamation Act 1996, and a notable judgement was Godfrey v Demon, which found Demon liable for a libellous comment from a third party. The key points were a) if notified of a libellous comment you must remove it, and, as I recall, b) if repeated libel is occurring and you are notified about it, you should take some steps to prevent this happening.

I'm not a lawyer but that was the advice I got from someone who was. I would expect Peeple (missing an "i" there) to be on the sharp end of most of these points fairly shortly.

Given the three pillars of the internet are spam, pornography and abuse, it was only a matter of time before someone tried to commoditise the last one.

'Boss, I've got a bug fix: Nuke the whole thing from orbit, rewrite it all'

Re: Well, this article'll cause some arguments, eh?

It's not elegant. It's appalling. You're welcome to disagree but I offer as exhibit A, the recent round of disastrous bugs in OpenSSL. Bugs emanating from the original designers, by the way, not some poor sap newbie who came along later and tried to maintain it.

First rule of engineering is you are not as clever as you think you are. Follow the principle of least surprise. Use constructs and terminology that others can follow. Be methodical to a fault. The only way to reduce the complexity of a system is to black-box its components, and the only way to do that is to make them predictable. These examples fail on every one of those points.

Oh, and personally I would have "assembly man" put against the wall and shot. Then I would shoot his kids, just to make sure it didn't happen again. But that's just me.

One-third of all HTTPS websites open to DROWN attack

Re: Meanwhile on OS X

Macports? Hello, 2005. Try http://brew.sh, it's a much cleaner approach.

We suck at backups. So let's not have a single point of failure any more

Hmm

While much of this conversation is beyond my pay grade, in my experience things are given write access precisely because configuring them to run with read-only access is the complicated bit. The presumption being that the system is secure, so run it as root and save yourself the bother.

Intravenous hangover clinics don't work, could land you in hospital

I've said it before, but...

if you're sober enough to remember to drink a pint of water, chances are you don't need it.

Raspberry Pi 3 to sport Wi-Fi, Bluetooth LE – first photos emerge

Re: Bluetooth YAAAAY [golf clap]

Absolutely agree. Bluetooth is the single worst aspect of using Linux - well, modern Linux anyway back in the day it was all like that. Anyway, it's a shambles - lots of undocumented examples pressed into service as system utilities, and an incompatible and incomplete version 2 which never managed to replace version 1 entirely. A proper BT userspace suite would get my vote for Google SoC.

Brit brewer opensources entire recipe archive

Worth a read if you're a beer snob

https://www.brewdog.com/lowdown/blog/nailing-our-colours-to-the-motherfucking-mast

Those guys are alright.

'I bet Russian hackers weren't expecting their target to suck so epically hard as this'

To encode these bits, the engineer decided to bitwise OR the destination byte with 2 raised to a particular power representing the bit position. "Bad approach, I know"

It's only a bad approach because there is no "to the power of" operator in C. Otherwise it's fine I think - I would expect a decent compiler in any language would treat "2**3" and "1<<3" as identical (when 2 was a numerical constant)

Feds spank Asus with 20-year audit probe for router security blunder

> The free market would have fixed this

There is one, and it didn't.

What would happen if Earth fell into a black hole?

Well you've got this headline, or his scary views to choose from. Although this one really takes the biscuit.

I did quite enjoy some of his articles here, although I didn't always agree with them. I have said that before. But he's still a certifiable, misanthropic loon.

Patch ASAP: Tons of Linux apps can be hijacked by evil DNS servers, man-in-the-middle miscreants

Re: ASN.1

I think you'll find the "A" stands for "Awful", although after writing our own ASN.1 toolset I believe they missed a trick and it should really be "AAASN.1". A classic example of design by committee.

"the only binary wire format with constraint checking" is a bit rich - you could gzip an XML file and that would meet that description, and the constraints specification and checking you describe goes rapidly out the window in the real world, where there are dozens of ill-conceived OIDs that partially overlap. If you want your software to work, you'd better accept all of them.

It has legacy uses and is pretty firmly entrenched with any public-key based stuff, but I would never adopt if for a new design.

Good thing this dev quit. I'd have fired him. Out of a cannon. Into the sun

Always use braces isn't rhetoric, it's probably the number one rule in any coding standard worth its salt. And unecessary () aren't always bad option either. I think everyone knows the precedence of * and +, but with || and && I'd always use () for grouping.

Re: thermonuclear FORTRAN

My first job out of university was an insurance broking system originally written in basic that had been automatically converted to C. Lots of fun stuff: I remember methods like b_streq(string1, string2) where 0 meant the strings were equal. Dozens of source files, each with a two or three methods several thousand lines long peppered with code like "goto b_2405" for flow control. Oh, and every variable was global, including loop counters, which meant every change had to be analyzed to see if the value of the variable was used later in the code without being reset.

I don't recall if comments were included in the conversion, but I doubt they would have helped. Sadly I don't have any code from those days, otherwise I'd be submitting it.

This is why copy'n'paste should be banned from developers' IDEs

man true.

Comrade, the FSF would prefer you run "info true". It's quite easy, there is some documentation on how to use it. Just type "info info".

Don't you see these simple facts? Destroy Facebook and restore human Liberty

That's it?!?!?

It has punctuation and capital letters, not too many and not too few. No swearing. No questioning of the authors parentage, species, sexual orientation or inadequacies , or of the their mothers.

Frankly that's a miserable effort. 1/10 and only because "sick" is repeated five times.

It's 2016 and a font file can own your computer

Re: How did this ever become a problem in the first place?

TrueType fonts are normally just "a bunch of vectors" but can also contain a whole program. This isn't very common: it's normally use for hinting, and nobody bothers with hinting, but we have a few fonts that use this table to shape the glyphs. Which is ****ing annoying.

Spec is at https://www.microsoft.com/typography/otspec/ttinst.htm, here's a snippet of example code:

PUSHB[3] 23 17 1 /* PUSH : jump1, jump2, rast. version flag */

GETINFO /* get the rasterizer version */

DUP

PUSHB[1] 34

LTEQ

ROLL

SWAP

JROT /* we are at MS rasterizer version 1.7 or higher (> 34) */

PUSHB[1]

As you can see there's a lot of room here for poor bounds checking to do some damage. I didn't read their bug report and I've no idea if the fault they found is in this section, but knowing the spec, I can't see where else it would be.

(We've written our own TrueType font parser due to the holes in the one supplied with the JVM)

(edit: El Reg, a newline at the end of the line means one line break, not two! Sort your editor out. No, not Andrew, the text editor)

Now you can easily see if a site's HTTP headers are insecure, beams dev

Re: Oh heck

I'll do the work for you! Just let me know which site you maintain and where the dangerous bits are. It's no trouble.

Sena's multi-action camera monster, or Cardo's PackTalk club rider juggernaut?

Re: NFC tag

@ Gene

Details please! Which tag, which app?

Sainsbury's Bank web pages stuck on crappy 20th century crypto

Re: Prosecution required.

If I were a man of dubious character with an account there, I would be attempting to hack my own account by breaking the ciphers. Transfer money away to another account, sue Sainsbury's for letting it happen, get twice value of the transaction plus inevitably successful damages.

Of course I am not that sort of man, nor am I foolish enough to bank with them.

Eight budget-friendly 1TB SSD data packers for real people

Failure? Oh yes.

Intel 600GB 320 Series. Back when it was very, very expensive. It failed under warranty after a few months, I returned it but when I tried to order a replacement they were no longer available. I never did get to the bottom of that one, looked like a recall to me but couldn't find anything in the press.

It took the shine off SSDs for me for quite a long time, but not forever. Our primary server boots off SSD, but I have six of them running RAID-Z2 and with a RAID-1 (mirrored) boot partition on each of the six. Try breaking now you ****er!

It's Wikipedia mythbuster time: 8 of the best on your 15th birthday

First look at the BBC coverage of the Scottish independence campaign - it was a propaganda tool of the Tories and other scum who wanted Scotland to remain enslaved.

Call me crazy, but I have this feeling you'd struggle to recognise a neutral position on this topic.