* Posts by Lee D

4500 publicly visible posts • joined 14 Feb 2013

Tech support world record? 8.5 seconds from seeing to fixing

Lee D Silver badge

Re: Fastest:

I work in schools and I get this one a lot:

"My mouse is going crazy! I think someone has taken over my computer! It's jumping all over the screen!"

"Remove the decorations you put around the interactive whiteboard."

"Oh."

Especially relevant at Christmas, and have also had the same because teacher was leaning back on their chair and the chair was touching the board.

Lee D Silver badge

"The server's down!" (yes, singular).

I was working consultancy for individual schools and worked 3-6 hours for a different one, often a few a day.

This was an emergency call while I was at a different customer's site. They were increasingly desperate, which is a good time to talk terms. I agreed I'd come and fix whatever the problem was - however long it took - if they paid emergency rates so that I could justify tearing myself away from the other customer I was already with that day. But also that's all I would be doing - fixing that problem.

Asked the customer I was with and they were happy for me to "swap days" (because it would similarly benefit them if anything were to happen, and it was a rare occurrence).

CYCLED over to the other side of town through freezing ice and snow.

Got there and went to where the server was (it was sited in the school office, sitting in a corner, with its screen turned off - this was "normal" for Borough installs that I had inherited at the time).

Turned the monitor on for the server (it was always switched off to "stop people playing with it" - high security!).

"Press Enter to continue boot...." white DOS text on a black screen. Nothing else there.

I pressed Enter. The machine booted. Everything started working.

Apparently it was a BIOS option that the Borough put on their servers - most ridiculous!

So technically the fix was within a few seconds or so of arriving.

But, diligent as I was, I diagnosed further.

I noticed a disconnected fan heater hidden under the office desk just a few metres away, clearly trying to obscure itself under some cardboard. It was hot to the touch, but not plugged in. I put my Poirot detective skills to the test. There was nowhere else to plug it in except near the server.

I gathered the suspects and had my moment:

The office secretary was cold (it was snowing outside). She wanted to plug in a heater. There were no sockets available. So she plugged it into the extension lead (I know, I know, don't go there, it wasn't my setup!) that the server was plugged into. It popped the breaker. The server went off. Rather than admit to this, she unplugged the heater, hid it, and flipped the breaker back on (the breakers popping happened a lot in that school, especially in winter). The power came back on, the server started to boot, but the BIOS option made it wait forever until someone came along and pressed Enter.

For several seconds of fixing, and 5 minutes detective work, I was paid a full day's wage at emergency rates, and was home by 9am.

Another official four-day week pilot kicks off in the UK

Lee D Silver badge

Like universal basic income, working from home, and now the 4-day work week - every single trial ever proves that it's better for everyone once you remove the dumb concerns of outdated employers...

... and nobody ever does bugger-all about it.

Sysadmin shock as Windows Server 2025 installs itself after update labeling error

Lee D Silver badge

Re: First...

It's the perfect way to move people off Windows servers, that's what it is.

Bitwarden switches password manager and SDK to GPL3 after FOSS-iness drama

Lee D Silver badge

Re: No docker needed

Which you have to do manually for every update and their dependencies.

Welcome to 1990 and Slackware packages.

It's dumb compared to an "apt-get" "yum install" or whatever equivalent.

Lee D Silver badge

Vaultwarden appears to suffer heavily from the "We'll just throw everything in Docker" method of package deployment.

I'm going to have to dig through all those "unofficial" repos to generate an deb package or deploy with apt by the look of it.

It seems that in the last decade we have thrown away everything to do with basic package management in favour of absolute overblown nonsense like docker, snap, etc.

UK watchdog hints Voda-Three merger will likely pass

Lee D Silver badge

Re: How about approval only if...

If you want that, you remove their ability to deploy their own masts entirely and make them contribute to a centralised cooperative that manages the masts which they have to fund.

Nationalise the infrastructure, privatise the commercials running on top.

There's no reason for any of these companies to be anything but an MVNO with infrastructure for all being funded by all.

Rather than, say, erect one pole for Three, another for BT, another for EE, etc. in the same locations and then having to have them all enter into sharing agreements and all being unwilling to fund anything further because they're just paying for access to their rival's masts and it's up to the rival to bother to upgrade them.

Combustion engines grind Linus Torvalds' gears

Lee D Silver badge

Re: Refuelling.

When I bought a house, I literally factored this in. I realised that the place I was renting before would NEVER allow me to use an EV - the allocated parking was quite a way from the house, there was no infrastructure to that point and they couldn't even be bothered to run a bulb to the DARKEST alley I've ever had to cross through (in order to get to the house in the first place).

So when I bought a house, even though it had to be the cheapest one I could get, I got one with a driveway, which goes all the way up to the porch, inside which is the main electrical intake and meters, etc.

So I know that I can get an outside charger slapped on the side of the porch and give it a direct feed to the consumer unit.

Because, to be honest, I wouldn't own an EV I couldn't charge at home. I'm sure it's possible. I'm sure some people do it. I'm sure it's just a small inconvenience and some people would judge me for it. But I would absolutely want to park that thing on my own property, plug in to my own electricity, and leave it like that overnight.

I once did the maths and in the town I used to live in there was one public charger for every 8,000 people in the town (not counting visitors, etc.). It was simply not viable to plan on using them. Unless you only get one-eight-thousandth of a turn on one via some kind of timeshare, which means an overnight charge every... 22 years or thereabouts.

I'm sure that will change over time, but you know what? £300 on Amazon, and a couple of hundred to an electrician friend, and I have my own fuel station for an EV. Without that... I simply wouldn't bother with them. To the point that I choose my house using that kind of capability in the future as criteria.

My previous house (before I rented), we have a 32A commando connector on the side of the house installed for something else (an electric kiln). And I sited it where you could run a cable to the front drive. Because even then... I knew eventually we'd need it to charge an EV.

My next car will almost certainly be an EV (I'm skipping hybrids entirely). When my current car dies, that's what I'll get. But most places I've lived, or worked, it simply wouldn't be viable.

Oh, and I haven't seen a single electric car charging point near me, or on my way to work, except a few at a Tesco 20 miles away that almost exclusively are used by their delivery vans to charge / keep refrigerated. My workplace has some... but they are used by the public a lot. And they charge 60p per KWh - twice my home rate. Great to know I wouldn't be "caught out" if I got to work with 0% battery, but otherwise I wouldn't touch them.

Lee D Silver badge

Re: Dumb interviewers

That's what happens when you move from "famous person in a niche field" to "celebrity" and it's when I start to lose interest too.

I don't care what breakfast cereal Johnny Depp eats, I don't care what Benedict Cumberbatch recommends for living room colour, and I couldn't give a toss what Linus recommends for a car (outside the scope of a Linux kernel running inside a car computer system).

Fact is, the media think that that's all we'll be interested in at that point and will actively hunt out this nonsense trying to find something vaguely controversial.

Buzz Aldrin just gave his opinion on who to vote for... and all it's really done is divided opinion on him whereas before I think most people liked him. The last thing you heard about him? Probably that he punched a reporter who claimed he hadn't been to the Moon. That's what they're after, they don't care about anything else now.

They can't fill a 500-word article with Linus' opinion on in-kernel global locks. So few people are interested, and they are often working in highly non-technical arenas so anything they publish would be useless with that kind of thing in it. But they can ask what soap opera he likes, etc. until they find something they can report that their readers will understand. "Tech guy prefers EVs" is a bigger story to them, because they have no idea who he is, what he does, or what any of that means.

And that's why I stopped reading newspapers a LONG time ago, magazines and even "industry" magazines (sorry, but I cannot find a mainstream computer magazine that I enjoy nowadays... I had Readly for over a year so I had them all available to me, and I can't be bothered to read any of them. Gone are the days of my shelves creaking under the weight of all the PC Pro / PC Magazine etc. issues with their highly-technical coverage of new tech, programming, etc.).

And I really couldn't give a damn about anything Elon says because even in the arenas that he's considered an "expert", I think he's actually just waffling and really is as thick as two short planks. I couldn't care less about what any head of Apple says is the next big thing because universally they're salesman, not visionaries or technical people.

But you won't see a quote from an independent qualified surgeon in a newspaper article about a company's bio-medical interface. At least not in full.

And, often, The Reg is just as guilty of this as other places. The only difference is here the real interesting article is often hidden in the comments section.

Apple quietly admits 8GB isn't enough in 2024, M4 iMac to ship with 16GB as standard

Lee D Silver badge

Then there is no sense in dropping thousands on a laptop (especially a Mac) at all.

Lee D Silver badge

I bought a Samsung laptop (which should tell you how old that is, because they stopped making them) back in 2011.

It had more than 8Gb.

I haven't owned a single machine since that had as little as 16Gb.

My current laptop has 64Gb and that was bought maxxed-out on day one and I'd happily have bought more.

As an (old-school, ex-ZX-Spectrum) programmer, gamer (including VR), browser, IT professional, etc. I don't understand how you can not have 32Gb nowadays minimum.

Linus Torvalds affirms expulsion of Russian maintainers

Lee D Silver badge

Re: Approach? What approach?

"The lawyers say I'll go to jail if I don't" is what he's implying.

"Hardly sufficient" doesn't matter one whit when it comes to that. He has no choice.

Fujitsu claims 634-gram 14-inch Core i7 laptop is world's lightest

Lee D Silver badge

I don't want it light. I want it a) not to break, b) not be expensive, c) be powerful, d) have good battery life, e) have a screen I can see and f) actually be available.

We've dropped past the point where we're trying to lug around unreasonably heavy equipment. We passed it 20 years ago.

I want a laptop that I can put in a laptop rucksack and carry it around without dying, and which actually is robust enough to survive a few years of active use being moved around.

Let's stop this ridiculous "put things on the head of a pin" shrinkage and make the thing that's a decent, reasonable size, without undue weight, and which does FAR MORE.

Currently my only personal PC is a 17" (all I could get, I wanted 19") gaming laptop. It's portable. It can run off battery (for hours if I'm only doing casual stuff). It has a ridiculous GPU in it (which helps with the power usage!). It does EVERYTHING I throw at it - video processing, VR, mass compilations, etc. It is small enough to carry around in a backpack, strong enough to survive (metal casing) but big enough to see the damn screen and watch movies on it by preference (I have a projector, but often just the laptop next to the sofa and lying down next to it is more than enough to get the full movie experience in terms of "how much of my vision is taken up by the movie"). It has a full keyboard. It has lots of ports. It has PLENTY of oomph. And there's no real compromise there at all.

Can we stop making things smaller and lighter and start making things actually just do more without having to work out how to fit a battery in the tiniest/lightest/thinnest cases imaginable which will break far more easily?

My next laptop would be a Framework most likely. But they need a 17" or bigger screen option and a choice of GPUs.

Vivaldi gives its browser a buffing, adds a dashboard

Lee D Silver badge

Re: Stop changing things

And, honestly, you could send me back 40 years in terms of UI, to interfaces I haven't used in decades, and I'd be MORE PRODUCTIVE.

That's just insane, but it's true.

Imagine reinventing the way you have to pedal a bike every 5-10 years and then finding out that the original Victorian pedals actually are easier and faster.

Modern UI designers have literally broken the UI and still there is no intention to fix it and everyone is copying them.

Lee D Silver badge

Not the hero we deserve, but the hero we needed.

Lee D Silver badge

Sigh

Is there an option to go back to how it was?

The whole point of Vivaldi was to bring back how Opera used to be, and Opera was so configurable for stuff like this it was amazing.

If you're just going to enforce UI changes on me that I don't want (e.g. Speed Dial which I disabled on day one and have never used), then there's little point in using a different browser.

Floppy discs still run a U.S. metro? Japan steps in with 'project kill floppy'

Lee D Silver badge

It would literally be cheaper to buy / invent / produce some 5.25" compatible drives that use an SD card / hard drive / SSD / network connection for floppy image storage.

I'm surprised that they haven't just done that and bought themselves another 40 years until they start to fail or SD cards etc. are obsolete.

I know you can already get them for 3.5" floppies because even 20-something years ago those were popular for things like MIDI keyboards that needed whatever it is that MIDI keyboards have loaded into them.

Big browsers are about to throw a wrench in your ad-free paradise

Lee D Silver badge

I can quite understand from a browser's point of view that any extension that wants to load into EVERY website, and change content there, is undesirable even if user's installed it.

I totally get that they have advertising revenue to think about too, which is a bit of a conflict.

But I don't get the fuss over this.

If you want to block ads, you need to run a web filter that lives outside of the browser, it's that simple. It's a well-specified, supported configuration in use in millions of businesses around the world, and you can "run it" on your own machine with no dependence on a network or the Internet (literally just run a local proxy that does SSL interception and strips ads, etc. offering a port on localhost, that you put in as a HTTP proxy into your browser). To make it work, you have to authorise the proxy's certificate on your machine to pretend to be ANY site, same as any other SSL interception. And that's still supported by every browser and in use in millions of workplaces and schools every day.

But expecting a simple one-click Chrome extension to have full browsing of everything you do online, and the ability to modify it all silently on the fly... that's not good. And cherrypicking that app X can do that but app Y can't is just problematic for all kinds of reasons (e.g. Kaspersky changing their software underneath users without consent, anti-competition lawsuits from minor players, etc.).

Far better that you just remove the capability entirely and make the user arrange their trusted proxy if that's what they want. It can be as simple as an MSI or app installation on a device and maybe changing one setting.

The browsers are going about things the wrong way here by cherrypicking and blaming other things - they're just blocking known apps that can't prove they're safe, and they should just be blocking the functionality entirely. Even an extension that wants to READ any website (e.g. accessibility) shouldn't be able to modify or block parts of it as easily.

We've reinvented Netscape plugins again, but with only slightly more control, when all ad-blocking can be done as a third-party service running as a trusted web proxy.

Telcos find cloud migrations, security, are a pain in the IaaS

Lee D Silver badge

Sigh

" high-speed and low-latency"

"cloud"

Spot the issue.

Developer pockets $2M in savings from going cloud-free

Lee D Silver badge

Business realises that paying a middleman to do the same job you can do in house is less profitable for you and more profitable for them. Shocking.

Cloud is the most ridiculous over-selling of renting a few remote dedicated servers, and then being charged per API call, in effect.

I'm following a thread on Twitter about web developers who are only now finding out that a $5/month VPS can do what they've been paying an absolute fortune to do. Want redundancy? Buy three of them, from three different providers, in three different continents if you like.

For personal use, I'm chugging along with a £20 a month dedicated server, which I've done for over a decade. It does EVERYTHING. And there are no "usage" charges whatsoever. An unmetered connection. And I can literally go "Oh, a new version of Factorio... let me start up a server for it" and that's all I have to do to run it alongside everything else that's running on that machine. It's everything from my "GMail" to my "Google Drive" to my Plex to my TV etc.

And in work, I find the same. Most place just don't need three-continent-redundant, zero-latency, huge amounts of servers queued ready to go with a thousand containers on each.

If your company is vaguely technically and you've gone to cloud and somehow skipped the part in the middle where you just rent or colo a few decent (£500/month+) servers BEFORE you pay AWS or whoever that same kind of money... it makes me wonder if you really should be doing that at all.

Someone's finally taking on £10M Hull City Council ERP deal to replace Oracle

Lee D Silver badge

Re: Utterly crazy!

No opportunity for backhanders, custom bespoke modifications, consultancy fees, ongoing service charges, long tied-in contracts, failing to deliver 75% of the way through, and then repeated extensions and consultancy for decades to come. Never gonna happen.

The real question is why central government don't just provide the same services to all of them so they don't need to engage third parties at all.

Opening up the WinAmp source to all goes badly as owners delete entire repo

Lee D Silver badge

If you're running a software-creating business and you aren't tracking licensing at even a FILE level, especially for things you've PAID for licensing for, you have far bigger problems that what happens if you want to open source.

And I've seen plenty of releases from studios where it's just "and this file isn't included because it's proprietary" and then the community builds an open-source shim around those functions or rewrites the parts that are missing using something else entirely. (Things like games using EAX or PhysX or Miles Sound System, etc.).

But you have no source control whatsoever if you don't even have the licenced portions of your products separated into folders with the relative licensing associated with them (in comments or a separate file).

The days of "oh, we just kept it all on a floppy and nobody cared about the licensing" are so far gone it's laughable.

And if you've ever licenced anything ever, I guarantee that licensor occasionally looks at your programs to see if you're still using their code.

Western Digital releases firmware fix for SSDs blighted by Windows 11 24H2 BSODs

Lee D Silver badge

Re: Western Dataloss

WDs aren't anywhere near the unreliability of Seagates:

https://www.backblaze.com/cloud-storage/resources/hard-drive-test-data

Been true for many, many years.

Lee D Silver badge

Re: Accidental bonus

(Goes out and buys one of those drives just to shut Windows up...)

Lee D Silver badge

Re: Anyone still buying WD?

Yes.

WD Red (CMR editions like Plus and Pro) are amazing. I have more than 10 in my house - 4 in an active NAS, 4 in a backup NAS (mostly the older 3Tb ones rolled down from the active NAS) and randoms that are too small for my usage (e.g. 1Tb) but I keep for if I ever need a hard drive.

WD Gold just keep going - I have a box of them that are 10+ years old still spinning after years of server storage cluster usage.

WD Black NVMe's are incredible (I have two in my only home device - a gaming laptop - and just upgraded one of them and sold the previous still with 99% life after 4 years of very heavy usage - almost 24/7, high-end gaming, VR, video-editing, programming, etc. etc. etc.).

I will always go to WD first, but I will research what I'm buying (e.g. I don't want WD Red SMR devices).

My Steam Deck is waiting for an upgrade (I bought the 64Gb model) and I've waited for the 2230-sized WD Black drives to come down in price. Maybe for Christmas.

Every manufacturer on the planet has problem models (Seagate have a particularly bad reputation with me, for example, after EVERY ONE of their drives across an entire site failed catastrophically and without SMART warning within 4 years, including high-end server drives).

But WD... I have managed thousands of WD Blues way past their expected lifetime and they were absolutely fine. Hundreds of WD Reds. Dozens of Golds. Dozens of Purples. And a handful of Blacks and NVMe's.

And the numbers (which I have run) spoke for themselves. WD would always be my first choice.

Yes, your network is down – you annoyed us so much we crashed it

Lee D Silver badge

How to go to jail in 1 easy step.

Honestly, whatever bills are outstanding, this is just "criminal damage" (in the old days) or computer misuse under current legislation.

I'd be leaving any place that did this, and if they're lucky then on my way out I may not tell their client what actually happened and agree to swear to that under oath.

Post Office CTO had 'nagging doubts' about Horizon system despite reliability assurances

Lee D Silver badge

Re: Roll out new point of sale system, get petty crime wave?

To be fair, implementing a more robust accounting system could EASILY generate that kind of response, things that were totally missed before because there was no way to check them, but which flag up immediately in a newer system.

And judges are not there to do the research for you, they judge the case in front of them based solely on the evidence in front of them. Anything else is dangerous. It would be for the lawyers (especially defence) to say "There have been X hundred court cases in recent years because of the Horizon system, which is far in excess of the previous system, can you account for that? Is it not possible that my client is one of many being unjustly accused?"

Fact is, many of the people that went to court PLEADED GUILTY because they were advised to do so. In that instance, neither the lawyers or judges have much to do beyond dotting the i's and crossing the t's. It's why you never plead guilty to something that you know you didn't do. You've basically said "Yes, I did that, exactly as described." and there's no way back short of a pardon or major scandal.

But a new accounting system suddenly detecting 100's of cases of potential fraud over 16 years (so barely 50 cases a year), out of about 7000 subpostmasters, their other employees, etc.? Yeah, it's significant but it's not implausible. Especially when some of those pleaded guilty and in the process even accepted the evidence from Horizon was accurate.

If you were to suddenly implement "insider trading laws" on 7000 stockbrokers and their employees and departments, I would bet that you'd find more than 100 cases a year.

The real problem is the Post Office's rather unique ability to act on its own: "when an organisation is allowed to act as a prosecutor when it is also the victim and the investigator of an alleged offence".

i.e. crusty old laws with no modern need for them and people able to run amok and avoid oversight.

If they'd had to push their case through the normal entities (such as they had to do in Scotland and Northern Ireland), the number of instances would have been less but still might have flagged something in people's brains along the way.

Parents take school to court after student punished for using AI

Lee D Silver badge

You could read the defence:

"This lawsuit is not about the expulsion, or even the suspension, of a high school student.

Instead, the dispute concerns a student, RNH, dissatisfied with a letter grade in AP US History

class, having to attend a “Saturday” detention, and his deferral from NHS - rudimentary student

discipline administered for an academic integrity violation. RNH was given relatively lenient and

measured discipline for a serious infraction, using Artificial Intelligence (“AI”) on a project,

amounting to something well less than a suspension."

"Despite accepting the discipline, acknowledging its legitimacy and not appealing the

discipline to the Superintendent, RNH and his parents now asks the Court to grant extraordinary

relief"

And it says that AI was used to draft and edit the submission.

Critical default credential in Kubernetes Image Builder allows SSH root access

Lee D Silver badge

And what's the fix?

"echo '{{user `ssh_password`}}' | sudo -S -E sh -c 'usermod -L {{user `ssh_username`}} && shutdown'"

Literally bash scripting to lock the user using sudo and a piped plaintext password during the build process.

Amazing how we've formed yet-another-tool around a huge complex layered obfuscation of bash scripting again.

Lee D Silver badge

And this is why, in my opinion, automating individual creation of VMs/containers for every tiny thing you build, need or use is a terrible idea.

Along with the "what dependencies is it sucking in" and "what's it actually DOING in that VM/container" questions.

"Kubernetes builds upon 15 years of experience of running production workloads at Google, combined with best-of-breed ideas and practices from the community."

*cough*

Would banning ransomware insurance stop the scourge?

Lee D Silver badge

"In UK law money laundering is defined in the Proceeds of Crimes Act 2002 (POCA) and includes all forms of handling or possessing criminal property, including possessing the proceeds of one's own crime, and facilitating any handling or possession of criminal property."

https://www.ifa.org.uk/technical-resources/aml

Everyone in the chain that touches, facilitates, authorises, allows or processes money that is the proceeds of a crime (a ransom is literally a proceed of a crime, you don't get much more smack-bang inside the definition) knowingly is allowing money-laundering. Obscuring the path of supplying those proceeds is fraud.

This is why banks and charities are required to know both the source and the destination of funds now. You can't just drop £10k on your kid's private school in cash anonymously... they have to identify you before they can accept it. And your own bank wants to know why you're trying to draw out £10k in cash.

And just because you're at the start of the chain doesn't exempt you (and the act of "wanting" to pay the ransom isn't illegal in itself). But the second you reward someone for committing a crime, by paying a ransom, that becomes proceeds of a crime and ... oh... look... you handled it.

The law in this circumstance has always been enough to make it convictable, but PoCA *literally* makes it explicit.

Equally, the third-party in my example (the company that acts as a middle man) is a prima facie example of a money-launderer. It doesn't get much clearer.

“a person commits an offence if he enters into or becomes concerned in an arrangement which he knows or suspects facilitates (by whatever means) the acquisition, retention, use or control of criminal property by or on behalf of another person.”

Lee D Silver badge

Tell me how paying software ransoms isn't money laundering.

You're paying large sums of legitimate money to an unknown, undiscoverable entity, deliberately and knowingly.

How are you accounting for this on your accounts and auditing? How are these third-parties who do it on your behalf?

I had this come up at a workplace (registered charity) that was infected and they wanted to pay a third-party company to pay the ransomware for them, and then bill them (plus some commission, plus zero guarantees anything would actually be fixed by doing so). I queried how we can knowingly contribute to money-laundering given that we'd spent the past year telling customers that we couldn't accept anonymous cash for payment any more because of anti-money-laundering rules. I asked what we tell the auditors about this not-insignificant sum we're paying to this company. I asked how the charity administrators could account for it, and the gambling with that kind of money.

There are literally companies that exist to do this... they take your money, issue a legitimate receipt / invoice, convert it to Bitcoin, pay the ransomers, and then... they don't care what happens beyond that. If you're not committing money laundering yourself, they certainly are, and doing it with your knowledge (so now not only are you money-laundering, but you're trying to obscure your accounting to hide the tracks of that very money-laundering by converting currency, sending it abroad, washing it through another company, etc.).

I think government should crack down and make it clear... if you pay a ransomware author, you're money-laundering unless you can identify the person or organisation that's receiving that money. And if you can identify your ransomer... well... shouldn't you be telling the police?

Sysadmins rage over Apple’s ‘nightmarish’ SSL/TLS cert lifespan cuts plot

Lee D Silver badge

Re: Cookies too?

Call me when iCloud is GDPR-compliant. As in it has a GDPR compliance statement that isn't just "wishful thinking" and no details.

You can't, because iCloud is just Amazon AWS, Google Cloud and Azure instances lumped randomly between regions without any of their regional / processing guarantees passed on.

Google, Microsoft, Amazon gave me cast-iron GDPR assurances months before it became law.

Apple still don't. They make it *sound* like they're compliant but they will never certify such and give a simple statement to that effect.

Lee D Silver badge

Re: The solution...

Your website is a prime target for interception and man-in-the-middle attacks.

Sure, to you it's just an HTML site. To any ISP or intermediary, it's an opportunity to insert literally anything they like into your page (including, ironically, advertising as some ISPs have been caught doing) because there is no way to check or guarantee if the HTML etc. has been modified en-route.

People went HTTPS everywhere for a reason - because ISPs and governments were inserting rogue Javascript code, trackers, cookies, adverts and even changing content on HTTP sites that people visited without the site-owners being aware.

Ironically, your "no cookies, no tracking, no advertising" stance is precisely why HTTPS is enforced nowadays.

Schools bombarded by nation-state attacks, ransomware gangs, and everyone in between

Lee D Silver badge

Re: welll

Now try and make a 5-10 year old safely use MFA on their own while in school, where they're not allowed to use phones and other devices.

The only "other factor" you can reasonably use is to either issue children with Yubikeys and the like (good luck with managing that) or using a simple factor like "originating IP address" (which MS lets you use as one factor).

So their 99.9% is probably true. But when you have a class of up to 30 all trying to log into Word, OneNote (current fad), Sharepoint, etc. and you have to have them all perform MFA even once a month... that's a huge chunk of teaching time wasted.

Fine for older kids. Fine for adults. Still sucks up DAYS out of the year just authenticating. But with little kids? Good luck with that. P.S. biometrics aren't reliable at that age either, and every biometric provider I approach at BETT basically says as much for this age group - fingerprints, facial recog, etc. just isn't reliable enough for growing kids.

UK ponders USB-C as common charging standard

Lee D Silver badge

Re: Mandating a charging standard is idiotic

To be honest, I would rather not have any standard operated, specified, licensed, controlled or determined by a single company. Especially not Tesla.

The whole of Europe don't seem to be crying out for a better charger, including several countries with the fastest / highest EV adoption rates.

FYI, China has yet-another-standard which only goes up to 250kW, the Type 2 CCS goes up to 500kW and the Tesla superchargers only go up to 250 kW of power, "but this is not the maximum the NACS connector is capable of."

So apart from "awkwardness" (for which UK mains plug would have been removed from circulation 50 years ago if that was a primary criteria), there's nothing wrong with CCS.

The only thing "vastly superior" (dubious) is that the Tesla charging cable is thinner because it shares AC and DC charging. Whereas the CCS is the only one that allows both at the same time with the same cable and no "protocol" / "negotiation" jiggery pokery to decide whether to put 500kW of AC down a DC line or not.

I know which I'd rather have.

Techie took five minutes to fix problem Adobe and Microsoft couldn't solve in two weeks

Lee D Silver badge

Regardless of everything else:

Why does a software update of a PDF viewer REQUIRE A FULL SYSTEM RESTART IN ANY WAY, SHAPE OR FORM?!

It's this ridiculousness that we have to kill off - even if that's because of poor MS OS handling of DLLs etc. - not Fast Startup.

Internet Archive user info stolen in cyberattack, succumbs to DDoS

Lee D Silver badge

Re: haveibeenpwned

Not my particular one, no. I wouldn't even claim to understand it any more!

It's a complex regexp built up over years, but to give you an example:

If I wanted to give, say, Microsoft an address.... I could use microsoftnn@domain.

And nn would be a factor of the word "microsoft". For instance, length. Or how many vowels (easily countable in your head). Or some similar metric / formula.

Then if I'm asked on the fly for an email, I can craft one. If someone makes one up and doesn't know the rule, it won't generate a valid email. Email that doesn't meet the regexp (in the "virtual" alias file in Postfix, for example) will just bounce as not being valid. New emails don't require me to explicitly set them up, so long as they match the rule (and because it's a virtual alias, all valid ones at my domain are just forwarded to my real email account on one line). And when I receive them at the endpoint, I know if it came from my mail server it must have matched those rules.

I don't even do things THAT simply... the address wouldn't be microsoft, for instance, but something I know that is related to Microsoft... i.e. I might use "redmondnn@" for example. Then if I get an email purporting to be from Microsoft and it's addressed directly to my final email account... it's a fake. If it's addressed to anything other than redmondnn@, then it's a fake. And if it's addressed to redmondnn@ then I know that that is the precise email that I gave Microsoft and Microsoft alone (so either they have released that email somehow, or I've been compromised).

And yet when I speak to companies or sign up on their website on a foreign device, all I need to do is make up an email, work out the "score" that goes on the end in my head, and provide it to them and they likely would never query it at all because it just looks like an ordinary email address ("johnsmith43@" etc. are common).

One regexp, and I'd have to sit and spend a week deciphering it admittedly because it's more complex than the above!, and all my "phishing identification" and catch-all spam goes away.

Lee D Silver badge

Re: haveibeenpwned

I have a Postfix rule that validates the email address according to a set of non-obvious, non-inferrable rules and if valid forwards it onto my real email account.

Best way to spot spam, phishing, credential theft, etc. "Oh look, an email from Paypal... except that's NOT the email address I gave Paypal".

But also, if you try to make up an email at my domain yourself, you can't without knowing the rules.

The power of regex...

Lee D Silver badge

Re: haveibeenpwned

There's a reason that for years I've been using not only unique passwords but unique emails at my domain.

Just in the last week, I've seen emails to the addresses I used for NextDoor, Scan.co.uk and others that are not being sent by that company.

That means that, at minimum, their employees are sharing their customer database emails with spammers, but could also indicate a compromise.

However, in a breach none of those passwords would be useful on other sites, and none of those emails would be useful with those passwords elsewhere, etc. and I *KNOW* that something was breached in some fashion (even if that's just an email list leak) even though neither of the above appear on HaveIBeenPwned.

I have "2FA" on my accounts, in effect, and someone breaching my NextDoor account would get logins and emails that only work on NextDoor and nowhere else (even if you try to mix and match emails at my domain with passwords I've used elsewhere).

Smart TVs are spying on everyone

Lee D Silver badge

I can't *GIVE* my projector "TV" network access. It simply does not have the functionality at all.

Which is literally the perfect enforcement of a "least privilege principle".

Lee D Silver badge

Re: I just want a display with an HDMI lead. Nothing more. If I can't get that, then I won't.

Yes, my legal private life that occurs inside the boundaries of my home, on my internal computer network, and when guests and family come to stay.

Anything illegal? Nope. Just my private life.

Lee D Silver badge

Re: Smart, you say ?

You want to flush twice in one hour? Just upgrade to Flush Prime.

Lee D Silver badge

Re: IF YOU CAN'T BEAT THEM .... USE THEM :)

You overcomplicated that by about a dozen steps.

I use a Pi with DVB-T (and a USB DVB-S for FreeSat) with tvHeadend. (In fact I have two Pis with DVB-T hats, and they talk to each over via Sat>IP).

That's it. I set the recording. It records to MP4. I watch the recording at my convenience (often editing out the adverts if I think I want to keep the file).

The Pi doesn't even have a display. It doesn't need it. I have a laptop / projector / whatever.

You can also do the same with Plex - PlexTV is basically plugging in a DVB into your Pi running Plex and it'll do the full live-viewing and recording experience in one hit.

Lee D Silver badge

For years I insisted on a dumb TV.

Now I wouldn't use anything else.

In fact, I scrapped my TV and I use a dumb projector for movies, and my laptop (with a sizeable screen) for anything else.

As far as I'm concerned a TV should be a monitor and nothing more. I'll pull content from whatever I like, I don't need it built into the TV and don't want it - it means that the TV has an obsoletion date attached to it and.... well... it's a display screen. Why should it?

The trend towards Sky Glass / Amazon Fire TV (as in the physical TV they sell) isn't for me. I'm not interested in branding my display screen, nor locking myself into content, no removing the ability to show whatever I want on the thing without question.

Increasingly, I believe that if I do ever want a TV, I'll just buy one of the digital-signage screens or even interactive whiteboards to do so (but even the latter are creeping into full-on giant Android devices).

I do not want a branded, cloud-managed, subscription-based, locked-in faux TV that'll be abandoned in a few years.

I just want a display with an HDMI lead. Nothing more. If I can't get that, then I won't.

Uncle Sam may force Google to sell Chrome browser, or Android OS

Lee D Silver badge

One who develops it, one who uses it.

Lee D Silver badge

Or even Edge, Windows and Microsoft (again!) for that matter.

Lee D Silver badge

Cool. Now do iOS, Safari and Apple.

Bitcoin creator suspect says he is not Bitcoin creator suspect

Lee D Silver badge

This is Sparta!

No, wait.... wrong movie.

Microsoft veteran ditches Team Tabs, blaming storage trauma of yesteryear

Lee D Silver badge

Re: What I don't understand

Because when you then get a guy taking code that was lined up with tabs and adds lines lined up with spaces, they won't match and now your indentation is broken or misleading (there are even gcc warnings for misleading indentation like that, which can cause compiled failures if you compile with -Werror for example, and thus could literally stop the build succeeding).

And don't even imagine what happens when the same guy takes that same tabbed-line, adds a weird number of spaces to the tab, and now you have a mixed line that doesn't correspond to any amount of tabs for conversion.