Posts by Lee D

Mourning Apple's war against sockets? The 2018 Mac mini should be your first port of call

Mac OS legitimately? No.

But my 8-year-old laptop has a VMWare virtual machine on it with MacOS from my "proving" the same thing to somebody else.

With that OS, running inside a Windows 7 hypervisor, I can allocate 25% of the laptop resources and enjoy BETTER performance inside the VM than on a real Mac. While also getting real-work done and even virtualising other OS (I have Windows, Mac and Linux VMs running on a Windows machine, all picking up the same codebase and all compiling via Eclipse and running the result to test it works, in case you wonder why.)

Granted, it was a couple of years ago that I last did this specifically to prove the point, but my laptop is EIGHT YEARS OLD. And it can virtualise MacOS in one-quarter of its resources, faster than Mac native hardware. Seriously... go try it. VMWare Workstation and a couple of UEFI config file tweaks to make it boot.

Honestly, that same 8-year-old laptop still beats out this Mac Mini! It's Intel i7, 12Gb RAM, dual-drive bays with 1TB in each (but I later replaced one with a 1Tb SSD - however the tests above were NOT done when it had an SSD) and has nVidia graphics (I think it's a 960M, to show you that it's hardly top-of-the-range even back then!).

If you don't realise that MacOS is clever-tricks and showmanship and NOT actual performance, then you've not looked into it. The slippy-slidey menu at the bottom is a perfect example. You're led to think it's scaling those icon in real time. It's not. They are pre-cached bitmaps in a variety of sizes. It's giving you a GIF animation, basically. On the VM I made, you can knock the allocation down to a single-core and it still does slippy-slidey quite smoothly, but every performance metric of "real work" (e.g. loading apps, browsing websites, compiling code, etc.) falls below on the actual Mac hardware compared to a VM experience.

MacOS is designer shine on a hardware turd. Sure, it's "clever" in its way, but it's entirely snakeoil.

Honestly - if you have VMWare (I don't think it works in anything else as it has a serious UEFI integration), go Google how to do it, load MacOS up and run it. If you dial-down the resources allocated, you'll instantly spot what's snakeoil and what's actual performance. And your PC will still kick the Mac's arse.

Honestly, the only reason to own MacOS is if you need to cross-compile to Mac, where you can only reasonably do so via an up-to-date XCode, which usually needs and up-to-date MacOS, no matter what compiler / development environment you are using. I use Eclipse and the CDT, and the only sensible way to cross-compile to Mac is to load Eclipse on MacOS, configure it to load the XCode etc. compilers and libaries, and then make that do the compile.

As I proved recently on another forum, for the same price (of all the models available) I can get a PC that out-performs the Mac for a-half-to-a-third of the price - and that usually a laptop with an HD screen to boot!

It's another Apple "designer" product, and I don't see why anyone would touch them, nor why Reg would cover it at all seriously.

"mainstream professional power users"... yeah, right. The kind of people who want to buy a machine that can barely cope in its default config, where the highest config is comparable to a run-of-the-mill PC and where the graphics card is an optional extra because it only has the Intel HD graphics...

Literally for the same price I can get a gaming laptop that'll knock every feature it has for six. Or I could buy a desktop (no monitor) that'll wipe the floor with it so badly the poor thing wouldn't be able to network with it from embarrassment.

Honestly, stop bigging up their over-priced peddled trash.

Microsoft claims Office 364 back to business as usual. Oh no it isn't, say suffering sysadmins

Re: Office 364?

To downgrade is simple.

Just update to the newest version of Office each time it's released.

Less features, less reliability, the perfect downgrade.

I had a rather interesting conversation with a client lately where they demanded to know why our staff webmail was only running <old but still-fully-supported version> and not the new-new-newest.

"a) it works, b) it's not insecure, c) it's supported, d) we have no need of any upgrade" was the gist of my answer.

GitHub lost a network link for 43 seconds, went TITSUP for a day

I'll explain that problem to you in two words.

Split-brain.

You had two places that both thought they had the "definitive" copy of the database, but didn't, because they didn't have what the other side had, because both were pretending to be in charge and taking any orders that came to them and applying them, even if they could never tell the other side about those orders.

Note that this is perfectly possibly with ANY replication setup that works in a failover mode whereby one place - upon detection that it can't talk to the other place - becomes a full-service node. It starts taking orders from the waiters and giving them to their own chefs, without realising that other places are also taking orders and giving them to their chefs, and then you try to merge the kitchens back together and you just get chaos.

It's so prevalent that you can do it in Hyper-V failover replicas, DFS, MySQL or anything else that tries to "take over" when a site goes down without proper shared "journalling" of some kind, or a forcible master server handing off work.

If you chop your network in two, and expect both halves to get full service, you need a way to resolve split-brain afterwards. That can either be something like DFS or Offline Files does (hey, we have these conflicts, sorry, nothing we can do and you need to manually check what you wanted), or you have to literally put in intermediary services that can handle and clean up the situation.

The job is almost impossible automatically... someone commits something to site A... it times-out because of the fault but gets to site A storage. They retry, they get balanced over to site B, you now have an *almost* identical commit to site B, but they both differ. Or you have one developer commit his branch to site A, another to site B, they conflict and now you've messed both side's entire tree. Leave it for 40 minutes with a crowd of developers and before you know it you have entire trees with two completely conflicting trees that can't be merged because the patches change the same parts of the code and who do you reject now? Plus one of those developers is going to have to rebase their tree but may have done thousands of hours of work based on the deprecated tree and they won't be happy.

And I've tried to explain this to people too... yes, just slap in a failover / replica, magic happens and it all works when you join them back.

No. It doesn't. The only way to do that is to have a load-balanced queuing/transaction system whereby the underlying databases are separate, but there's only ever one "real" master, and that gets committed to by a single ordered list of processes that will always feed that data back in the same order to the same system. Literally, one side "takes orders" but does nothing with them. Until the join is fixed and then they hand them off to the shared kitchen. You don't lose any orders, but they don't get acted upon immediately (i.e. you accept the commit, but on the failed site, it's never reflected in the tree). Even there, you have problems (maybe the commit you accepted wouldn't be valid against what is NOW the master tree that's taken other commits in the meantime).

Such things - and their solutions - introduce all kinds of problems with your "distributed / fail-safe" setup.

And all because you didn't think it through and just assumed it would all carry on working perfectly like magic. If you have a blip, and you failover, the failover will work perfectly. But before you can ever resume service, you have work to do that if you haven't considered it in your design turns into a mess with hours of downtime and potentially accepted-but-then-disappearing commits.

Woman who hooked up with over 15 spectres has found her forever phantom after whirlwind romance and plane sex

Dear God,

I'd like to file a bug report...

Britain's rail ticket-booking systems go TITSUP*

There's a feature that I quite like in Veeam (bear with me!)

When you're copying your VM's over from one place to another, or backing them up, or whatever, it tells you where the bottleneck is.

Source, Processing, Network, Target, etc. You know what's holding up the line.

Cloudflare do something similar, with a checklist of "Well, we're up, but the site you're trying to access is down" icons. It's about time, we all follow such lead and have the systems automatically lay blame.

"Please try again later" isn't acceptable. "Sorry, the national ticket-booking service is down", or "Sorry, this station isn't able to connect to the Internet to check that information", or "Sorry, information about Virgin trains isn't currently available from their systems."

Short, easy, subtle, but at least lay the blame where it needs to be laid rather than "Error". And it's literally the case of changing the output of a few exception catchers / error paths into something friendly.

However, Veeam caught me out the other day through exactly this problem. "Could not process the VM". Apparently that means "You need to take a Full before you can take an Incremental, pillock" but fails to tell you that and instead gives you something that's both heart-wrenchingly worrying, and almost impossible to narrow down without working blind.

What can I say about this 5G elixir? Try it on steaks! Cleans nylons! It's made for the home! The office! On fruits!

Re: John C Dvorak

Actually, it wasn't anything to do with 5G.

He was equating 5G with millimetre wave (which is, in itself, dubious as 5G will be at least partly on "ordinary" frequencies already in use and the millimetre wave frequencies haven't even been auctioned yet). And not just a few particular frequencies but basically EVERYHING above a certain frequency.

He was then equating cellular millimeter wave with... well... some tosh about your eyeballs and skin frying. Complete lack of coherency or understanding about the difference between frequency and emitted power.

It was an incredibly dubious, incredibly unprofessional, incredibly misleading and incredibly badly-researched article (which basically tried to use the argument "nobody uses it, so we don't know what it does, so obviously it's gonna fry your brain" - despite the fact that this kind of stuff is deployed all over the world in radar systems, military applications, site-to-site wireless links, etc.) which was pulled because it was written to try to smear 5G (and ONLY 5G) with such tosh.

Honestly, though I remember the guy's name and probably read thousands of his articles in my time, reading that one really put him firmly in the "ignore everything he's ever written" category for me, it was just that bad.

When they actually deliver what 3G is capable of, even a percentage of the time, then I'll start thinking about delivering what 4G is actually capable of, then we can worry about what 5G might be capable of.

HSPA+ is technically capable of 168Mbit/s

LTE A is technically capable of 1000Mbit/s

I have a 4G connection on a little portable Wifi box that can just hold a steady 20-30. But even that cuts out for long periods of time and is nothing to do with the signal - a mobile phone right next to it with the same kind of SIM will happily ramp up speeds while that struggles to stream even a 0.5Mbit stream with buffering. And that's *4G*. And I live inside the M25. And the nearest tower to me is about 200 yards away with no obstruction.

The problem to solve is not the "talking to the phones" end (that's a shared medium, plus it's highly dependent on enrivonment, etc.). It's "backend carrier" that you need to deal with. Because it's just not there.

(But, hey, I can't even get a decent digital TV signal either, so I think we can safely assume that we've forgotten how to do radio networks nowadays).

Techie was bigged up by boss… only to cause mass Microsoft Exchange outage

Which is why you don't work direct at the server but over RDP unless something really critical has happened, because then "shutdown" is something you can only really do with a command-line (or if some installed program offers to do it for you, but then you test that on a non-server first, and generate yourself a mental install script, right?)

Flash price-drop pops Western Digital's wallet: Surprise revenue fall with worse to come

Haven't bought a hard drive in years.

Don't intend to unless it's a seriously high-end thing for a server that has to be certified and firmware'd up, etc.

I see no reason that SSD/NVMe can't be your main product now and your sole product in years to come.

I'll do you a deal. Gimme a 1Tb SSD that's "only just" faster than an hard drive but comes with the tiny space, the no-moving-parts, non-hermetically-sealed boxes and the same price, and I'll buy dozens of them tomorrow.

Then you can slowly ramp the speeds back up to what they are now (i.e. Ludicrous Speed) and increase capacity as you go. Then in a few years time, I'll buy the same amount of 5Tb SSDs for the same price. And so on.

I honestly don't understand why HDDs even exist any more, or why companies that used to make HDDs are considered at all the people to get SSDs etc. from - entirely different technology and processes and they didn't see it coming and now they're reeling.

My Samsung 1Tb (which is stupendously expensive) has been in use for... 5 years straight. And it's still only £50 cheaper on Amazon than it was when I bought it.

I blame them focusing far too much on trying to justify their old business, and failing to get on board and ramp up SSD / Flash etc. It's like when I was watching Kodak produce printers and new cameras and films while everyone else was already using digital cameras.

The best way to screw the competition? Do what they can't, in a fraction of the time

Re: when you charge more per hour

When I was self-employed, my phrase was:

You don't pay me by how many hours I press buttons for you.

You pay me to know which buttons to press and when.

Have gladly charged a customer a full-day's rate for the simple matter of turning up, pressing Enter on a screen that said "Press Enter to continue..." and then going home.

The question is not "am I being paid for pressing one key?", it's "was I willing to press that key, understanding the consequences, and take responsibility for whatever happened after I did?".

(P.S. when you plug heaters into an extension that also runs "the server" - not my idea! - and the server turns off, and you hide the heater and just press the server power button, you should know three things. a) the server was set to "Press Enter to continue" on the BIOS, which if you'd done, it would have just booted up, b) your heater stays warm for a long time afterwards, especially if you try to hide it away in a cupboard, c) if I had been paid by the hour, I could easily have spent hours on figuring out the cause if I hadn't been lucky and observant... or you could have just owned up to it and I could have solved it in seconds for free over the phone)

Note to all those random people that phone me up trying to be "one of your suppliers in the future":

This.

I don't care if you're the cheapest. I don't care what incentives you throw at me. I don't care that you're friendly on the phone and try to engage me about the football / weather / etc.

I can get all that ANYWHERE. Literally, I have so much of that that it's basically spam - on the phone, by email, etc.

What I want from you is... helping me. This includes things like access control engineers who cleaned up after a third-party locksmith made an atrocious mess. Computer companies who overnight shipped me thousands of pounds of critical gear on the basis of a late-night email to keep us up and running (no contracts, no huge deals, just literally a box of gear arriving because they knew we needed it ASAP). Engineers that I know and trust, because they help out, not say "not my job mate" and even advise on things that are nothing to do with them because they see problems (and literally can't use it to upsell as they always refuse to handle prices etc. anyway - that's for "the blokes in the office" - and always tell you when even their own products "aren't something I'd recommend", etc.).

Sure, that stuff is "unnecessary" and may even cost you money. But it keeps your clients. And your clients will spend more money on you.

This is true of all customer service - you SPEND MONEY on customer service. It costs you time, money, equipment, effort, etc. But you get it back. I'll make sure you do. With things like this.

And it's a definite two-way street. The guy who helps me out can phone me after work and say "Sorry to bother you, I'm at another customer's and I see they have a problem that I know you solved on your system... could you talk me through what you did?". Bang. We're best mates now, and mutually beneficial to each other.

I've actually had to adopt a process now for a) taking suppliers details, b) ignoring them until I need their services, c) blacklisting them if they bother me too much to chase at any point, d) testing them out on small projects and seeing how they react when they realise they haven't won millions of pounds worth of business just because they were friendly in the first email, e) gradually building the projects up only if they are successful and seeing how long the trend lasts.

This has left me with some areas of my work where I literally REFUSE any other contractor. Sorry, no, that job's going to Company X and I don't care if you can undercut them or you have to wait until next week for them - they do all our <whatever>. The other areas are where I literally can't find anyone who does a good enough job and I have to break them down into mini-projects and hedge my bets among several unknowns, knowing that at least one project will fail because of the way they operate, and then using the others to see who wants to pick up the slack.

Drop the business boundaries and try to help me.

We asked 100 people to name a backdoored router. You said 'EE's 4GEE HH70'. Our survey says... Top answer!

I'm not suggesting that this is "secure", but if you're going to put in a default backdoor password (presumably to force firmware updates and the like, like cable operators do), then at least take ten seconds to come up with something that's not so bleeding obvious all you have to do is grep the firmware.

Off the top of my head:

Set the password to: A cryptographic hash of the device serial number/MAC address, salted with a secret salt that - should the worst happen - you can change and then re-password all the devices (you know what the serial number/MAC address is, it's then easy to work out what the password for any particular device should be and it should only be travelling over your own network, yes? And one password does not let you into every device. And if you do it right, even with a million passwords of a million devices out in the wild, someone shouldn't be able to work out the hash salt?).

Just make sure that the salt is NOT stored on the devices themselves (literally just generate the hash and use that in your password file as the password for that device - hell "ASCIIfy it" or "hexadecimal" or something if you want a human-readable version of it).

That's where I'd start with the absolute bare basics of "bodge job".

If you want to do it properly... secure certificates. Gosh, if only we had those right? A client certificate on each device that can be unique and you can use for securing their update checks, and every device carries the public key of the certificate that you intend to use to connect to them and expect login.

This way - you don't even need a password! Just a certificate (it might be an idea to passphrase it though). Ten minutes with OpenSSL (gosh, I wonder what kind of device would have to have OpenSSL installed by default anyway?) and every client can generate their own unique certificate to identify themselves, and you have a certificate at EE / whoever that can connect to any router to make it update. And you could even do things like replace that cert, revoke any compromised cert, pull that cert from the Internet when it changes, verify it against certificate stores, etc. etc. etc....

It's almost like someone invented an infrastructure and encryption methods to support all this, and people added it into basic login / administration tools so you could use it, eh?

A.K.A. SSH public-key-authentication.

This two-year-old X.org give-me-root hole is so trivial to exploit, you can fit it in a single tweet

Re: And this is news how?

Not sudo. setuid.

X was setuid in every distribution for DECADES. Some of them still are. X itself runs as root no matter who you are in those distributions, then downgrades itself to the user's level.

Here's a shock - apache does the same thing. You have to run as root to enable you to bind to any port number less than 1024 as a server. So apache starts up as root, binds the port, drops privileges, and runs the rest of its life as "www-data" or whoever while holding something that only root could have obtained. X does pretty much the same, or did. There are ways not to, but pretty much X has spent more of its life starting as root than anything else. Same as "ping", I believe. You have to be root to send ICMP messages. So ping is "setuid root", so whoever runs it is actually running it as root. (Things may have changed in recent years, I don't delve into it myself).

Because of that... anyone on those affected distros (i.e. all but the most secure) is running X as root for a period of time. Which wouldn't be a massive problem if it didn't allow you to specify arbitrary files as the log, and then let you control what's logged. Basically, that's using X as a proxy to read/write any file on the filesystem. In this case, it just happens to set a root password by overwriting the password storage file (shadow).

Yes, it's a dumb idea to run as root when it's not necessary. Fact of the matter is, there's almost ALWAYS a point at which it becomes necessary. Windows has a SYSTEM user, Linux still has root. If they weren't required, those accounts wouldn't even exist. (It actually goes back to the micro-kernel argument of old, where you shouldn't need one user able to "join" all those systems, but if you want sufficient performance, you often have little choice without switching between 20 different subsystems and handing off state information 20 times to achieve something basic).

But it's not an incredibly dumb idea so long as you are very careful and drop privileges as soon as you've done the necessary. In this case, the former failed and - while still root - X allows unsanitised user-specified data to be utilised in the name of a filesystem file which it then gains root write access to, and again to allow the user to specify more unsanitised data which can end up in that file.

Should a robo-car run over a kid or a grandad? Healthy or ill person? Let's get millions of folks to decide for AI...

Wrong... the answer to the trolley problem is "there is no right answer".

You have no capability to assess two options quickly and conclusively in a short time, nor does a computer.

Both options are bad and, in reality, most people won't blame you for "choosing" either but the fact is you won't get to choose - it's essentially random in any crisis situation. Even choosing between "hitting the fence and taking the pedestrians out" versus "not smacking into the oncoming HGV myself" is a no-win situation of which people take both options all the time or, again, the third option "AARGGGH!" and bouncing off the truck because you couldn't decide and ricocheting into the people anyway.

The fact is that any reasoning applied is largely arbitrary (why would you save rich people instead of poor people?), thus such reasoning is pretty unnecessary anyway.

The only options to decide are "do something" or "do nothing". And the answer should always be "do something", which should be "brake". Where you're steering when you brake is largely undetermined anyway - try to change that too much and you skid and make the situation worse.

All the computer should do is ask itself "do I need to stop?" And that's it. Anything else is going to cause as many deaths as it saves.

Re: Important 'cause...

I have experienced the "time slowing" thing. People think it's an exaggeration but it's not.

I was driving through a rainstorm at night. Had navigated to a random point on a map, so literally had no idea where I was or where I was heading.

Emerged from a forest, into a little village, miles from anything. Only the pub was actually lit up, the rest was just houses and incidental lighting. Passed the pub, 20-25mph or so (it was seriously belting down), followed the road, and ended up with a bridge in front of me.

Literally, I can remember my entire thought process. A sign on a pole appeared and passed the front of my bonnet. Through the rain-soaked windscreen it was tricky to make out but I saw it and my brain processed it. It was a little car. Going downhill. Into some wavy lines. I *know* I know what that means, but I can't think of it. Literally - from my brain's point of view - many, many, many seconds of debating happened as I tried to reason what the sign was. Meanwhile I drove up onto the "bridge"... Very steep this bridge. I wonder why they have a bridge in the middle of nowhere.

And then brain finally decided that it had thought long enough and brought back reality to me. Not bridge. Harbour. Not "the road is made of bacon" but... this is the end of the harbour and you're about to plunge into the ocean. Amazing, considering I had *zero* idea I was near the ocean at all. Never pressed the brake so hard in my life and it appeared to take forever to stop - I can remember at least "ten seconds" of me just pushing the brake to try to hasten the stopping, and it not happening... after the long internal conversation to do so.

I literally spent the next ten minutes with my car at a 25-30 degree up angle on the ramp, full beams shining off into the sky, the bottom of the beam just catching the top of 12-foot rolling waves as they smacked against the ferry-docking-ramp I'd just driven up.

1) I can't swim.

2) I did not know I was near the ocean, so would have been utterly unprepared.

3) It was 12-foot-waves. No exaggeration.

4) Because it was a ferry port / harbour there was no easy way back up to dry land even if I could get out a car that fell into water bonnet-first.

5) It was pitch black, middle of the night.

6) Because of the huge rainstorm, nobody would have heard a thing. The pub was shut, it just had lights on.

7) I'd just split up with my wife and gone on a drive to escape... so nobody was coming to look for me even if I was missing.

I sum those to equal "death", personally. It's the closest I've ever come to it.

However, when I recovered from the more-than-slight shock, I realised several things. Including that the sign I "passed" was parallel to the passenger door. I'd barely encroached a few feet up the ramp. Given the conditions, that tells you how slow I was being anyway, but there is NO WAY I had time for the internal-conversation that took place.

I can remember the length and detail of that internal conversation, which must have been literal fractions of a second, and it far exceeds reality. Either your brain massively overclocks in an emergency, to get more done in a short time, or something weird happens to your perception of time.

"Although I will say I never realised quite how fast 60mph actually is until I was approaching a wall at that speed with limited control. When normally driving it always felt quite slow."

I like to do this to people (my kid especially). Drive along normally. Pick a landmark. A lamppost. An old lady. Whatever. Now, in your head, picture what it's like to hit them as you drive... literally see how quickly they would go from being "in front of the car" to "up in the air behind you before you could even really brake". The distance you cover at motorway speeds is stupendous, but even driving along a side road.

There's the old lady... here we go... BANG-CONTACT-FLING-SPLAT as the front/windscreen/roof/back of your car passes the point she's standing at. It's amazingly conducive to realising quite what speed does.

Congrats from 123-Reg! You can now pay us an extra £6 or £12 a year for basically nothing

Re: Snake oil sales men

Honestly never understood such things anyway.

Does anyone ever click and check them from those icons?

Is that in any way secure anyway (if the website wasn't in the first place)?

How many people who don't understand the SSL certificate highlights in browsers, who then go to click on the Verified By... thing then have the first clue about checking that that's actually genuinely FROM the SSL provider in the first place?

If only all the information required to verify the certificate was somehow included in the certificate itself, and somehow showed itself in the browser as soon as you visited such a secure website, eh?

SQLite creator crucified after code of conduct warns devs to love God, and not kill, commit adultery, steal, curse...

To be fair, they would be subject to wear-levelling.

It's just a matter of waiting long enough.

London flatmate (Julian Assange) sues landlord (government of Ecuador) in human rights spat

Re: Ecuador could solve this in about 3 minutes

They really don't need to even do that (and he wouldn't evacuate anyway, would he?).

Just phone the police and say "I invite you to come arrest Mr Assange at your earliest convenience".

The ambassador wouldn't even need to leave their desk.

Data given to his organisation ends up being released unsanitised, putting people's lives at risk and identifying his sources. One source goes to jail for that, another ends up fleeing to Russia to escape.

Court gives the man a chance to be free on bail, he skips it.

Friends of his donate money to secure that bail, he skips on them, losing that money for them.

Ecuador give him asylum (the only place really willing to), he abuses it for years and then tries to sue them.

All I take away (even assuming that the Buzzfeed link with all the crap about his behaviour inside is just hyperbole) is that he's a twat who abuses trust.

And yet, we're supposed to believe this guy is going to be sniped by American agents the second he shows his face?

At one point, very early on, he could have had a message, a cause, a reason to back him. All he's done in the years since is drop other people in it, cause hassle for those who back him, and run from the law that isn't even really chasing him (our police ARE chasing him, but then they have a cast-iron admission of guilt for failing to abide by court bail, in that he's not abided by the court's bail conditions - they don't need to prove anything).

GitHub.com freezes up as techies race to fix dead data storage gear

Re: Cloud based services

It isn't really cloud, though, is it?

Not if one data storage thing going offline causes the whole thing to fall over. It's more like a Drip. Maybe a Puddle.

Whether or not it's "cloud"... where's the failover? And I mean failover, not just "oh, have some stale data and we may be able to restore a backup"... but live storage somewhere else ready to take over. You'd think $7bn might be able to buy something like that, no?

It doesn't matter whether it's cloud or not - it's SHODDY. Storage failures should never get to the point where they affect users, because you should have enough redundant storage mirrored up to date, and via a versioned filesystem so even a "delete all" command can be undone, for it not to matter.

If you're basing your business on their services, immediately review that decision. From the looks of it, they are just running off stale caches at the moment. That might mean they have no data actually up at all.

Crucial P1 minicard flash drive? Not if you grabbed Intel's 660p

Re: I'll never buy another

I bought a bucket of the cheapest Crucial junk SSDs I could find, lobbed them into any machine in work that couldn't take our >4Gb RAM upgrades (which tells you the age of those machines! They run 64-bit WIndows but the motherboard can't take more than 4Gb RAM) - so half the machines are 4Gb with an SSD, the other half are 8Gb with a normal hard drive.

Bear in mind that I *never changed a single option* - none of this caching rubbish, no "tool" running to optimise the SSD, no overprovisioning, no disabling of swap, etc. - literally a byte-for-byte image of whatever was on the same computer before the upgrade...

1) I've not had to replace one in over 4 years.

2) If I did, they are the cheapest things to replace, and literally replaceable because nothing is stored on the HD, just the OS and roaming profiles.

3) They would be much swapping harder than the 8Gb machines.

4) They OUTPERFORM the 8Gb machines, by a large margin. People use them in preference.

5) When I *do* runs the tools, there are zero failures and the estimated life is still 5 years +

6) These machines are hit hard every day, in use all through the working day, way into the evening, and sometime 24 hours a day in some locations. They get dozens of users a day sucking down their entire profile and then pushing back to the server, and doing all kinds in between and "Switch User"ing between half-a-dozen users all the time rather than logging off.

I honestly can't fault them... I have a Samsung in my personal stuff but they were a test to see if they were viable and whether I'd have to replace them every year, and they are still flying. If I had to replace them every year, I really wouldn't care at this point.

P.S. You should never lose data. Literally never. If you can afford one drive, you can afford two half the size and something to RAID between them, even if it's only a pathetic mirroring. And you shouldn't be storing anything critical on any machine that can't do that (we call those clients, they shouldn't be storing files on them and you should be able to code up a bare-metal machine to a working client with all your software and domain in minutes).

Now, if you'd said Seagate and hard drives - I'd be right with you. I burned through EVERY SEAGATE DRIVE in the workplace in that same time. Literally everyone failed, and every RAID resync with more Seagates inside them was a cross-your-fingers-and-check-your-backups moment. Every single drive that failed was Seagate (whether SAS or SATA, client or server or storage). Every Seagate drive has failed.

But the cheapest, junkiest, more useless, sacrificial Crucial SSDs... they are so impressive, I've worked out what I'm upgrading next rather than RAM.

Party like it's 1989... SVGA code bug haunts VMware's house, lets guests flee to host OS

Re: A standard dating back to 1987?

I still contest that a WinTV card plugged into a decent aerial put onto a computer (via the old purple-overlay-on-screen-with-a-cable-passthrough trick) was some of the best quality TV images I'd ever seen. I was enjoying full-screen, smoothed-but-sharpened progressive-and-deinterlaced TV at HD res long before HD was a thing.

Hell, teletext was also a dream - it cached EVERY page of teletext on the entire channel, so you literally clicked around it on the three-digit page numbers like hyperlinks.

Re: A standard dating back to 1987?

Ah, VESA VBE.

UNIVBE and Scitech Display Doctor.

Yes, I remember those days, but I have no idea of the timescale. I do remember, though, having monitors with post-"Standard Definition" resolutions about 15-20 years before people started buying HD TV's.

They never understood why I wasn't at all impressed.

Hell, I remember running... Fractint? In ridiculous resolutions. And a DOS program called "display" (which is non-existent now and impossible to Google) that could utilise those ridiculously high resolutions that monitors were capable of back then. Until you hit the one res that was a little too much and your whole screen spocked out trying to show it (no "Out of Range" messages in those days, just a monitor slowly damaging itself...)

I still have a Philips 105S that I used extensively in those days. It still functions some 20 years later as a CCTV monitor, and the picture is as clear as the first day I turned it on.

Sure, Europe. Here's our Android suite without Search, Chrome apps. Now pay the Google tax

Re: Or the fourth option...

This is always brought up about such things.

The regulators really wouldn't care very much. They get paid either way. And they can claim it's "opening up the market" (which is what you want such regulators to do, really, isn't it?). Also, every Google competitor will jump behind them and claim that they were just protecting "the small guy" and love them for it.

The biggest answer really is "Would you like to lose 50% of your revenue from one of the largest markets in the world?" Often the answer is no. Because people forget that annoying the EU has major ramifications for any international company, because it's often the second biggest market they trade in, if not the first. Nobody's stupid enough to throw away 50% of their worldwide revenue for the sake of a bit of legal work. Did you see company's responses to GDPR? Even US-only companies were diving for cover.

Virgin Media? More like Virgin Meltdown: Brit broadband ISP falls over amid power drama

Re: Not just residential

We have a VM leased line. That stayed up.

We also have a VM-managed, but BT-supplied leased line. That one was down on the timing in the article.

We also have half-a-dozen staff complain that their Internet was "really slow" at home last night (quite what they think I can do about that, I'm not sure!)... almost all of the BT.

I'd be inclined to think that this is at least partly "BT equipment not joining to VM network" rather than just VM on its own - a lot of their connections are now just ordinary BT-resell stuff, not VM at all.

Web browsers sharpen knives for TLS 1.0, 1.1, tell protocols to dig their own graves for 2019

Do me a favour - someone tell the banks and places like BACS.

I'm tired of dealing with their obsolete junk that only works in IE and so on, competing - and incompatible - versions of smartcard software required (one that works in Chrome, one that doesn't, etc. but you can't have both at the same time) and everything else.

The only place I've ever left the services of for not understanding basic online security was a bank.

They really need to get on board and make things easy for their customers, especially business.

Samsung’s flexible phone: Expect an expensive, half-bendy clamshell

Things that a foldable phone fixes:

- Too huge and thin a device in my pocket, compared to a littler, fatter one.

- No accidental screen presses (if I put my phone in my pocket unlocked, I have often come back to all kinds of icons all over the place and deep in the menus and even nearly butt-dialling people).

Things that a foldable phone makes worse:

- Longevity. Any moving part is bad - look at your current phone and name the actual moving parts. For most phones this is quite literally "whatever is inside the accelerometer".

- Screen scratches - now you can trap something inside your phone and scratch the hell out of your screen.

- Ever increasing cost. This stuff ain't going to come cheap.

- Manufacturing faults. I guarantee that within days of release someone will post a photo of one that has half the screen invisible because the bit in the middle failed.

It's a good idea, but until we have a literal materials revolution (i.e. something unscratchable, flexible, durable and touch-compatible enough without being a NASA-grade material), it's not going to be any good.

Scanning an Exchange server for a virus that spreads via email? What could go wrong?

Which is why you ALWAYS exclude any MS SQL, VHD(X)-holding-area, or Exchange database folder from any antivirus scan.

Such "bad-string-search-programs" (as I like to call them) are too dumb to cope with such files half the time, and certainly you don't want the AV holding up or quarantining access to your main hypervisor's VHDX files that are constantly being read from / written to - for a start, just making some AV look inside a VHDX file which can be terabytes large is an incredibly stupid idea anyway, let alone when you're on a machine that has dozens of them. I don't debate that it's a good idea to have the core OS on a server (even a hypervisor) protected by an AV program, though.

Modern software (usually) knows how to deal with such formats (famous last words), but I always put them on the exclusion lists anyway - you just know the one time that it doesn't, it'll take down your system, and any program that can sneak past the AV and plant its stuff in the MS SQL db folder is already a full system compromise anyway, and must have come via another entry point through which they would have been scanned anyway (as things tend not to download to that folder by default!). For me, there's a Sophos server config and a Sophos client config, and the server one excludes any of usual / default folders I store that stuff in, and certainly DOES NOT ever delete files - and the individual emails are handled via Puremessage anyway before they ever hit the Exchange database, and then the database is only scanned by a program that understands its format.

It worries me that people manage systems by just slapping on some AV onto a server without for a second thinking of the potential consequences.

Yale Weds: Just some system maintenance, nothing to worry about. Yale Thurs: Nobody's smart alarm app works

Re: Not Surprised

It's the only reason that locks and British Standards clauses exist.

Nothing is secure. Any front door can be taken down in under 60 seconds, as can any car. What matters is that you can't do *without damage*. Insurers want to see signs of forced entry, or no-payout.

Nobody even tries to pretend that your car is secure. It's a mobile device like any other. That's why we put GPS trackers and stuff on them. But I don't have any involvement with Ford to open my car door. I press a button, or I put the key in the lock, it CANNOT talk home - it doesn't even have any method by which to do so.

The difference is - I'm not relying on my car locks to secure my car from theft. They can't. They secure it from "opportunist" opening of my doors and nicking whatever is in the footwell/centre console. I also don't leave anything in my car overnight. What I do is, I take it out... and put it in the house. Because forcing entry to my house is a) harder, b) more obvious, c) much more likely to attract attention (not just mine, but mine's the only one that matters), d) can't be had as a quick getaway.

But, certainly, my car and my house have something in common - you could easily get in if you really wanted to, but you would have to leave evidence of doing so... and that means my insurance pays out. If the Yale lock decides to just randomly open, or they get hacked and an "open all customer's doors" command is sent, I have precisely zero recourse to my insurers (seriously, read your policy... "forced entry"), though I might be able to sue Yale (though it's unlikely I'd get full compensation for anything that was taken even then... more likely Yale would go bankrupt first!).

Re: Not Surprised

Smart locks are dumb ideas.

But non-mechanical locks are fine. E.g. magnetic strikes, mag-locks, etc. People - and businesses - use them the world over.

The advantages are many: Auditability of access. Alerts on access. Ability to rescind access (try taking a key back from a tenant - you'll end up just changing the locks).

And if you don't "cloud" every-fecking-thing, then it works great. To get in my workplace, you have to force entry. It's that simple. Even if the power goes out, the Internet goes down, etc. then you have to force entry. Except... if you are an authorised user. When you just tag and in you go. The only complicated scenario is a seriously extended power-outage which exhausts ALL the batteries. In which case there is a single method of entry in "fail-open" instead of "fail-secure", which is protected by a physical key. Thus entry can be made only by the genuine people even in absolute power-failure for weeks on end.

What you don't do is have this smartphone-connected junk or, if you're going to have that, you remote-access your secure internal systems via a proper method, not a junky smartphone app that relies on Yale. What you do is VPN into your own system and access it directly. If someone works out how to get into your VPN, it's already game over anyway, presumably. And you can do that from a smartphone really easily.

It's a matter of "design", not the tools you use in that design. You have to consider what happens in every circumstance, not just "I'll assume this will always work".

The other thing is - can this Yale lock, in theory, lock you in the house? Because that's a death-in-a-fire waiting to happen.

Re: If this guy has chosen not to install one of those ...

Then he probably wouldn't say "my property" and would probably be yelling at his landlord, instead of Yale.

"I’m an engineer, I work in IT, this is not acceptable. Who signed this work off? What was the rollback plan ? Call yourselves a security company ? Shameful. @BBCBreaking @Channel4News @BBCRadio4 @CNN @Reuters here is a story for you! I can’t enter my property I only have the App!"

Gosh. You'd think a guy who worked in IT would understand the importance of a way to enter when the app went down, really wouldn't you? I mean, backups and resiliency, and all that. I wonder if he even has two Internet connections at home in case one fails and he can't get back in?

People like this annoy me greatly - I work in IT and though Yale might be damn shoddy, for sure I wouldn't be embarrassing myself saying "I have no other way to get into my property except a smartphone app dependent on a third-party". For a start, I'd have a manual key lock or a bypass code on a secondary lock that overrode it, even if I never really needed to use it.

Powerful forces, bodily fluids – it's all in a day's work

Re: Monitor

"Clearly the above commentators have never had the fun* of having their 'known good' hardware killed by whatever was causing the original problem."

So you mean.... you change one part. No change. Then you have to move your diagnosis further up the chain, until you find a dodgy item (i.e. a PSU that doesn't work on TWO motherboards, or that you swap out and it powers up), or until you *test* an item more than a quick check of "does it function immediately and perfectly in all regards"... by, say, sticking a PSU tester on it.

I have in fact had MUCH more complex diagnoses than that (recently someone put a digger through a 450KW supply cable and blew up £20,000 of hardware, that we restored by diagnosing and replacing only £3000 of parts that were ACTUALLY faulty). And you ALWAYS start with the same diagnosis. In that scenario. I wouldn't have got through more than two motherboards or PSUs before I suspected a much more serious problem. In fact, likely one PSU and maybe two motherboards - when the known-good MB is replaced on the same PSU and doesn't work, I'd suspect the PSU, replace that, and then when that didn't work, I'd go once up the chain (checking the power sockets and cables by using a known-good one of those).

Then when you know that it's the MB/PSU end / combination that's at fault... pull both, check one level up to make sure the power isn't blowing the PSUs, put something else in place, allow the user to continue work, and then carry on your diagnosis of the faulty parts back in the IT office (e.g. with a £10 PSU tester) before you do any more damage. In fact, at that point, I'd put the previously-known-good MB back on a known-good PSU, realise that it must have actually BROKE during testing despite being known-good, and ditch the PSU that did it, testing it only for curiosity.

Four PSUs and three motherboards again reeks of "I didn't narrow it down sufficiently and just kept guessing / throwing hardware at the problem".

Honestly, the second the "obvious" swaps don't work, I'm replacing the entire kit to shut the user up, breaking out multimeters and testers back in the office (where there's an isolated mains and network circuit, because you are playing with 240v and PSUs!). There's a reason I have a drawer full of nothing but cheap PoE testers, mains socket testers, multimeters, PSU testers, network cable testers, battery testers, discriminating continuity testers, telephone line testers, etc. And that drawer cost me an awful lot less than even the price of the cheapest replacement motherboard. (I am not one of these people who wants/needs £1000 high-tech testers... if it doesn't pass a basic test I don't want it, and if it needs £1000 of tester to tell you if it works, but £50 to replace it, I'll just replace it.).

P.S. Yes, we do all our own cabling. We manage and repair all the PCs and devices on-site. Hell, we do the CCTV, access control, and everything else you can imagine ourselves. We do not have a huge stock of spares (currently about 0.1% of the deployed hardware) or parts. I don't have a huge test suite or dozens of techs - 1 per 500 devices. I don't have a stupendous budget, or warranty support etc. on anything but the server-side. The way we cope (more than comfortably) is by proper diagnosis.

Re: Monitor

Because "elimination" is not in most IT guy's diagnostic process.

Yes, it drives me mad too.

The other is when they "eliminate" something, then for some mysterious reason proceed to return to it and eliminate it several more times after exhausting themselves on other things because they don't have the nous to go further down the line and/or imagine a test that would isolate the cause.

"X isn't on the network".

Okay... ping it. Is it turned on? Is it cabled in? Is the cable in the wall? Is the cable good? Is the wall cabling good? Is the wall socket good? Is the other end patched in? Is the switch working? Is that switch connected upstream? Is that switch port configured properly (e.g. VLANs, MAC filtering, etc.)? Is that actually the IP assigned to the device? ...

All these things are "simple" and obvious for an IT guy, or should be. But I've watched supposed IT professionals stare mystified because "obviously the wall cabling must be good" despite the fact that they haven't bothered to test any of it by even the simple precept of putting something else on the cable.

I've literally sent technicians back repeatedly for nearly 6 hours straight because a device wasn't online despite being powered up and working... only to then have to go do it myself and discovering that the cable between the device and the wall was faulty. Replace the cable, everything came up. They literally didn't bother to eliminate along the path, instead stabbing at random at causes, rebooting switches, etc. The reason I kept sending them back was to teach the lesson - you can waste an entire day just stabbing at causes and making yourself look an idiot... or you can apply a proper diagnostic process in a linear fashion until you find the cause (or, even, multiple causes).

The value of diagnostic thinking is greater than you think.

Microsoft Windows 10 October update giving HP users BSOD

Re: IPV6

Sounds like a good way to make sure you don't use Edge or Windows Store to me.

Noted for if/when I ever upgrade to Windows 10... turn off IPv6...

Hey, it's almost like you should wait until the user is at a point that they feel confident they have backups of the system and everything they need before you push updates to them.

Almost like... you know... you should ask the user. "Hey, I'd like to update now... are you ready?" rather than just forcing it through anyway.

Hell, maybe even a 30-day "Have you backed up yet?" nag might not be enough... maybe they are desperately trying to get the system backed up to a sufficient state, and are struggling to do so as a home user on an OS with PRECISELY ZERO GUIDANCE on how to do just that, or restore it if it goes wrong. So maybe someone should a) ask them to backup, including asking them if they'd like to see the backup tools available, b) not proceed with an update until a backup has been taken and verified, c) not proceed with an update until the user has said "Yes, I have adequate backups" no matter how long that takes.

And maybe, just maybe, put an System Restore feature into the SO that actually fecking works?

Gosh, I wonder what the easiest solution would be to this dilemma if you don't want to hand-hold your users through this, but also don't want to trash their systems by updating before they've managed to take a backup.

I don't know... allow them to indefinitely postpone updates maybe?

Here you go, cloudy admins: Google emits NATty odds 'n' sods

Re: Still amazes me how oblivious/stupid some companies are

Once they're inside, how they get the data out is really a secondary concern. NAT isn't going to help them or hinder them.

But a default-allow on outbound packets is the silly thing. Possibly acceptable for a home machine, certainly not for any major service.

Samsung Galaxy A9: Mid-range bruiser that takes the fight to Huawei

- Non-removable battery.

- Costs more than most cars I've owned (and they've always lasted longer than a year, up to 10 in some cases) and certainly more than I've ever paid for every phone I've ever owned collectively.

- Four cameras? I mean.. .why?

- No waterproofing or wireless charging - I'm cool with that. If only that had saved some money, eh? It's almost like it's a freebie that costs nothing that they throw in as "another feature" on all those other phones...

Hell, I can't even justify the junk that is the J6 for £199.

And they wonder why they don't own the market?

PINs and needled: Experian site blabbed codes to unlock credit accounts for fraudsters

Re: Can someone tell me why?

There's no such thing as a credit score.

It's literally a number made up by a single entity, and has no standardisation or correlation to any other number. You can't compare them, you can't predict them, you can't even choose a threshold (GDPR says that a human must now evaluate if the customer demands, not a computer score). They are literally a fabrication and any website that claims to tell you your credit score is no different one telling you how many you rate out of ten on the sexiness scale.

As such, no credit decision is taken on the basis of "at least 900 on your credit score". It doesn't exist like that, and isn't processed like that, and when you do a minimal/statutory/DPA request from the credit agency, that number never appears.

Because the data they hold (what you pay for, when you pay it, how much you owe to whom) is the data that decisions are based on and every single credit-giving entity has their own criteria based on that data that has nothing to do with the credit reference agencies or any made-up "score".

The reason they won't lend to someone like you with 999/999 is precisely stated in your comment: You don't have any credit, and "You're never missed a payment". You're not profitable to them. And even no credit history at all is a red-flag so they won't lend to anyone who doesn't already have some form of credit history. It's a reputation score of "would he pay me back" - when someone who's never needed credit in their life suddenly asks for a loan, the risk is enormous - you have no idea if they're just gonna cut-and-run.

I made my "score" on one website drop from 700 to 100 by asking for a Vodafone SIM three times, and never receiving / activating any of them. Literally, I did nothing else, owe nobody any money, never even got to give payment details but "multiple credit requests" is considered a sign of desperation, so they hurt you for it so they don't put themselves at risk.

Credit scores are made-up nonsense. Credit references are basically subjective and there to profit companies giving credit. Actual credit for daily life shouldn't be required except for the major unaffordable items (housing is about the only thing). That someone asks for credit for home or car insurance - that's a red-flag. They can't afford to pay an annual lump sum, but they're keeping their car in good nick are they? Credit shouldn't be required for that. But we've taught our kids that that's okay (I blame Direct Debit a bit, but most essential DD's are actually zero-interest and cheaper than the annual payment). Telephones and mobile - I covered that. No. Buy.

But in all these other places you're ASKING for credit, when you could operate without credit. You're asking the gas company to lend you £200 for gas and you'll "pay them back next month". That's what you're doing. It's perfectly justified but also not strictly necessary. Nowadays pre-pay with a smart meter means you are on a monthly recurring pre-pay "contract" that you can cancel at any time and never get into debt for. That's no worse than a DD of credit on your account, in effect.

I'm not saying it's not the norm. I'm saying all those things - apart form housing - you do actually have a choice on, but instead choose to pay money to credit reference agencies and credit middle-men who are paying for your car / phone / etc. and then taking their percentage on top.

100 years ago, you literally didn't have a choice. You had the money or not, and lenders were not to be used for minor things. Nowadays, every 18-year-old fights for a credit card, phone contract, monthly car insurance deal, car finance, etc. the second they are of age to do so. Sorry... no sympathy.

(P.S. I have credit agreements. I'm no martyr here. But I do everything I can to ensure they're affordable, as well as ensure they are necessary and that I have a backup plan should something happen - lose my job, etc. And, no, that doesn't mean payment protection insurance! If you said to me tomorrow that you're cancelling all my credit agreements that I have in place... you'd take my car from me and have to give me back more than enough to buy several new cars, or I could dip into what I have and buy it from you - and even that is *literally* because I was forced to move out and live on my own, doubling my expenditure, and therefore spending the money I had put aside to pay off the rest of the car... halfway through the credit term).

Re: Can someone tell me why?

I'll give you the "ability to get a place to live", because credit checks are done on both renters and people taking a mortgage.

However, EVERYTHING else you state is either a) optional in that process or b) you expecting people to give you free money to do so.

To get a mobile phone? Nope. I have one. No credit check. I bought it.

To get a phone connection? Nope. I have one. No credit check.

To get a credit card? Yes. To get a card that functions like a credit card? No.

What I'll add to your list is "bank account" but - again - you don't really need them unless you want them to give you free money - overdraft or loans.

If you want people to give you free money, yes, that person will use a service like this to check who you are.

If you don't want people to give you free money, you don't interact with them.

And the only time the average person NEEDS (not chooses to) someone to give them free money is... when applying for a mortgage or possibly a rental agreement.

I hate them with a vengeance, and credit ratings are the most backwards things I've ever seen in my life. But the way to stop them is to NOT borrow money, and then pay them the interest for having done so. Then they lose not only your applications to them, but also all the money they would have made from you.

That we live in a society where people are perfectly happy to give away their information and sign up to a loan in order to purchase an over-priced luxury that they use barely 1/10th of its capabilities... that's just a sign of the times. There are perfectly viable alternatives called "save up" / "buy outright" / "live within your means".

You can hear a PIN drop... All quiet on the mobile broadband speed front, says network watcher OpenSignal

Re: <Title is optional>

Could just as easily be better backhaul, or more towers, or just better prioritisation.

They're never going to know from crowd-sourced data, and the mobile operators aren't going to discuss internal technical affairs.

To be honest, speed isn't so much an issue. I'd happily halve my "max speed" if I could more data for the same price.

On a Three mobile broadband SIM, I get more than enough bandwidth even at peak periods to watch all my telly over it, what I don't get is enough data to cover what I want to do.

And Vodafone (the only people who give more data) are still too stupid to allow me to order a SIM despite the fact that they have a better deal with all the TV channels and big websites not counting towards your data allowance. I can't do anything on two accounts I "registered" and ordered a SIM on until I activate the SIM, but haven't seen any SIMs at all, and signing up with another email just starts the process again.

(P.S. No, just because you have a 100Gb SIM does not mean that you can tether / mobile broadband for 100Gb, and I use my SIM as a broadband replacement for the home network, not watching all my TV/movies on tiny phone screens tied into 36 month contracts).

But the fact that I can use a 4G SIM in a cheap Huawei box off Amazon to run my entire household is pretty impressive and shows you that the "max speed" doesn't really mean much nowadays. Even my Steam downloads happen just as fast as when I used to have a broadband line.

Apache OpenOffice, the Schrodinger's app: No one knows if it's dead or alive, no one really wants to look inside

RHEL is always behind the times.

RHEL 6 is based on Fedora 12 from 2010.

If RHEL don't support it - then they don't support it and you're on your own.

Fact is, they support older versions only.

Blame RHEL, not OO (and I'm no fan of OO!), and take that blame and use it to influence your decision next time you use / pay for a distro (i.e. go to ANY of the other distros that supports the full version of modern OO if that's what you want...)

This is what happens when you tell developers who are working for free to "get on board with our methods or bugger off".

They have a tendency to bugger off and not come back. Or, in this case, bugger off, make something better, steal your entire userbase and then laugh at you.

Sorry, but AOO is dead. Oracle killed it many years ago. LO gets updates all the time with significant feature changes and constant evolution.

I actually JUDGE the Apache project people for allowing it to a) happen, b) continue, c) be endorsed, d) continuing to distribute the old crap codebase that people can barely compile.

Almost the first few months of LO's existence was "rip out all the rubbish and put in a normal build system". It wasn't until they did that that anyone contributed anything useful. They then spent many years translating obscure German code comments and ripping out code that did nothing and did it badly.

World's largest CCTV maker leaves at least 9 million cameras open to public viewing

Re: Security? We've heard of it.

"Regardless of all the stuff about VLANs, you could check out the building remotely and use the information to find out the best route and time to break in, and delete the evidence afterwards."

No, you just wear a balaclava. Done.

Nobody in their right mind will break into a building and then try to hunt/destroy the cameras. Mostly because they'll almost always be synced to off-site storage, cameras often comes with SD cards inside to double-record all footage nowadays, and the actual reliance on "roll the camera back" is fading fast in favour of "the camera just texts me when it detects movement on an internal camera, with a copy of the last 30 seconds of the footage" (note: all perfectly viable without third-party cloud servers).

Honestly, if it's an average private home, the police don't even have the time to obtain footage and unless they pull up with their car number plate facing the camera, or look up into the camera, you stand precisely 0% chance of identifying them. (Source: Three police incidents of burgled neighbours with captured footage of vehicles and burglars).

If it's any property that you need to keep more secure, that footage is stored in a secure location and mirrored (you tell me where that network cable I plugged into the camera is actually recording TO... could be anywhere in the world, synced to an off-site backup, sitting in a cabinet anywhere on site, accessed live over a VPN, etc. etc. etc.). You'd have to smash all the cameras you passed (which is why they are vandal resistant), pull them off the wall, destroy the cards inside them, find the NVR (or NVRs!) on-site, destroy them too, and hope that in all that time it never got to send out a single message, alert, alarm signal, footage or backup off site.

P.S. any modern NVR has "camera blackout" alerts that can detect obscured / disconnected cameras and alert you in a number of ways. You have from the time you smash the first camera, until the time the security company van arrives to destroy all traces of the CCTV system.

P.P.S. CCTV is not there to roll back and see what people did. That's just one function. It's there to alert someone to something unusual. Like burglar alarms - there's no point getting home and the light is flashing and it's been going off all night and everyone ignored it. At that point you KNOW you've been burgled. You fit a burglar alarm to alert someone who'll do something about it quickly - like your neighbour (highly unlikely), a security firm (better, but expensive), the police (yeah, right, they don't even come out for persistently-ringing alarms any more, they tell you to call Noise Abatement), or... the best option in the world... you. By texting your phone and saying "Internal camera detected movement" or "Lost contact with Front Camera".

You have to notify the only person in the world who care about your property - which is you. That's the function of CCTV, burglar alarms, car alarms and anything else. Everything else you might "think" will happen is a nonsense. I hear a car/house alarm literally every night. I do precisely zip about them. As do all my neighbours. (Source: three house burglaries, nobody "heard anything", several site intrusions, vandalism, burglaries, thefts, not a single one caught in the act or discovered until the next morning).

I supply CCTV footage from large sites to police. Pretty much, it's useless and nothing comes from it. (Source: Three house burglaries, plus dozens of site burglaries and vandalism: convictions - zero, arrests - one [a teacher that was arrested for restraining a teenager from beating his mate up, I kid you not, the guy was never able to work in a school again], time spent - literally MONTHS of hunting footage).

The reason it's on the wall is so that people can see we're watching, and so that the guy who's in charge of the site at night can see whether the banging outside is a gang of kids, or a loose fence panel before he puts himself in harm's way. I guarantee if there's someone actually doing something, he will call the police, but only after he checks the LIVE footage. The historical footage is there for a court many months in the future, if necessary, and is usually so pitiful as to be useless.

If you don't know this, I suggest that you've never managed CCTV or been asked to provide footage to police after an incident. Note also: Approximately 70-80% of the thefts, break-ins, vandalism, intrusions, etc. that I've ever dealt with in my professional life - there is ZERO CCTV footage, even with dozens and dozens of cameras around all the places I've worked.

Re: sure no one is watching

"Researchers find way to tweak CCTV camera IR LED's to 'see through' Post-It notes".

Re: Security? We've heard of it.

To be honest - for home use, yes, that's pretty devastating.

For anywhere that matters - are you really allowing your cameras on the same VLAN as anything other than other cameras? Are you really giving that VLAN Internet access? And do you really need to allow viewing of those cameras remotely from random IPs requiring port-forwarding etc. that you couldn't just do over an approved VPN to the right VLAN?

The kit is dodgy, whether it's £2000 big-name cameras or £20 Amazon specials, it shouldn't need to talk out like this at all, and thus you shouldn't let it. If you don't let it, it can't be used as a launching-off point to the rest of the network even if entirely compromised, and can't be found just by trawling the Internet for open-ports.

Hell, my own users can't ever get to the point where they can see the cameras on the network themselves, or any of the NVRs. They can only connect to a single machine which straddles the CCTV VLAN and provides them access via a logged and audited relaying portal which then mirrors some of the RTSP streams that the NVR provides from the cameras it records 24/7.

The IoT problem is as much about people just throwing stuff on their systems as if it'll magically configure itself securely as it is about devices coming with poor defaults and dodgy cloud portals.

Microsoft deletes deleterious file deletion bug from Windows 10 October 2018 Update

If they hadn't allowed every-man-and-his-dog to trash my My Documents folders so that it more resembles a list of every manufacturer's idea of what to call their product folder, with no useful files to me in any of them, and which stay there forever, maybe people would actually use it.

And maybe you could do proper user-data / program-data separation such that programs NEVER have a need to iterate or access such folders and the user can choose what they do with their own data and how to organise it completely outside the scope of where a particular program feels it should shove "My Cyberlink DVD Projects", etc.

We need to move to a container-style where programs each have two folders: Program Data. User Data. Anything saved in User Data *CAN* be accessed by the user, but the program can NEVER access any other file the user has. The user only ever sees a collated list of User Data for all programs that they CHOOSE to see (i.e. I don't care about seeing my Cyberlink DVD projects as I only ever access them from Cyberlink software, etc.) - kinda like "Add to My Drive" / "Shared With Me" in Google Drive. I mean... this is what all the Documents and indexing junk in Windows is SUPPOSED TO BE FOR.

Similarly if the program then can only access the data it's GIVEN by the user, and the data it creates itself, it can't trash stuff or snoop into everything in My Documents (as it can currently do). Removing the program is a simple choice - delete the Program only, or the Program and the Data? Done. Gone. No traces. Finished. Out of here.

Then the OS would NEVER have to mess with user files, redirects or anything else. The programs wouldn't be able to either. And I'd have a single storage for any of 20+ locations I choose to put things if I forget where I put them, without them cluttering up with everything from My Music to a folder for every damn program I've ever opened.

Hell, use your brain and the registry could work the same way. And you could literally run a program and NOT give, say, GTA V access to all your CAD documents, where one slip of a temp-file removal code or a bit of macro could wipe out everything you've ever stored. How amazing would that be?

We honestly still don't design software or computers properly. There's literally no need for this - and we still do it on Windows, Linux, Mac and Android (Android, ironically, gets closer than most!).

Program in one folder. Data it creates / requests in another folder. Do it properly and they're nothing more than hard-links to the real file or even copy-on-write links so that even if program X thinks it's trashing your hard drive, it actually isn't, only it's own view of it. Use things like Redirection, Shadow Copies and Indexing properly and you ever get an "immutable" user space that you can give to programs and roll-back when they mess up, while your documents were always safe and sound.

Do it *really properly* and you could even fake "Yeah, let this program think it's on the net / accessing my files / modifying the registry for real but just emulate the changes inside a container for it" for compatibility with those programs that feel they MUST be able to write to C:\

Re: *** Be careful *** Also new in 1809, changes to Disk Cleanup Tool,

Except if you had OneDrive and AutoSave it similarly trashed files.

Never attribute to malice what can be explained by sheer idiocy.

(For a start, why physically delete those files rather than "Recycle Bin" them?)

On the third day of Windows Microsoft gave to me: A file-munching run of DELTREE

Yeah, you remember that "we'll push updates automatically and you won't get a choice in the matter thing"? Yeah, that's when I stopped upgrading.

I can only imagine why that was, and what I could have foreseen happening in that respect, and what I said would happen when they stop doing in-house testing and start using the world as a guineau pig.

P.S. Not the first Windows 10 upgrade/update that I've heard of that just trashes the user profile. I have at least three documented cases of people upgrading from 7 or 8 to 10 from the forced update and then discovering that there was nothing left in their documents folders.

And, of course, they didn't get a chance at a rollback or to say "go away, so I can backup everything in my own time" before it was foisted upon them.