Posts by Lee D

Use Brexit to save smokers' lives and plug vaping, say peers

Bloody people, imposing regulations, telling us what we can and can't do, raising the taxes on cigarettes and making us move to vapers instead "for our own good", without public consultation... what right have they got to interf...

Oh, hold on. Nope, sorry, we're only allowed to say that when it's the EU doing it, right?

(Always been a non-smoker, for reference, but if this was the other way around, I could easily see everyone jumping on the bandwagon of "bloody eurocrats telling us what to do"... Strange how now the EU aren't a factor it's STILL the same kinds of rules being imposed on people without a vote, no?)

4-day Fasthosts outage: Customers' sites go TITSUP

I don't want to rain on your parade but weather or not you hide behind a clever pun, you're just precipitating the opportunity for cloud services to be seen as only a fair-weather solution.

I mean, come on, it's not all sun and rainbows in IT, I know, but coping with the floods of information coming into a business isn't easy...

New ISS crew will spend their time bombarding computers with radiation

Surely bombarding devices with radiation is something more sensibly and cheaply done on the ground. I mean, sure, measure the radiation a square inch in space receives, but then surely you can just replicate that - without other external factors - on the ground much more cheaply that putting even 100g of kit onto a rocket?

And what answers will you get? Yes it works, or no it doesn't. Either way, you haven't proved much as we have radiation-hardened kit on Earth already, and commodity hardware in space already (don't the ISS all use off-the-shelf laptops?), and we know when normal kit starts to fail and when extra protection is not necessary, don't we? Don't we have an awful lot of satellites and other equipment a LOT further from Earth's protection running around out there?

And I thought the point of ISS was that it's inside an orbit that's relatively safe for astronauts from the radiation. Otherwise it would be much further out where it could do more useful science, and maybe even be geostationary.

Facebook ‘glitch’ that deleted the Philando Castile shooting vid: It was the police – sources

Confiscation for the purposes of preservation of evidence would be okay, so long as it was all signed off and sealed properly.

Going into her Facebook account and pressing Delete or even adjusting the visibility? That's illegal tampering of evidence even if no "direct harm" was done by doing so.

Just pressing the buttons on a logged-in phone could be construed as such, as you then have NO idea what MIGHT have been in there before the tamperer got to the it - cop or bystander (and if it's a modern phone with encryption and flash, there may be no way to recover whatever you deleted, or even a way to tell that you deleted something).

It was deemed illegal to delete photos from the cameras, or even force photographers in public places to delete them by making a scary policeman do it themselves. This is exactly the same but happening immediately after a potential murder / attempted murder of a police officer (if there were genuinely at threat of death from the guy). It's a lot more serious.

Unmasking malware in TLS connections? It can be done, say Cisco researchers

Then what part does TLS itself actually play? Almost none.

It's like looking for a certain port-number, when what you're actually interested in is "is the same packet coming from thousands of different locations, simultaneously, in a spike, unannounced, and the follow-on transactions and replies never acted upon", etc. Not "what ciphers were enabled".

Well, that's a load of nonsense then.

Even if you can spot an outdated TLS being used by malware today, tomorrow when you spend a fortune on kit to block it, they'll just update the library - meanwhile all your old legacy software that uses TLS but not with critical data will get marked as malware and blocked.

Microsoft's cringey 'Hey bae <3' recruiter email translated by El Reg

I was staying down with my ex-, looking after my 7-year-old daughter not long ago. Had great fun, especially once she dialled into the sense of humour again and didn't get upset just because I was mocking her.

One the last evening, she got ready for bed and was hanging around in the living room with me. I said it was time for bed. She then said a word that shocked me to my very core and caused me to send her to bed immediately with stern words.

Chillax.

I mean, really? RyanAir speak? How dare you young lady, off to bed with you now, this instant!

Although it was in jest, and taken that way by her - she especially knew that she'd "scored a point" against me with that! - I was also semi-serious. I think I'd have preferred her to use a four-letter word, so long as it was used in the correct manner, appropriate and in-context.

But "chillax"?! Really? From my daughter? Hell, no.

This email reminds me of that.

Get ready for mandatory porn site age checks, Brits. You read that right

Re: Mandatory Age verification on porn sites that are not hosted in the UK?

"No problem. The referendum result abolished Abroad. The World now consists of Blighty, and some empty spaces on the map filled with mythical creatures".

And that's a problem how??

I refer you to the country known as the United States of America.

It does baffle me.

10Mbps over 100m has been available since... well, 10BaseT. And there have been WAN technologies available to do such things for decades, over even the flakiest of copper.

The core problems lies not with the end mile, surely, but with providing provision to the exchanges. And, let's be honest, are you really not going to need to upgrade every exchange at some point anyway? Surely it's now inevitable.

Linux letting go: 32-bit builds on the way out

Re: Thinks Bubble

They stopped supporting the 386 in 2012, when the processor was released in 1985 and Linux in 1991. 2012 was 6 years after Intel actually ceased production.

The first chips to support 64-bit were in 2003 / 2004. Do you really have chips older than a K8 or Pentium 4 running around in active service? That's 13 years. That's not bad at all. You probably can't even buy the early 64-bit capable chips any more, and haven't been able to for years. Certain Atoms etc. were cheap for a reason - like buying Cyrix was, back in the day.

Seriously, all your stuff moved to 64-bit a decade ago. You can't honestly have been using more than 3-something GB in all that time either. That's some serious long-term support, and by the time they are actually removed (look at the timeline!) they'll be so old as to be unobtainable. Which is exactly their argument - how the hell do they test things if they can't build several compile-farm computers of them?

Nobody is stopping you, in several years time, running an old kernel or another distro and carrying on. But even Ubuntu LTS is only 5-or-so years at best, and they're not going to include it in the next one, so you have more than adequate warning.

Replacement machines to usurp any machine of this era are literally junk-heap material now.

Man killed in gruesome Tesla autopilot crash was saved by his car's software weeks earlier

My car has cruise control - I consider that the most dangerous function on the car, being the only one that can accelerate against my will (and no, it does NOT do it smoothly enough in my opinion and will happily burst forward to reach its set-speed if it resumes from after manual braking).

Now, my car is a late 2015 model, so it's not exactly early tech for such a thing, but I just don't trust it. I deliberately refused the option for "lane control", etc. because I just consider it far too dangerous when I'm the one who's going to die (not the car) and I'm the one responsible for other's deaths (not the car).

Given this guy's previous video, I'm going to say he's inattentive and complacent. In the US, you are ON the side of the car that that first truck approached him from, and he doesn't see it, doesn't notice it approach, until LONG after the FRONT WINDSCREEN DASH CAM (obscured by the left-hand window support!) can see it could be a threat and the car still takes a little while to decide it's a danger.

And what does the driver do / notice in that video? Nothing until the car swerves out of its way.

Meet the grin reaper: Password manager now snaps login SELFIES

Re: Photos?

Well. At least a padlock made of cheese would keep the lactose-intolerant away...

Re: Photos?

Better question:

How this is any easier or better than:

"A user at IP x.x.x.x just tried to log into your account. If this is you, please press Accept. Otherwise press Reject"?

Because, for sure, I can't think of anything else that would make a difference between those systems. "I could send you a fake request with a fake IP"? If I didn't request login, why would I press it. And if I got four or five logins at the same time as I login, then honestly you're compromised anyway because someone KNEW you were logging in at that point.

And any serious usage of both systems is likely to be hindered by automated spam after a while. After the tenth incident of someone not you trying to log in, you're just going to turn the feature off to stop it bothering you.

A compromised device is game over anyway. They might not be able to fake the photo but they'll just wait until the photo is from you and then intercept it to gain your login or whatever.

I don't think this is anything new, groundbreaking, or useful over system that already exist (like just getting an email / notification whenever I access my account - even my server host does this "You just logged into your manager control panel. If this was not you...").

Maplin Electronics demands cash with menaces

Re: Remember the days...

Indeed. I still have a drawer full of components labelled by their Maplin number because - when originally purchased - that was the easiest way to find their circuit diagrams and specifications. It was easier to keep their catalogue, and label by the Maplin number than try and remember or read the tiny writing on the chip / transistor / whatever.

Nowadays I don't stand a chance finding that kind of information, even in store for products they have on the shelves.

From what I can tell, they said "Oh, Dixons has gone bankrupt, maybe we should follow their business model and put overpriced tat out for a handful of idiots that don't know what they're buying, not stock anything of use to people who just need a quick cable or connector, fill the rest of the shop with toys, and then spend all the rest on pointless morons wandering around asking if you need help and by extension babysitting the local moron on the difference between a USB cable and a 220v power socket". Because that's basically exactly what they've done. And it's been about as successful for them as it was for Dixons.

I knew the writing was on the wall when I walked into a Maplins once and walked out again WITHOUT BUYING EVEN A SINGLE PIECE OF JUNK. My wife nearly had a heart attack. Seriously, I once picked up two Video Backer ISA cards in there in the reduced bin. I have no idea why to this day. But I bought and paid for them. When even those kinds of purchases stopped, it was game over for them.

Dell tempts hordes with MASSIVE DISCOUNTS on PCs

One of the many reasons that I've never had a Dell on site that was purchased by me.

Nearest they got was a PowerEdge that I inherited briefly before retiring it in favour of a much more powerful, cheaper and smaller server.

Honestly, they phone me up - via various resellers - and I tell them where to go on the basis of the name alone.

And people say to me "Oh, so we're getting some new Dells or something, then" and I give them a look that explains why their answer is quite that bloody stupid.

BOFH: Follow the paper trail

I just spent 20 minutes looking for a blank piece of paper and a pen. And I'm in my office.

This is IT. We don't do paper. Unless it's at high-volume, double-sided, fold-and-stapled, and then given to someone else.

Google Keep has replaced Post-ITs

Email has replaced everything from purchase orders to stroppy emails.

Intranets have replaced everything from holiday forms to policy documents.

In fact, the only time I have to dig out paper (like now) is so that new users can write down their initial login details to get into all the above to access everything else.

Have never been sent on work training.

Certainly not externally.

I work in schools, so I've had to sit through - say - an hour of how to not beat up small children ("Child Protection"), or how not to kill myself when using a 20cm high step, but that's not the same and it's almost always in-house.

Strangely, all the talk of training evaporates when you explain quite how much use an MCSE is going to be for someone who's run Microsoft networks for a living for the last 15 years, was originally hired because all the previous guys (who all had certifications) made an absolute hash of stuff, and then suggest alternative, more appropriate courses pitched at the correct skill level, which cost almost ten times as much. Amazing how much it jumps down the priority list after hovering somewhere near the top when they thought it was just a case of drop £500 in someone's lap.

"Continuing Professional Development". A.K.A. "keep doing your job".

Biz security deadline knocked back 3 months 'cos Brits ignored it

Re: Bah.

I work for a school.

We were told, without much ceremony, that we needed to upgrade in order to continue making BACS payments. We upgraded. It wasn't hard.

As far as I know, nothing has changed as at least one of the finance machines is still on an older version and that's the one they actually pay BACS from (the others are all backups and secondary authorisations etc.). Never just blindly update without keeping the old system around for a while, just in case, that's my motto.

To be honest, I wouldn't be surprised if, when they flick the switch, lots more breaks than they ever intended and they are forced into another "extension", but we hadn't heard anything about this one actually happening and - to my knowledge - there's nothing actually happening differently at the moment.

It does make you wonder why something like BACS is still dependent on in-computer (and browser) support for things like TLS, however. You'd honestly think it would be better off as an app for various systems with its own root certificates and verification that can be updated independently of the underlying OS.

Microsoft's paid $60 per LinkedIn user – and it's a bargain, because we're mugs

A TV ad costs £2000 minimum to air and might reach hundreds of thousands to millions of customers. As such, they can actually "fund" the TV channels that air them even if they cost £10,000 or more to produce, and still make profit for the person producing them.

And peak spots can cost £1,000,000 and up for 30 seconds of footage on a single channel.

Online advertising is several large orders of magnitude from anything like that, even video advertising, even splatted over the front page of something.

TV actually has a viable revenue stream, which is why there are so many TV channels - and still profiting despite there being so many competitors just one station up.

But online advertising on any single website? There's little to no value there.

Why is the graph worth that much?

Honestly, where does this Monopoly money actually come from, exist or go to? Advertising? CPM's are in the pence range nowadays. You can't sell the data directly, and if you can they certainly can't do much that generates revenue with it and so they probably won't pay a lot for it.

LinkedIn Premium costs a stupdendous fortune, and I imagine 99% of their users aren't paying that. And all the adverts in the world aren't going to make most of those people part with a penny.

Literally, where is this revenue stream's source?

Java API judge tells Oracle to suck it up, quit whining about the jury

Nope.

Counterfeit means you were passing it off as the original manufacturer's when it wasn't. "Imitated against". You're literally selling a "Sony" battery that's not been made by Sony, or whatever.

But after-market third-party compatible products (e.g. cheap batteries, chargers that don't try to pass themselves off as genuine Nokia or whatever) are a multi-billion dollar legal business worldwide.

They can't say their USB leads are "Lightning (R) cables" because that's trademark and counterfeit if they aren't, but they can say it's a cable compatible with an iPhone or whatever.

That's the reason that the whole "they can make a compatible product" thing is legal - it's a huge portion of worldwide trade to make cases, batteries accessories, replacements, etc. that AREN'T from the original manufacturer. Otherwise you could kiss goodbye to everything like universal remote controls, and say hello to 50cm cables that cost the earth.

It's not illegal to implement a compatible piece of software. In fact, it's positively protected in law. The EU **ORDERED** Microsoft to allow compatible office suites and compatible file-sharing protocols. Enshrined in such law is that anyone can make a compatible product.

Google, et al, have not taken ANYTHING from Oracle that they weren't advertising publicly. In fact, they've implemented the ONLY POSSIBLE WAY to provide a Java substitute that could ever work. To reimplement millions of lines of code that interface with a handful of structure and function definitions that Java programs expect to exist. Those functions/structure HAVE to be named identically, HAVE to be in the correct order, HAVE to take the same datatypes. That's what Google "copied". But every single line of code that those functions have to actually DO their stated job is not Oracles. That would be prima facie copyright infringement.

It's like saying (but not exactly like this, because software patents are VERY different to hardware ones and don't even officially exist in the EU, for example) that you've built a computer that controls a piece of machinery. It issues up, down, left, right commands. Oracle are trying to claim that it's actually ILLEGAL to replace their control box with another control box that you've made yourself that issues those same up, down, left, right commands down the same cable. Not just that it would void your warranty, or they won't support it, but that you even trying is actually ILLEGAL.

Oracle are stupid. And "using" an API in this fashion isn't illegal at all. In fact, technically "using" an API is the absolute utter intent of creating one in the first place. This isn't "using" an API at all. It's creating a compatible API. Like making a computer than can run ARM binaries, for instance. Or, in this case, closer to making your own BASIC interpreter.

However, Oracle are not only trying to claim that me making a piece of software compatible with theirs is illegal, but that the API cannot even be used without their permission (copyrighted), and nobody can implement any program that replaces Java NOR interfaces with Java in any way without their permission.

They are so stupid, they are trying to argue that they should be allowed to destroy not just competitors but their own users. And the courts disagree.

Re: Dear Oracle

The case wasn't about whether it was code or not.

It was whether about it was copyrighted (which did involve whether it had any creative expression, but they were overruled at one point so they carried on in that regard anyway), and whether - it being the ONLY way to describe that interface for compatibility reasons - using it even if it was copyrighted would be fair use.

Honestly, Oracle are trying to make it impossible to ever use another companies public API ever again, or make anything even vaguely compatible. You can see why it might benefit a place that charges thousands of dollars per core to use a database. The rest of the industry all know that it would just destroy programming overnight.

Thief dresses as Apple Store drone, walks off with $16,000 in iGear

Given that it costs a pittance even for a cheapy replacement screen, fitted properly, I can't see that their resale value would be in parts. A "genuine" piece of glass is basically indistinguishable (and, in a survey of 500+ iPads and iPhones that have come through my office, no less likely to break - Apple products really are shitty and crack with the slightest drop, yet I've thrown my Galaxy at the floor any number of times - with the dents to prove it).

My repairers also tell me that they are almost impossible to remove without damaging because of the glues and pressures used to put them in there in the first place. It's basically "smash it again and replace it entirely" when they need to do that (misalignments, etc.).

Nope, the second-hand value of a stolen iPhone adequately reflects their real value. Almost nothing. Find-my-iPhone, IMEI blocking, unable to disassemble, and people are incredibly suspicious of Apple products that don't cost the Earth (the biggest giveaway, really).

Microsoft's BITS file transfer tool fooled into malware distribution

Re: Just get into the habit of setting up PXE-based WDS or SCCM

PXE = Preboot eXecution Environment (aka booting off the network)

WDS = Windows Deployment Services (aka installing Windows from the network)

SCCM = System something something Manager (google it! aka installing Windows and/or MSI software from the network).

But, to be honest, if you don't know that, that's part of the problem!

Basically, I press F12 when booting on a brand-new, fresh-disk machine (or an old dodgy one that has a software problem or needs updating), tell it to boot off the network instead of the local disk, and it then runs off and downloads, installs and sets up a Windows installation from nothing - including formatting disks, encrypting drives, joining the domain, installing software, etc.

And generally speaking, 20 minutes later, you have a working, ready-to-log-into full desktop machine with all your software and configuration on it, built to the exact same standard image as every other machine built the same way.

So when things mess up, catch viruses, have unexplained problems, lose their hard disk, or fresh machines come on site, you plug into the network, turn on, press F12 and twenty minutes later you have a room full of working systems indistinguishable from anything else you use on site, all ready for users to log onto.

If you haven't done it, and you work in the Windows side of IT, you are honestly wasting SO MUCH TIME by not having it that I would question competency.

Of course, other systems have equivalent services that do the same - I've done it for everything from DOS and Norton Ghost, to Linux via LTSP and/or Clonezilla imaging.

Re: BITS is not "fooled"

Agreed.

There's a shocking culture in many smaller shops of just "cleaning off" machines and, if no obvious evidence is left, assuming the machine is clean.

Just get into the habit of setting up PXE-based WDS or SCCM and standardised images so you can just wipe out a machine with F12 and a password, and put it back to a known-good state. Then you can pull someone's infected machine, stick any replacement in its place, F12 it and in 20 minutes they are back up and running.

Meanwhile you take anything off the old drive and then just F12 that back in the IT office, ready to go back on the spares pile.

Anything else is really just asking for trouble.

Honestly, a couple of weeks of setup and testing, and then 20-minute rebuild times across any number of devices you like. And standardised images make things infinitely more simply to diagnose and resolve.

Millions of 'must be firewalled' services are open to the entire internet – research

Re: Port Scan Licensing

Real world numbers?

Swamped, by orders of magnitude, by the sheer TCP traffic for the number of attempts to connect to port 22 (SSH) or 25 (SMTP) on a datacentre dedicated server on 100Mbps line, even when those ports are closed and have never offered a service.

Include port 80 and you're swamped by another order of magnitude as automated scans from virus-laden networks try to attack /phpmyadmin/admin.cgi or whatever, even if your site doesn't have any HTTP server running at all.

Passive port scans from security companies etc. don't even figure in the numbers. Even the automated port-80 bot scans (from Googlebot and a thousand and one genuine "research" bots) aren't worth bothering about.

But the junk trying to hit your SSH and/or send you spam swamps them all.

And in terms of bytes transferred, your genuine traffic on ANY service that you offer (even NTP pool membership, or a website, or an email server) will swamp them all.

TCP is quite an efficient protocol to shut down connections quickly, and you can have several thousand connection attempts in the same on-the-wire size of even the first few replies for a real HTTP response (i.e. someone visiting your website).

It's really not a factor to worry about, and nobody bothers to filter. Rate-limit? Possibly, but you've already received the packet by that point anyway. But nobody really bothers to filter out port scans on their upstream firewall, it's not worth the effort for the traffic you save.

I remember when I started at my current workplace.

All kinds of stuff open and port-forwarded for little or no reason.

Everything open "because otherwise things don't work".

And nobody paid attention to whether that port 80 that software needed was port 80 OUTGOING or INCOMING so they just opened everything "just in case". And in 90% of cases I say, it actually just wanted port 80 outgoing (i.e. so it could check for updates) but it was having everything exposed.

I came in, put in a deny-by-default firewall, waited for people to shout or things to stop working. Apart from a few things that turned out not to be related anyway (but it took a lot of convincing), and opening up - say - the telecoms remote access ports ONLY to the telecoms company instead of any passing IP, everything worked. And grc.com provided a "clean" sweep of the system - showing only the ports we were deliberately opening.

Then I put in reverse proxy - so even our "port 80" isn't really port 80 at all. It's just a proxy to the internal systems that don't need to be individually port-forwarded, locked down etc. and that only ever received already-filtered-and-IPS/IDS requests from the reverse proxy. As a nice bonus, the RP was able to SSL a few services that weren't capable of SSL by themselves.

Don't even get me started on the state of the RDP server configuration. Guest logins, anyone?

It's scary how often people on tech lines answer "Oh, just exclude our software/services/device from your filtering / firewall", and even scarier how often that's interpreted as a blanket exception rather than just poking holes where they are actually needed.

If GRC.com and/or nmap show that your public IP is putting out anything more than the explicit services you know you are providing to the world (e.g. SMTP, HTTP, RDP, etc.) and/or that those ports do anything more than ask for login details or filter requests from the very start, then you're doing something incredibly badly wrong.

UPnP is my biggest bugbear in a home-use scenario. A protocol that allows unauthenticated software on the local network to just request port-forwards from any external port range to any internal port range without user's knowledge or consent ("so that the video works"). I honestly just turn that off as one of the first things on any router I buy.

Freeze, lastholes: USB-C and Thunderbolt are the ultimate physical ports

What happened with the EU mandating a charging standard for phones?

Or are they going to leave it fifteen years and then look into a monopoly action against Apple costing more than it ever recovers, ala Microsoft vs EU?

MIMO is not a panacea by any measure.

In fact, let me use my favourite analogy.

In wireless communications, you are trying to shout to attract your friend's attention from across a crowded room. The people in the room are also doing the same, and holding conversations across the room, at the same time. Now try to have a meaningful conversation.

MIMO just lets you triangulate the signal. So you know your friend is over THERE so you cup your hands and direct your voice that way. Yes, it helps. Does it solve the problem when you have 50 people in a room all yelling at the top of their voice (and, on unmanaged systems, getting louder every time they can't hear a reply?) trying to talk over each other? No.

Infinitely more effective is wireless management, where you do what humans would do. You tell everyone to shut up (because they are managed by you) and then you point at who can speak at what point. Interference from non-managed entities still destroys the system but you get much closer to theoretical maximum throughput (bear in mind, the numbers stated for Wifi are basically theoretical maximums, in a vacuum, inside a faraday cage, for two such devices to talk to each other and you'll understand why it means NOTHING to have an advertised Wifi speed even in the same order of magnitude as a cabled speed).

I speak as someone with site-wide Cisco Meraki wireless - have you seen the price of that kit? It's horrendous. One of our point-to-point wireless links costs in the thousands and has multiple antennae the size of dinner plates. Hundreds of devices, inside acres of site. You aren't going to find better kit with greater range, throughput, management or coverage, And still Wifi is bog useless past casual browsing, collecting email and the odd remote device that you don't care about (weather stations, etc.).

Sigh.

And all wireless technology shares a common medium. Remember the days of 10Base2 or - shudder - Token Ring?

Thus the max speed of any wireless technology is DIVIDED by the number of clients in the same area simultaneously trying to do the same thing.

Whereas, cables? Cables can each do the full bandwidth all the time and the bottleneck is in the device they are connecting to, not the transmission medium. Two wired USB-C devices will have four times the bandwidth available than if they were to share a cable / the airwaves (1/2 vs 2).

The number of times I have to explain this to people about wireless is scary. There's a reason that servers aren't wireless, that infrastructure isn't (generally) wireless, and that the wireless things are low-bandwidth applications (IP phones, CCTV, etc.). Wireless is great for easy-connectivity to a shared medium that you can browse the net on. It's bog useless for transferring a 1Gb roaming profile across the network to your device, and will always pale in insignificance to cabled infrastructure - especially when you have more than a handful of clients trying to do the same.

Wireless video? That'll work great. For the first device to have it. And then there'll be a catastrophic collapse as people all buy it and flood the allocated frequencies with THEIR video too. You can compensate by ramping up the bandwidths and giving it more and more frequencies but - after a point - it just jams up with traffic or interference.

Whereas an isolated copper cable from the 10-50p / metre range, will connect you from 100m away and give you full duplex, full-bandwidth of whatever was supplying that wireless access point anyway, but one such full-connection to each cable you have.

Honestly, wireless is for guest wifi, convenience connections, etc. You don't use it for bridging unless you've carefully considered the full usage pattern of both ends, and you don't use it for primary infrastructure. Using it for video sounds like a disaster (but then, I'm working in a school where they are 32 huge HD displays all within metres of the next screen, so maybe my use-case is unusual? I can't see that offices aren't doing the same, though, especially shared-offices on multiple floors).

And the same applies whether it's 802.11-whatever, bluetooth, or some fancy proprietary protocol.

Juniper: Yes, IPv6 ping-of-death hits Junos OS, too

Re: I'll have a go at translating that into English

Or:

"We trusted external data without thinking about the consequences"

You've got a patch, you've got a patch ... almost every Android device has a patch

Re: Weurd

You remind me of those people who used to crow about Macs "being more secure" and "not getting viruses".

Even if your anecdote is true, it's a single data point. Do you deal in Android phone repairs or support? Then it probably doesn't mean much that your group of friends don't KNOW they have a compromised Android phone.

And even if it's true - that doesn't mean you aren't vulnerable and/or that it can't come your way. The fact is that people don't use smartphones for visiting random web pages as much as they do their PC. But that one time you do, your phone is technically more vulnerable.

And, honestly, when was the last time you CHECKED your phone? I don't run on-access antivirus, ever, but I still occasionally give my PC a sweep through just to check that my "don't do stupid things" policy has kept me safe. When was the last time you did that on your phone? Virustotal has an app that might detect malicious apps, but detecting a compromised base OS is much more difficult and you might never know about it. Literally, if you don't look, then you can't see.

And, yes, I'm an Android smartphone user. I wouldn't touch anything else.

Dell finds liquid cooling tech on eBay, now wants you to buy it

Re: Water cooled rack doors

I have seen many (and owned several) cars where the radiator hoses just pinged off or deteriorated to the point what it was quite likely if I hadn't checked. A hoseclip between you and disaster is really not what you want. Now, that's on a moving device, but I imagine rack doors aren't designed to never open either.

The biggest problem isn't the theory but the practice. The first idiot that "WD40's" a small section of the hinges will set the seed for the rubber to deteriorate rather rapidly (and catastrophically) in the next few months.

And though you can say "that shouldn't happen", when it does the results are catastrophic, affect a much wider range of kit than just that in the cabinet, and are maybe uninsurable.

Risk = probability (low) x effect (stupendously high).

To say that absence of that is negligent? Read the stories above where water-cooling with all the funds and impetus in the world causes more problems than it ever solves.

And what happens when the inlet water is colder than expected? Oh, dear, you have an untested scenario with possibly unknown consequences.

Yeah, I'm not sure that what you want in a datacentre when things go wrong is water, connected - directly or indirectly - to a metal plate stuck inside an electrical device, connected to every other electrical device in the building.

To be honest, even if they're using some oil-based liquid instead that is only cooled by the cooling towers, and it's non-conductive etc. still the mess from one leak is going to take out an entire rack in seconds before your fancy drip alarms get a chance to go off.

I think there's a definite case here for a risk analysis that says "Yes, it'll get more oomph out of our CPUs but if ANYTHING EVER goes wrong with this untested and new tech that we've spent a fortune on, we're immediately into losses".

Wi-Fi hack disables Mitsubishi Outlander's theft alarm – white hats

Re: I run an Outlander PHEV

"drive it away" is optional once you're inside the car with all the time in the world. Hell, you could just release the brake and tow it late at night, who's going to know?

Re: Yay, Yet Another Vehicle Hijacking By Maker Lazyness

Mk5 Mondeo.

2 x 4-way pads, with center buttons.

Cruise control - same as yours.

Vol+, Vol-, Answer phone, Hangup, Voice Recognition (one-time enable button), mute (mutes music and/or puts caller on hold).

21.

Re: Yay, Yet Another Vehicle Hijacking By Maker Lazyness

I bought a new car recently.

My criteria to the guy in the showroom was "I want NO extras, no fancy gadgets, no software junk, basic model."

He took me to a car with in-car Wifi,entertainment touchscreen, electronic handbrake, hill start assist, tyre pressure monitors, dashboard monitor LCD screen, built in voice control and bluetooth (including PAN connectivity) and no less than 21 buttons on the steering wheel (not including those necessary to drive).

I said "No, I said I want the base model, no extras"

"Sir," he said dryly. "This *IS* the base model".

Given that all the electronics were ON the car, not the car talking to something else, that it was manual-gearbox and not remote controlled (though that was an option) and they didn't directly interfere with driving (i.e. no lane-assist, parking-assist or junk like that), but again all options), I did end up getting that base model. But, hell, the amount of tech in it scares the life out of me.

21 buttons on the steering wheel is just ridiculous. And even with hands-free voice dialling / call answering for the Bluetooth phone in your pocket, I still refuse to answer calls when driving anyway.

I saw a video the other day of a guy in a Tesla, asleep. The car has auto-roll-forward for traffic, including auto-braking when it nears the car in front, and lane assist to keep you in the lane. But you should NOT be able to fall asleep while driving in a queue and have it carry on driving for you.

Sometimes I think tech has gone too far and there's no way back.

On her microphone's secret service: How spies, anyone can grab crypto keys from the air

Re: Mobile computing

Gosh, if only we could, e.g. put the radio outside the cage and join to it with a couple of wires? Then the encryption is behind the cage, and the radio is just a radio outside it.

Why is a Faraday cage not realistic?

So long as it doesn't cover the radio parts (in a desktop, zero, in a laptop, the screen, in a phone, the radio?), it seems eminently sensible to put in a Faraday cage, and it doesn't have to be a solid block of metal if you choose the spacing correctly, and I reckon you could even double-up part of it as a heatsink, no?

Two plead guilty to stealing personal information of millions

I have ONE email account.

I have a domain with forwarding, that has extra filtering applied to it, then - if successful - the emails are then forwarded to my "real" email account.

I get a LOT more than 2 spam through to that end account (at a major mail provider) directly, despite never using that address for anything else, and even more from the domain addresses (which are all unique and traceable to their source).

My email account is about 10 years old, my domain is about 12, I've been online with one or two email addresses since 20-something years ago. I've always followed those rules. And I assure you, I get a LOT more than 2 spam on any given address, let alone direct to the end account, let alone all together.

I have unique addresses for every company, person or contact.

I have my own email servers with anti-spam, DNS blocklists, greylisting, SPF, DKIM and everything you can imagine.

Those servers then forward onto a major mail service (and, for reference, I'm excluding anything that originates to that address which is NEVER used directly).

I never tick the "pass my info on" boxes, nor do I use any service that allows that.

None of my emails are on world-visible websites, where they could be scraped.

My website contact section is CAPTCHA-protected forms that email to a private address that cannot be read from the HTML.

And I still get spam. To some of those unique emails, to made-up emails that get caught in the catch-all after being sent from "reliable" mail servers, and a shed-ton to the major mail service despite it being the only one to have that address.

It doesn't matter what you do or how well you protect yourself, the lists are sold on. I even had one guy try to sell me educational furniture via spam and then, when pressed, I "discovered" what I already knew from the unique address they'd used - he'd formally worked at a major educational supplier who I'd given a unique email to, and when they'd left they'd taken the email database with them and spammed it. I reported them.

But, seriously, just buy a domain, make up addresses at that domain for everything, and block anything that ever gets abused immediately. And you'll still get a shed-ton of spam. Hell, after a spamming with a load of emails with "2" on the end, or random hexadecimal numbers in the username, I put in a "rule" that I use where - if the email address I give includes a number - that number corresponds to a formula applied to the vowels, consonants and punctuation in the rest of the address. Anything which includes a number and doesn't have the right calculation for it is refused. But I still see THOUSANDS of emails every day bounce off my filters, blocklists, and everything else.

Cisco warns IPv6 ping-of-death vuln is everyone's problem

Re: how long has this bug been around?

Web server? I should hope so. It's usually just a case of enabling it in Apache etc.

Your home? Probably not. Virgin haven't even tried to deploy IPv6 to normal homes yet, despite being DOCSIS 3 which mandates compatibility with it.

Wifi hotspot? See above.

3G/4G? IPv6 is mandated as part of those protocols. Probably more phones use it than they do IPv4 when connected direct to the cell network, rather than wireless.

I have an IPv6 website, email, etc. server. It's not a huge majority of traffic, but its definitely "there" and been working fine for years. Google servers prefer IPv6, for instance, so almost all GMail and Google traffic use it first, and I get IPv6 mail from Google all the time.

It's certainly not "untested". Hell, IPv4 was still finding problems DECADES after deployment (ping-of-death, Xmas-tree packets, ECN, you name it). But to suggest it should be "bug-free" even 20 years from now would be moronically stupid for such a thing.

Computex 2016: Full of people in cold sweats, retching after VR demos

Re: RE : Lego is an obvious health and safety risk in the office.

Calm down.

Banana?

Windows 7, Server 2008 'Convenience' update is anything but – it breaks VMware networking

Re: So is this rollup intended to resolve

Why would it affect anyone deploying en-masse?

WSUS? WDS Imaging? Slipstreaming?

What are you doing to be deploying plain Windows 7 that then needs all the updates that have been released for it to be applied before you can use it?

Home use, sure. But then how often are you reinstalling (and why?) and I refer you to the Slipstreaming part of the above.

Microsoft mops up after Outlook.com drowns in tsunami of penis pills, Russian brides etc

I'm always amazed at the miracles people expect you to work when it comes to spam-filtering.

I mean, obviously, you don't accept spam from non-reverse-DNS, apply greylisting to new senders, filter attachments from unknowns, perform DNSBL for everything you can find, drop where the SPF or DKIM checks fail, etc. etc. and then keyword and Bayesian filter the hell out of what's left. But still stuff will slip through.

Yet I'm given the impression that it's all my fault whenever a new batch of spam slips through.

Sometimes I feel like saying "If I *could* write a system that just coped with all of this properly without needing to be tweaked and tuned and manually-overrode, and that could identify spam with even 99.99% accuracy, I certainly wouldn't just be working in IT any more - I'd have sold that and lived off the proceeds for the rest of my life".

Swiss effectively disappear Alps: World's largest tunnel opens

Re: Swiss efficiency

Crossrail, really?

The project planned in the 1940's and still yet to happen?

It's easy to be "in-budget" when nobody remembers what the original budget even was.

It's easy to be "on-time" when you still haven't delivered anything and "on-time" is supposed to be 2017 (or actually 2018 now, possibly).

Literally, Crossrail is the entire antithesis of your counterpoint.

Re: Tunnels aren't as good when everybody likes them

Groan.

Re: Swiss efficiency

The BBC News article confirms:

On-time

In-budget.

Maybe we can learn something from them.

US computer-science classes churn out cut-n-paste slackers – and yes, that's a bad thing

Precisely.

That's what we try to do with the extra-curricular clubs, etc. but it's hard when they've never been exposed to it before and you have limited time to cover anything like that. The irony is that the kids are proficient in all the usual software packages before they even start school, really, and can do all the things that "computing" purports to teach them.

We once rolled out the "game" TIS-100 to our club. It was eye-opening. The problem-solving skills to even start something like that aren't there, and despite being "gamified", it was almost impossible to get anything done (holding interest wasn't a problem - getting them to think in the right way was). The problem, as you say, it Googleability. There's little independent thought and the children's first reaction is "How did other people do it". There's an element of that to all programming, sure, we've all done the stackexchange / github lookup when we were after something. But to actually get that stuff from first principles, or understand it enough to modify it successfully, is alien to them.

Though the assistance I had when I was a child their age was minimal to nothing, even with all the resources and power available to them now for free, they aren't able to get close to the same kind of understanding. It's a slippery slope.