Posts by Lee D

Reg reader casts call centre spell with a SECRET WORD

Re: Lawyer magic word...

Automatic termination of contract because someone said lawyer? I don't think so. They probably hear it a thousand times a day and further termination of the service in that instance would just get them into MORE trouble if they're already failing to deliver on their contract.

It's a matter of using it carefully, not just empty-threatening.

As someone who took the offered £50 compensation from a car insurance firm, and used it to initiate the small-claims court action for much more than that that I'd been threatening them with, I can tell you that crying "Lawyer" doesn't get any more action than usual, in fact. What gets action is that little document with your name and a court letterhead dropping on their Head Office's doormat. Until then, it's just a customer and empty-posturing, unless you have an incredibly large account with them.

But if you truly want a response (not really something you can do in a massive hurry), just send a recorded delivery or couriered letter that they have to sign for. That kind of shit has implications of "Shit, this guy's serious and our response to this will be read out in a court". Not hugely useful in the cases like this, but the only alternative is to set the lawyers on them personally but even a lawyer will tell you - phoning up to threaten the company, even their legal department, won't do shit unless they are co-operative by default (in which case you won't get that far anyway), or the paperwork lands on their desk.

I have actually seen the bursar of a very exclusive private school on the phone to an ISP using the words:

"Look, what do I have to pay to get it put back on? No, seriously. I don't care what the problem is, I just need it back on. How much?"

Unfortunately, the ISP in question were far too thick to understand the question. It turns out that they'd installed two ADSL2 lines for the school years back. And then one day they just cut us off. When we phoned up to enquire (thinking it was just an outage), we were told "You're using more than your data allowance." When it was pointed out that we were a school, they said "Yes, sir, but you're using more data than an ordinary residential household, so we've had to cut you off."

After a long argument back and forth about the definition of business vs residential, that we were paying for business-class service, that we've been paying for business-class service for years, that we've ALWAYS been a school - even when their engineers took our credit card number, came and installed the routers, etc. we were a school then and we're a school now - and, OF COURSE, with several hundred kids we will be using more than an average grandma on residential broadband, they just said "Yes, but we don't do any package with higher allowance, even for business."

Obviously the worst kind of cheap-shit reseller that was buying BT lines at residential limits and selling them on as business lines to people. That was when I got bored of them and handed them to the bursar, who then proceeded to argue for forty minutes including the above phrase several times. They didn't understand at all. They insisted that they weren't CAPABLE of upgrading the line and that was their best "business" package (for reference, we'd done a few hundred gigs in a month, which isn't at all bad for a school). No amount of money could get us off the data limit block, back up and working, with them.

So we immediately cancelled all lines. The bursar never paid another penny on the contract (schools like that have very expensive lawyers who are perfectly aware of the phrase "breach of contract", so he ended up getting a lot more back too). We spent two weeks on 3G sticks that we bought from the local shops, plugged into our normal Linux router (which we had to tweak to up the caching, downgrade image quality, etc. to reduce bandwidth as much as possible), and nobody really noticed any difference apart from the morning of shouting down the phone.

Two weeks later, a BT engineer called, switched the lines from that ISP back to BT and we had business-level broadband back up again. Six months later, after much digging of roads and planning permission, we had a Virgin leased line because I'll be damned if we were going to stay on dual-ADSL2 after that, especially with BT.

When your customer is saying "How much to put it back on?", get a figure. Because, damn, who'd really be THAT stupid as to say "We can't do that". Hell, put in a business line JUST FOR THEM but don't tell them.

In the end, however, T-Mobile and the local Argos profited from the sale of an awful lot of 3G sticks and SIMs with limited data that we swapped every 24 hours...

2015 Fiat 500 fashionista, complete with facelift

"Fiat has a radio screaming service"

That doesn't sound incredibly useful... and I already have a kid, thanks.

Brit school software biz unchains lawyers after crappy security exposed

I work in schools, I can't say I'm one bit surprised. Not just Impero but any "educational" (though the buzzword is pedagogical nowadays) software. MIS software, in particular, scares the pants off me.

Bear in mind that MIS software will probably contain:

Salaries

Bank details.

Disciplinary notes.

CRB checks and details of passport, driving licence, etc. for all staff.

Pupil details (including parents names, numbers and arrangement for pickup)

Medical info (staff and kids, everything from long-term conditions to issue of sanitary pads, etc.).

Info on witness protection programs, child abuse records, Learning Support information, every minor concern about a child imaginable.

Timetables.

Events, including arrangements for transport, pickup, whether a child will be alone, etc.

Parent's banking details for fees, paying meals, etc.

And yet their "security" is some of the most lax I've ever seen. I've yet to fully push our MIS online because of these kinds of problems - the only MIS gateway available to us VPN's into our site to pull SQL information to their remote site, which then puts it into a "secured" web interface. I have paranoia over us executing SQL statements which ultimately originate from some random guy on the web logging into a website.

If I can crash your MIS software in a hundred different ways off the top of my head (everything from overflow, to not entering a number when required, to choosing one option before another) and you want to put that accessing my SQL data containing all the above into a web interface that parents and even children can log into to see their little darling's school report? You can think again until you tighten up your coding and security and at least integrate some decent error checking.

SourceForge goes TITSUP thanks to storage fault

Re: It's a pile of poo

Dice have no idea how to handle what they've bought.

SF is dead now, in all but name. They tried to bundle the code in adware, trick you into false downloads, and all sorts. It doesn't matter the scope or limits they put on that, you can't do that on an open-source download site.

Slashdot has been on the decline since they took over. The code is still stagnant and doesn't support basics like a pound sign (how hard is it? £ ffs...), but all they've added is irrelevant and somewhat demeaning ads - EVEN IF you were a former subscriber and still have the "Disable Advertising" button. They went through many months of just not knowing what to post and facing user backlash from adverts posing as serious article.

Dice have basically killed two of the most famous IT sites by trying to turn them into shovelware/advertising sites.

Your security is just dandy, Apple Pay, but here comes Android

It is not a good thing for consumers to be required to buy a specific manufacturer of device to make a credit card transaction, when the credit card number that had to be entered in the first place is in their other pocket.

Go abroad, your payment system doesn't work.

Battery dies, your payment system doesn't work.

iOS chooses a bad time to update/reboot, your payment system doesn't work.

The shop choose a rival system, your payment system doesn't work.

So you still have to carry the card anyway.

And, let's be honest, Apple know exactly who you are as they have your Apple ID on the same device. Just because they've not shown it linked in, doesn't mean they couldn't, can't, don't, haven't or won't. If you are authenticating the software on the device and the device is linked into an Apple ID account or course they know who you are. Whether they join the dots or not greatly depends on local legislation, not technical capability.

I'm actually much more interested to know how Apple will work at the business end. Because, for sure, every time I call them about the 100's of iPads my schools use, on the Mac Mini servers that we have, with the stupendously expensive MDM system we bought, they couldn't care less and literally do not want to know.

They are one of the few cloud providers to not provide an EU data protection guarantee for their cloud services (which technically means you shouldn't be using them in EU businesses like schools etc.). They are one of the least "business-friendly" companies that I've ever seen. Last time I rang up about a pupil iTunes account, it took 10 business days to reset and they were demanding original receipts showing the iPad serial number before they would touch it (despite being enrolled into our MDM and supervised by us) - security for home user, unnecessary hassle for verified businesses with tens of thousands of pounds worth of business with them. And we had to say literally dozens of times "No, we're a school, it's a school email, it's for a school pupil, it's a school device, we're a school".

I've also yet to see "other" payment systems that use the original credit card details separately in an auto-generated token with bank authorisation - that's the "new" thing, not that other payment systems don't exist (but, again, they aren't popular, even when they're cross-platform like the PayPal one I mentioned - I can show you any number of shops with the logo in London, but when you ask to do it, they have to go call the one guy who knows how and tell you "Never had a customer ask for this before", etc.).

Sorry, but even Android Pay is dead if you have to have it alongside Apple Pay etc. and you lock it to certain brands of phone. That's not a payment system, that's vendor lock-in. Either everyone has to take everything (e.g. like websites take Google Wallet, Amazon Payments, PayPal, WorldPay, etc.) or they have to take nothing.

And, I'm afraid, Apple just doesn't appeal to enough of the market to be the "one true payment system", no matter what gimmick they use, and they absolutely DO NOT co-operate with any other vendor whatsoever. They barely co-operate with some of their largest customers.

Like the whole "ID card" debacle... enjoy it while you can use your one type of phone in one particular location and look cool to your mates. Because, for sure, the next time you leave the city and travel outside, you'll realise that you need to pull out your card every moment still anyway.

Fastest adoption rate isn't hard when the competition isn't released yet. It's easier to be "first past the post" when nobody else is playing. Betamax was superior, HD DVD came out before Blu-Ray, etc.

However, Apple Pay ONLY works on Apple devices. Android Pay may well be the same but, being software, it should be portable if necessary. However NEITHER are the real solution people actually want, and the biggest barrier to adoption is that you have to have one of those devices in the first place.

As the article states, Android enjoys four times as many users as the Apple competition before you even start. And "Apple Users Spend More" doesn't equate for me. It's like the Humble Bundle statistics that their Linux purchases voluntarily contribute more. Individually, yes. But en-masse the greatest amount of total profit comes from the much larger user base of Windows gamers each contributing less. (Technically, my owning an Android device instead means I have more money to pay the shops, because I haven't given it to Apple!).

As such, kitting out all your stores with Apple Pay and then having to replace it because it wasn't the most popular system is what will hold people back - as the article implies, adoption is years away. Hell, stores have been "able" to take PayPal on your phone for years now... nearly a decade? How many of them actually do it? How much of their transaction totals go through it? Nearly zero. So you spend all the money for the kit based on the manufacturer's promises and end up not profiting from it at all.

If margins are lower for Apple Pay, that means that the risk of prices rising once it becomes mainstream is even higher. Not only that, if they are only doing it to "sell phones", the cost of that phone is actually part of the overall cost of the system. And I'm not sure I want a payment system that's designed to "sell phones" as the way to pay my bills, thanks.

This isn't blind anti-Apple sentiment. This is just early days of a single, non-cross-platform, still-has-flaws payment system. Nobody is going to leap onto it unless they are terminally stupid or incredibly rich and has a particular phone anyway.

No, wait... that last part WAS just anti-Apple sentiment...

Behold: Pluto's huge ICE MOUNTAINS ... and signs of cryovolcanoes?

What strikes me most about the various planets is quite how boring Uranus is in comparison to all the others. We now know that Pluto isn't just a dull sphere but an interesting, rock-like world with all kinds of activity and differences over its surface.

But Uranus? Go find a picture. It's never anything more than a blue orb.

I suppose, though, that one planet needs to be different, even if that means being different by being utterly boring. Uranus is the geek at the back of the class... :-)

Samsung stuffs 2 TERABYTES into flash drive for ordinary folk

Re: GIMMIE!

Those caddies (and more usually, the cables they are plugged into) generally only support SATA II at best. They aren't ideal by a long shot.

However, some laptops do have dual-drives plus optical (like my Samsung), and I've just replaced one of the drives with the 1Tb version of this - it's flying.

Because most people - like broadband uploads vs downloads - don't write a lot, only read.

This is not a server tool. How much writing do your home PC's do? Basically what you've downloaded and created that day, and that's it.

If you're assuming 10 year life, and downloading, say, 15TB a year, that's 15,000 GB or thereabouts, which is over 1000GB a month - I'll be more impressed with your Internet connection than where you're storing it all. I have a Steam account with 1000 games and it doesn't approach that kind of space. This is basically deleting and redownloading every game I own every single month.

Or your creation ability if you're churning out 1000GB a month of user-created content. Maybe video, but then you'll probably be better off with a more professional setup than one SSD by the time you get to that level of content-creation.

And, don't forget, reads are "free".

This is perfectly adequate for a consumer drive. No, you wouldn't want it in a 24/7 RAID5 config on a server. But then, if you did that, I'd call you an idiot just for trying that in a limited write-life device. This is not a server drive. This is a consumer drive. And for that purpose it's absolutely fine and way out of most people's reach, even most IT professionals.

Windows Server 2003 support deadline is TOMORROW – but thousands don't care

Re: Opensource alternatives...

To be honest, I don't know that you'll save any money compared to even several hundred quid. The transition alone, and pain of migration or integration, will cost you more than that on even the tiniest of systems (I work in schools, and have worked from tiny primary schools with barely one server up to huge colleges with hundreds of VM's).

I'm just not sure what you think you're saving there at all. And Zentyal isn't free by the looks of it. The OS versions look about as helpful as you might expect from someone offering paid support for what is basically the OS project.

I'm not averse to open-source - have put Linux into hundreds of machines in schools, and taken it out, have replaced servers with Linux, install and use Linux for back-end tasks all the time, run schools on OpenOffice (before LibreOffice) and run any number of services on OS software on all platforms - but this sounds like you're building yourself up to a world of hurt in preference to throwing down a few hundred quid.

Anywhere that you need an Exchange server, a couple of hundred quid should be nothing more than a drop in the ocean compared to everything else you have to have to make it work reliably.

Personally, I think you'd be better off going managed hosting, and have you seen the prices on that? It's not cheap, but it is usually at least per-user which is a great saving for tiny shops.

I have happily told Microsoft et al where to go on many occasions and come up with better, faster, cheaper, easier solutions... but I think you're just heading into a world of pain thinking that OS will save you here.

ARGH!

Honestly, how many articles are you going to suck out of one event happening? It's getting ridiculous, Reg.

At this point, anyone who cares has done something about it, and anyone who's left doesn't care.

My last workplace that used 2003 was taken from it nearly FOUR YEARS ago and that was a real hanger-on and fought to the last to stop me upgrading it (i.e. we were still using Windows XP!). The only thing I absolutely couldn't argue with was that they were still on permanent Volume Licences and thus had to move to the annual licensing if they moved forward (so I understood their reluctance). Still, I twisted their arm and moved them on to something sensible... FOUR YEARS AGO.

IT does not standstill just because you bury your head in the sand or "your boss said so". Get it upgraded, or you become the "support" for all the weird problems and lack of external support you'll start having.

Hell, how do you even buy new hardware that support 2003 any more anyway? Do they even still make RAID drivers for that OS? Just better hope your hardware never dies before you get onto virtualising it all (and why didn't you start that years ago with your 2003 machines?).

P.S. For those who don't get the hint, it's time to explain to your boss AGAIN why the IT can't just stay static for ever and ever and needs maintenance and upgrades and refreshes all the time.

Samsung's latest 2TB SSDs have big hats, but where's the cattle?

I have a Steam account with 1000 games. They all update. They all save. They get a LOT of playtime

I have an Origin account. Same. I have Desura and GOG and all kinds of games.

I have a development environment for Windows.

I have VM's for Linux, Mac (cough) and Windows.

I have development environments in each of those two.

I have all the browsers.

I have updates.

I have every photo ever taken by me, thousands of games, even more emulators (a full MAME is easily hundreds of Gigs).

****ALL ON THE SAME LAPTOP****

I still don't get that amount of writes. You're not measuring the right thing or your computer is so drastically short of RAM that it's swapping constantly and you haven't noticed.

I certainly don't see where you're getting your numbers applying to the average person (this is a CONSUMER drive). Look at Internet download speeds and bandwidth caps. You just can't download that much as an average user, let alone write it to disk. Users are not "creating" this amount of data and not writing it as a matter of course just by having their computers on. And we're power-users here, not amateurs. I have networks putting Tbs of data every week at work, from servers and SANs capable of ludicrous write numbers. But for a standard SSD drive, you are NOT going to wear it out before a normal hard drive with even your usage - as said, the warranty would cover you for FIVE YEARS at your usage (not ten, as they may state, but your usage is way at the top of the bell-curve here).

Game "downloads", saved games, temporary Internet files and the rubbish about things "buffering video to disk" are just laughable, sorry. Video editing, possibly, but any amount of that veering into Tbs or writing is NOT every day usage and needs proper storage.

Watching videos does not write.

Browsing the web barely writes (hell, I don't even bother with anything but in-ram caching nowadays)

Playing games does not write at all (maybe swap, but that's an indicator of an under-RAM system more than a drive problem).

Sorry, I just don't believe you've WRITTEN 2.5Tb in a handful of days. If you have, you are certainly NOT a normal use-case. This isn't a RAID or server drive, most people don't download or create 2.5Tb of new content in a WEEK. And every other type of write is incidentally, small and fleeting.

I use my computer 24 hours a day, effectively. When I'm not doing something, it is. But 150Tb would last me... years. Even you it would last 60 months, which is 5 years, at your claimed rates of writing.

To be honest, even one Tb a week is a constant, sustained data writing rate of 1.7Mb/s constantly, 24/7.

Either your maths is wrong, or whatever you're doing is WAY out of the scope of normal drives anyway.

Awoogah: Get ready to patch 'severe' bug in OpenSSL this Thursday

And if you're under an NDA.... can you actually report a security problem publicly?

Kingston offers up its fastest SATA SSD: HyperX Savage 240GB

Give me capacity or don't bother.

1Tb minimum nowadays.

What Murphy’s law has to teach you about data centres

This story is very relevant

I work in a school, I'm the IT Manager, my boss is the Bursar.

My boss just came to me. We're going to be doing something in September that I've never done before.

Planned, scheduled, disaster recovery scenario with NO warning for the other staff. Not just "Ah, yes, we can failover in this limited test plan that we know won't affect anything, before we've even fully-loaded the system" but instead "Let's just turn off the power to the stuff we use every day - EVERYTHING, during the middle of a full working day - and see what happens".

He's going to walk up to the fuseboard, turn off half the place, and then see how IT / everyone else copes. Obviously I'm forewarned to make sure we don't do damage (but we should be ABLE to do damage and it not matter!), etc. but still - an exercise you don't often get to do on live systems.

This is going to be interesting, and I don't mean that in a worried way but in a "Wow, I'm genuinely intrigued as to seeing how this will work out and what doesn't happen more than anything".

I have complete faith in his intended demonstration (that we still have BUSINESS continuity, i.e. we can easily recover from the situation after the initial upheaval and maybe sending the kids home for a day or two at worst), but I also have faith that we stand a damn good chance - no such thing as a certainty - of having entire continuity too (i.e. apart from the lights going off in the rooms and alarms going off, people won't even notice any change in the way the IT operates).

Of course, we've had power-outages and problems and failing hardware and all-sorts before that we've come back on so we have a hint that we'll do okay, but just the "Let's just do this quite badly and deliberately, without any kind of safety barrier or hesitation, just to make sure that the systems operate and, if they don't, the staff can cope with that".

I'm not at all panicked. We've had similar things before with phase-crossing electrics and all sorts knocking out IT. But I am genuinely intrigued as to how it will pan out, and glad of the opportunity for not just an "internal IT test" but a proper, serious test of everything we make promises for. And I actually hope there's something (hopefully small and inconsequential) that we've missed that we can use to say "Ah, ha! Glad we did this! We should do this again next year", etc.

UH OH: Windows 10 will share your Wi-Fi key with your friends' friends

Feature #47 of the "We managed to get Windows 10 into the news with a stupid idea, now let's revert it to appear like we've 'listened to our customers' despite never intending to let such a stupid idea ever happen" in the normal Windows release schedule.

It's only a shame that Metro wasn't a joke...

Abort, abort! Metal-on-metal VIOLENCE as Google's robo-car nearly CRASHES

Re: Road Network

Just wait until you get LACP - and then they divide each passenger between several cars going down all the lanes of a motorway.

Warning flags were raised over GDS farm payments system – yet it still failed

Re: Why do government projects fail?

@amanfromarse:

I wasn't aware that GDS built their own computers, wrote their own software, etc. rather than called in various vendors to bid for the options provided? Like, say, Kainos mentioned in the article? Not to mention those other "third-party suppliers" who had to co-operate to get the integration working.

Just because it goes via GDS doesn't make it immune to the basic bidding process.

This is a system for 300,000 farms, some of which will be jointly owned. At best, that's £500 per end-user. That's a disgrace, and they may as well just process them all manually and pay a guy £500 to do a week's paperwork for each of them (not counting what it costs the farmers to fill this out, hire advice, etc.).

Re: Why do government projects fail?

Because the company that gets awarded the contract makes a lot of money even if it falls flat on its face and achieves nothing else.

And the ministers that approve such contracts allow that to continue, with clauses that require payment to those companies even if nothing comes out of it.

And the reasons for THAT, are that being in a position to choose a random company to allocate £100m to allows you to dine out very well for many months of "negotiations", then give the contract to your brother's next-door-neighbour, who'll somehow work out a way to give you 10% of it back once the fuss has died down.

You think the Academy programme is about getting better schools? It's not. Every contractor, sponsor, and supplier involved in an Academy will be putting a little something somewhere. Think that "superheads" running these places are independent and have no declared interests? Think again.

Extend to the NHS where it can cost £16 for a pack of AA batteries and you can only use "procurement-approved" suppliers.

I speak from experience on the schools and from my girlfriend's experience on the NHS. It's not hard to extrapolate to the larger government organisations at all (military, banking, etc.)

So is Government honestly trying to tell me that if we got 150 IT experts together, paid them a million pounds each to work on what was effectively a website with payment system, for a year, that it would be impossible (or even unlikely) to have got a better system?

If that's NOT what they're saying - then why didn't they just do that? And you'd have £27m left over to actually supply the hardware for the first year or so of operation.

That's just a ridiculous amount of money.

Cambridge boffins: STOP the rush to 5G. We just don't need it

Both.

Provide coverage now, but keep ever-increasing speeds in mind.

Don't be blinkered and think that 2G-ing that out-in-the-sticks deployment is all you'll ever do to it... get into it being the nature of the business that you want everything using the same equipment with the same capabilities. Bring in those out of the way areas using 4G now, yes, that's first.

And then when you are 4G everywhere, then you can go to 5G everywhere. Don't make the mistake of thinking that going 5G in London and 4G everywhere else is acceptable on anything more than the short-term.

That place you're having trouble wiring out in the countryside? Do it once, do it right, make sure it's future-expandable.

I think that a central push for coverage will just 3G everyone while those in the cities are on 5G, 6G or whatever and they get left behind yet-again.

And I'm saying this as someone who has always lived and worked in and around London.

Stop having second-class customers at all - give them all the same service and get more of them into your company by expanding into the empty/quiet zones.

But it will never happen like that. How many billions did the 4G auctions make?

Cisco in single SSH key security stuff-up

Re: Suggestion

I don't get the fascination with Cisco routers outside of the datacentre.

I have to say, on the shelf next to me are several Cisco routers that I have refused to install after the various faffing with firmware, closed-off configuration tools that you can't download without support contracts, lots of updates pending on them, hideous configuration methods, etc..

My network, there are Cisco switches and wireless points throughout. They are much nicer to configure because they're aimed at doing so but they're entirely different beasts.

The incoming leased lines etc. all have ISP-managed Cisco stuff that they claim they need on our end for failover, remote configuration, etc. They do nothing more than an Ethernet switch or fibre-convertor would, from what I can see.

But on the boundary, between the two - at our interface between "lots of third-party junk and untrusted Internet" and "trusted internal network that we need to secure", we actually use Linux-based stuff (Smoothwall).

I'm sure if you're an ISP they're great, but I never see anything but people struggling to configure them and keep them up to date and patch against ridiculous things. The failover protocols they use aren't complex or unique in any way.

And no amount of fancy ISP kit disguises the fact that their supplied devices take a fibre or Ethernet at one end and push it to an Ethernet at the other end and do NOTHING to it in the meantime. Some of the configurations that you can pull from such kit (if the kit even ALLOWS you to pull configs back) are so basic as to be worthless. They have to forward all traffic, the incoming fibre/Ethernet only has a limited IP range anyway, it doesn't stop any kind of DDoS or unsolicited traffic coming in (I wouldn't want it to, they'd just break things), it doesn't do any kind of firewalling (my internal router still sees gratuitous attempts to ping, malformed packets, SYN-floods, etc.) and the only "fancy" thing is some HSRP or whatever it's called to let one router ping it's partner and failover if something is amiss. I've literally got ISP-supplied routers here with an IOS config that I could fit in a small screen on notepad. At one point I assumed it was for protecting their network from bad traffic from us, but that doesn't even seem to be true either (and, surely, a Cisco on their other end is their protection against that - I could swap out the in-and-out cables on their routers here in a trice).

I always wonder why they bother for the majority of business lines compared to just "And this is your incoming, unfiltered Internet cable" and leaving it at that.

Last time one of them had to configure a Cisco router, it came pre-configured from the ISP, then needed five engineer visits before it would pass a bit of traffic, then was sent back twice, then had to be manually configured in person on-site (at our insistence) by the head of the technical support, and then they would not configure it for our site needs (e.g. port-forwards, etc.) or license us for the tools to configure it via the GUI (only via telnet in IOS syntax), so they just left it at the point we'd need to put another router on the end of it anyway, That one's still on the shelf beside me, and I just plugged the unfiltered connection into our Linux-based router instead.

I worked for some years on Freesco - a project designed to make a single-bootable-floppy Linux router that run on any PC with network cards (or modems or whatever). It was back in the dial-up, 10Base2 days, but even back then I used to use it as it was more powerful - coupled with some junk of a PC from the rubbish heap - than anything the fancy expensive Cisco routers could manage. pfSense etc. are it's logical successors nowadays but I still battle to find out quite what people expect to get from a Cisco router with only an "in" and an "out" Ethernet port that they couldn't manage with required downstream devices themselves anyway.

BT: Let us scrap ordinary phone lines. You've all got great internet, right?

Re: Landline number

Type in zeroes.

Seriously, any online form that assumes you have either a landline or mobile telephone and won't let you continue without it is not a place to do business with.

(If I were malicious, I'd say put in a number starting with an directory enquiries or similar prefix, so when they dial it to sell you stuff they end up costing themselves money - do not be an idiot and use anything that starts like the emergency service numbers, however).

Oh, and name and shame such places.

The logical conclusion is that, sooner or later, everything will be IP.

Virgin services are IP, effectively, over cable. TV, phone, Internet.

Almost all businesses and schools are moving to IP in-house. They are investing in wireless and Cat6 and it's stupid and pointless to not use it in preference to some cheap 4-core run by the latest yahoo working for BT. And if you're using the same cable, might as well make it IP so phone, printer, computer, WAP, CCTV etc. can all co-exist and you can just branch from it as required.

They are moving towards SIP trunking (to save on line rental and international costs, if nothing else).

IP is the inevitable solution to all these things. If your system isn't IP-capable, you need to start moving onto one that is.

So changing the USO to be "we must you give a way for an analogue phone/fax to work and a way for an Internet connection to work" seems to be quite reasonable, to be honest. The current USO is literally never going to see expansion past that necessary to provide some crappy 56k copper out in the sticks, so might as well change it to an IP USO and let people get the same end-result using other, more easily deployable, extendible and shareable technologies. Things like fancy alarm systems that can't work over such analogue->IP convertors should die. You shouldn't assume your copper line can do ADSL of any speed, so losing ADSL frequencies on the master phone socket isn't a problem, SO LONG as there's an IP alternative of some decent speed.

And then you're doing what Virgin do. One cable to the whole street (rather than a plethora of telegraph poles), joint onto it as required, encryption and shared access using DOCSIS such that you can't interfere with the neighbours, and then pull off IP, telephone and even television as you need it. And because you're only going 100m or so, you can put stupendous speeds down it (e.g. standard Cat5e will give you Gigabit even on a homebrew version of this!).

I don't see why not. But the proviso is exactly that - you can substitute the USO only where you provide an equivalent (or damn close to it) IP service. And the USO isn't allowed to change in terms of call quality, uptime, dialling costs, etc. one iota towards the negative.

To be honest, I think that's a forward step.

The problem is that BT will then run a copper, put ADSL on it, then run your phone line over IP on it, and still cock it up because that's the equipment they have and want to get rid of.

That shot you heard? SSLv3 is now DEAD

Unlikely.

TP Online are still vulnerable to a vast range of ancient attacks for years and nothing's been done:

https://www.ssllabs.com/ssltest/analyze.html?d=tponline.co.uk

(Hell, it still supports SSL 2.0! That's possibly the lowest score I've ever seen in my life on SSL Labs!)

The instructions given still MUST be completed in IE 7 or above (and you can't use anything but XP or 7), the process is a faff, the signup site still gets validation errors in every other browser, and at the end of it this is used for vast amounts of Teacher's Pensions and (in some cases compulsory) security checks for teachers nationwide and has for many years, unchanged (the instructions they supply have not changed for 3 years at least).

The site is backed by BT TrustWise, Symantec, etc. and has been unchanged for several years.

Great.

Can someone tell banks and places like TP Online whose instructions state that you have to use IE ("7 or above") and that you have to have SSL 3.0 enabled, and that you have to download your ultra-secure client certificate to use with the service via an SSL 3.0 webpage that fails verification in most modern browsers anyway, and only with that cert installed in your personal trust store can you connect back to their website in order to log in with credentials anyway and do things like, say, pay Teacher's Pensions or do List 99 checks on staff.

Cos that would be great.

Privacy advocates descend on proposed domain name change

Re: It's called DotCom for a bloody reason.

Companies are required only to give you their head office name and address. NOTHING else. The "particulars" as they are known.

The guy behind the counter does not need to give you his name at all. His company might say that but they are under no obligation to at all. There is no legal requirement that he show YOU his qualification certificates or allow you to ask his university whether he is actually a pharmacist or not. He doesn't have to give out his phone number or home address to anyone who walks up.

The ONLY details that *you* are legally able to get off him without a court order are the company details of the company he works for. That's it. You want any more, you have to ask a policeman or court to obtain them unless he gives them up voluntarily. However, if there's a grievance, you go to someone who DOES have that capability.

There is no requirement for him to publish his name, address, home phone number, personal email address etc. and put it on a placard at the front of the pharmacy and publish it online. None. Because it's HIS. Even if he's a sole-trader - unlikely - he doesn't need to give that information to YOU, nor to every single person who looks. Market stall holders do not need to tell you their home phone number, even if you demand it, without a court order. They have to give it to police / courts on demand, of course, but that's always an available option via places like ICANN and proxy companies anyway.

Not everyone with .com is a business, not every business is a company, not every guy selling crap out of his loft via his own domain will want to register as a company just to stop you getting his home address.

So, please stop talking rubbish. You're inflating what a company is required to do with what a sole trader, private individual selling goods on eBay, or random person with a Donate button on their website would be required to do.

And .com might have originally meant commercial but it also meant INTERNATIONAL / stateless commercial (that's why the regional descriptors are there, but we're supposed to be .gb anyway, not .uk) - so anyone with a .com who doesn't trade internationally should be thrown off too (bye bye askmid.com, the official UK government place to check if you're on the motor insurance database), and .org should be non-profit organisations, etc. but NOBODY has ever enforced any of those restrictions ever. Because they aren't binding, only a recommendation. There's nothing that says they will take your .com away just because you're not a commercial entity or vice versa.

(P.S. I'm sure you don't use 90% of online websites, then, if you don't use proxied-whois.)

Re: um...

Sole traders.

Indie game makers.

People who take chips out of old ZX Spectrums and sell them on via Paypal for a couple of quid a time.

eBayers

People who use Etsy and put their stuffed animals on their website.

Cam-girls (private individuals selling videos)

A small pottery down in Somerset which is a one-retired-man operation to keep his hands going.

Random political blogger / whistleblower who wants to not have to publish a name to put information on his domain.

I can think of any number of private individuals, and especially some who DO NOT want their personal data sitting on their domain name, that won't be registered companies but might well come under these restrictions.

For most of them, just the cost of registering a company would be prohibitive compared to what they bring in in a year via that activity.

But, ignoring all that, my personal data is my personal data. Under EU law, you have to have a need to be able to disseminate that. Giving Joe Bloggs on the other side of the world my home address, on demand, just because he asked is not a reasonable use of my data. Sorry, but it's not.

And companies are EXACTLY the type of people who should be forced to give them information, and personal users the ones not to, not the other way around.

Wake up, sheeple! If you ask Siri about 9/11 it will rat you out to the police!

Re: Depends...

"On how Siri is activated. It may well be that the phone's owner is in some way incapacitated, and shouting to siri is their last recourse."

God, I'm dead.

No voice recognition that I've ever used even gets close to understanding what I say, no matter how many times I repeat, how much I improve my diction, or how slow I speak.

Seriously.

Hilariously, however, my Apple-mad colleague happened to discover that saying "Call <name>" in any conversation automatically unlocks your iPhone and starts dialling their number and then SILENTLY puts the call through to you and the caller can hear you and you don't even know you've rung them.

So you say "Did you call Fred? That absolute (&(£*"&$ of a man, what a moron, why doesn't he grow a pair?" etc. with your iPhone in your pocket and Fred gets to hear it all.

He found some option later, but he was as shocked as anything to discover that was the default on his flash iPhone while all us non-Apple people sat there and laughed at him, and that his iPhone was listening 24/7 even when locked for the magic words "Call <whoever>" and immediately acted upon the command.

Fortunately, Siri is so bad at understanding voice with even the slightest background noise that he never actually managed to activate it himself until he read about it and started testing his phone directly which he was convinced it wouldn't work on.

June 30, 2016: The day the US will hand over control of the internet

Yeah, cos that's not a forced backronym.

Assange™ celebrates third year in Ecuadorian embassy broom closet

Involve just one met-retained lawyer who's familiar with embassy-based international law and you can spend 90% of that in one question.

Pew, pew, pew! Sammy shoots out updates to plug mobile keyboard snooping bug

Your devices getting updates depend on your carrier re-jigging them and pushing them. Blame your carrier. This is why Kies works - because that's the Samsung update mechanism. Samsung have no direct control on if/when/how your carrier pushes published updates to your phone.

Security policy updates are pushed all the time, however. It's an option in the menus for Samsung Android devices. It happens in the background and - I believe - is basically SELinux profiles.

That the device does not update from non-Windows? That's an issue but that's true of basically EVERYTHING. Try and reinstall/update/unlock an iPhone from anything other than a Mac, for instance.

MILLIONS of broadband punters aren't getting it fast enough – Which?

Re: Does Anyone Use this capacity? I'd love it!

The Watford area is quite bad. I have just put in a huge leased fibre into a school around there because, generally, the ADSL/VDSL is so atrocious.

After two ADSL2 lines were deemed inadequate, we moved one to a VDSL. Promises of "up to" 75Mbps. We get 45Mbps at the property boundary (according to the engineer). 30Mbps by the time you get it somewhere useful. Our actual, usable, Internet-measured speed was 15Mbps at best.

And BT took years to try to get a leased line to us and then decided that the exchange was inadequate so delayed more years. We cancelled.

I don't know about this survey, but SamKnows does an awful lot of broadband monitoring. I know, because I have their kit in my house. And they supply that data to government, and probably places like Which too sometimes.

Basically I have a box that tests everything from download and upload speed to RTP packet jitter to DNS reponse time, you name it, throughout the day. I get a fancy little summary at the end of each month with pretty graphs going back years. If nothing else, I keep it because a) I know what it can and can't do (it's VLAN'ed off from my LAN and I can monitor its traffic using my router if necessary), b) it doesn't hurt my connection at all, c) It's nice to know that I am getting what I pay for at the top end even if sometimes I swear about "the connection" being slow (probably just my clients/wireless) d) I like to think that my ISP could easily detect I have one of these boxes and given that they contribute to the government statistics on which ISPs are performing and which are not, I imagine they might want to ... ensure my service level is consistent with expectations... ;-P

Plus, at any time now, I can turn it off and I get to keep the re-firmware'd wireless router that it's based on for myself (after the first year).

MOUNTAIN of unsold retail PCs piling up in Blighty: Situation 'serious'

The PC market is sitting on a ton of perfectly adequate hardware. The ones who want to move it are dropping their prices.

Last year, I started at a new workplace and replaced every single PC, it was cheap enough to do and didn't come anywhere near the price of replacing a single decent blade server. For that, I got rid of all the old junk that was lying around, I gave everyone the impression the machines were newer, faster, better (they were, but even what I bought was old models even if it was new stock, the biggest speed advantage came from a refresh and a clean image instead of the old multiply-cloned junk they were using, and they were better because they could all use the same image and "just worked" as they were clean installs of everything), I managed to give away a ton of old machines to charity, and I have a large stock of spares that are perfectly functional and can be slotted into any purpose in a few minutes.

The problem is - I did this more to remove any doubt about the old hardware than anything to do with it being 100% necessary. I bought old models because we didn't need the fancy new stuff. I just needed "shiny, and still in the plastic". As such, I won't be doing the same this year, or next year. Why would I? And, quite literally, the machines were so cheap that I didn't particularly care about replacing every machine on site - and they all came with original manufacturer warranty! Hell, just the spare keyboards, cables and mice they came with actually means I replenished an awful lot of my dwindling stock too.

Soon after, a supplier phoned up to say they had 20-something new machines they wanted rid of - fully boxed, warrantied, etc.. They were so cheap, I just said yes. Literally, that's the only reason I took them. They can use the same image and are pushed out as normal stock for replacements, etc.

PC's don't have a lot of money in them anymore. The money is in laptops (which I fight against because for our purposes they aren't suitable) and tablets (same) and in servers. The servers I have, I spent a lot more money on than all my desktops put together, twice. Probably more than that.

The end-user desktop needs are so low compared to the specs you get that I barely bother to read the specs any more. In my last place, we just pushed out Atom PC's because they were so ludicrously cheap and - literally - nobody could tell the difference. I had so-called "IT expert" staff telling me how fast and wonderful they were and could they have one. It had more to do with an extra couple of gig of RAM in an Atom than the processor power which you can barely notice in most office-type use nowadays.

And Windows 8 made the job easier as it actually can lower requirements. Windows 10 looks headed the same way. We don't need a ton of processing power, just a dual/quad core, plus a bit of RAM, and maybe if we're really showing off a graphics card jammed in there. Again, the cheapest one I can find should be more than adequate - we won't be playing Crysis 7 on them.

As such, those PC's in the warehouse are going to stay there until someone lowers the price. You want to sell PC's, you have to have other angles - service, warranty, software, integration, "packs" of laptop with charging trolleys, buy one server, get 10 PC's free, etc. PC's on their own aren't worth much. If you're paying more than £150 per PC (so call it £300 per seat once you add monitor, software, etc. but even there - why would you buy new monitors until your current flatscreen is inadequate?), you're just throwing money away unless you can justify it. And those PC's will be capable of virtualisation and all sorts themselves (Windows 8 Pro included Hyper-V, remember?).

Business PC's have plateaued. Great for me. I could redo the whole network of client two to three times a year if I needed to. Bad for sellers. They need to offer more than just box-shifting. And none of my suppliers has an interest in just selling me a bunch of PC any more. They are all about "service", "support", "relationships", etc. trying to get me to buy new servers every few months. Fact is, I'm set for the next few years at least, so god knows where they'll be making their money.

'Oracle, why are your sales f-' CLOUD CLOUD CLOUD, blasts Larry

Re: This obsession with growth...

Agree in part but...

Look at all the "constant currency" stuff. In real term, they are making less and less profit every time, and their money that they are holding onto is worth less and less.

Growth needs to match inflation at the very least or you're actually shrinking, not staying still.

Think how that translates to someone who paid, say £1 per share last year. If their shares aren't worth MORE now, they have actually just lost money. And given that banks are holding near-zero interest rates, business investment is one of the few ways to make money again.

And, unfortunately, shareholders are why the business operates, not customers. Businesses exist for the benefit of their shareholders, there are even certain legal wordings and definitions of things like "company" that enshrine that in stone.

As such, the "constant currency" growth is actually a loss, behind weasel words. Shareholders are losing money, which means they'll sell the stock off cheap if things don't improve soon. This will make the company shares worth even less.

Given what they've done to just about every major project they've ever purchased (Java, MySQL, OpenOffice, etc.), I can only wish this to continue and accelerate. But it's still serious and not just a case of "We've got so much money we can just sit around doing nothing for a while".

Apple CORED: Boffins reveal password-killer 0-days for iOS and OS X

Re: Whooooops!

Apple currently still has, on its app store, an app expressly stating that it is intended to be used to "bypass your school filter", etc. It's as simple as installing it, and you get full, free, VPN access to the outside world that's almost undetectable.

Not a huge issue, but there are no real ways to "block" a particular app install even with MDM APIs. You can turn app installs on or off and monitor them, but you can't blacklist an app. If you want to use, say, Cisco Meraki to push apps to your iPads in a school (a very popular choice) you need to have the "install apps" option on, or else you have to manually recall every iPad and do it manually every time.

The only real option you have is parental filtering, where you can block apps with certain age ratings.

The above app is STILL, after several reports, marked as being 4+. Apple have steadfastly refused to do anything about it, as they categorically state that it's nothing to do with them and it's up to the app-makers to decide the age-rating (not much point in having an age-rating, then, really?). This app allows bypass of any and all filters and access to the unfiltered Internet, for free, just by clicking "Get App".

However, Chrome was briefly pulled from the store and recategorised as 18+ because it "allows unrestricted access to the Internet".

Apple don't care about what they are doing, so long as they are making money. They are right and everyone else is wrong, and that's the end of it. And no amount of head-banging against their complaint department, tech support, etc. will do anything to change that at the moment.

Gone

<sarcasm>Does it discuss how to IPv6 your networks and SSL your website?</sarcasm>

The NHS pays up to NINE TIMES over trade price for commodity kit

Re: Bureaucratic procurement

This is exactly it. And there's no "official" way around it because you can't buy it yourself without incurring the wrath of the procurement departments, and you would never get reimbursed.

Was posting about this on here only the other day - my girlfriends works in the NHS in charge of a lab and has to pay something like £2 each for an AA battery. And gets... an AA battery. Down the road you can get a pack of them for £2, just the same. But you're not allowed to do that.

Somewhere there's a health minister with a procurement company who's getting their percentage on every product and then decrees that you can ONLY go through procurement.

Scumbags.

LastPass got hacked: Change your master password NOW

Re: Say what?

"And my last bloody spam-free email address is now for sale :("

Buy the cheapest domain you can find.

Point the MX record at the cheapest of cheap VPS.

apt-get install postfix dovecot

Then use whatever you [e-mail] - i.e the name of company you give it to - [e-mail]

Every time you give out an email put it on a whitelist, everytime you get an unsolicited spam, put that company's email in the block list.

And if you want you can just forward all email to another address (or even duplicate it all to, say, a GMail address) for security. Hell, you can make your backup MX be your domain registrar's original so if the VPS goes down, email just gets forwarded a normal.

It gets me that techy people aren't running their own domain but complain about spam.

Duqu 2.0‬ malware buried into Windows PCs using 'stolen Foxconn certs'

Maybe or maybe not the certificate is forged using a stolen private key.

The question begs, however, why ALL Foxconn-signed executables are trusted automatically just because they're signed by Verisign.

This is the problem with Windows, and Windows admins particularly. Rather than "Look, this is all my known software, anything not on this list - whether signed or not - I want to know so I can authorise it on the network or not", they go for the "Microsoft must know better than me what some third-party who signs another third-party who signs some third-party software does, so I'll just let them all run by default".

Sorry, Kaspersky, but I judge you immensely here. It's not where the file came from or who signed it that matters. It's what idiot didn't have a software authorisation list and/or put it on the authorisation list.

If only they had an antivirus or Internet Suite capable of detecting unknown executables and allowing the network administrator to approve / not approve their execution...

Limited edition Iron Man S6 sells for $91,000 thanks to ... serial number

Thanks for the uselessly redundant and reducible equality there.

People are people. And people are dumb. A person might be smart, but people are definitely dumb.

God, people are dumb.

Sun's out, guns out: Plucky Philae probot WAKES UP ... hits 'snooze'

Re: Excellent work!

Whenever I see space stories, I can't help but think that - so long as there's nothing else in the area - a big box filled with the cheapest set of wheeled-toy cameras all on slightly different frequencies with experiments bolted onto them en-masse would probably get more back than these multi-billion dollar missions with one thing.

I mean, just blanket-drop a ton of toy cars with cameras, drills, etc. over where the Mars Rovers were and let them loose. Let schoolkids control them (four-minute or whatever delay pending).

But then, I just *know* that what would break would be the thing that was supposed to drop them and never did, or the one box that can talk to them or whatever.

We need a mission that sods the accuracy and fancy calculations and just salvo-fires a ton of cheap experiment en-masse in the hope that just one works.

And if the Mars Rovers had been closer? Maybe one could have helped repair the other.

DON’T add me to your social network, I have NO IDEA who you are

I can't stand LinkedIn. It's like Facebook, but for you and your boss and future bosses. Why the hell would you sign up for that?

I have an entry, but it's there just to shut people up when they do the "Oh, you can find me on LinkedIn, are you on there?". Yeah. I'm there. With about a line of text and email notifications disabled. Past, current and future workplaces are not on there.

Strangely, I still get this junk. People add me because they think that will help them sell to me (nope). They add me because I work with them (you're THERE... just down the corridor... why do I have to add you online? You barely talk to me in real-life!). They add me because... god knows, random spam I assume.

Facebook, in my opinion, is for friends and family to share info - funny stories, the odd photo, and that link to little Johnny's online game that he wrote for school. LinkedIn... it's like Facebook for Work, but less useful.

I'm certainly not going to put up a work history on there - I left for a reason and though that reason was often quite amiable, anyone from there that I want to stay in contact with I have elsewhere (usually Facebook!). My current workplace? What's the point of putting people on there? So I can "link in" the people I work with and see every day? And when it comes to jobs, I don't want LinkedIn to be my CV work history. Because it contains none of my past or current workplaces anyway.

The only people I end up with are those persistent shites of suppliers that won't go away, so you add them to LinkedIn to shut them up. They never contact you from there anyway.

ISP Level 3 goes TITSUP after giganto traffic routing blunder

Re: Tolerate a nuclear attack my arse!

And, even if it were, it certainly wasn't to do so immediately, with zero downtime or with zero human intervention worldwide.

Else things like BGP would have been in the bin decades ago. I mean, seriously, just having routing tables hit certain sizes is enough to make many brands of high-end networking gear just fall over. BGP routing tables grow into the same kinds of fixed spaces. And, hell, BGP announcements do nothing to take account of CAPACITY of the system on either end (i.e. the preference of a particular route based on its response time etc.).

The Internet won't invisibly and automatically survive any kind of attack. However, it will be not-so-difficult for even a small bunch of humans to cobble it back together even if that means throwing out DNS, BGP or similar in some fashion to allow it to do so.

Don't panic. Stupid smart meters are still 50 years away

Re: Evidence Based

Energy reduction will be zero.

If you cared, you'd be monitoring already. It's not hard to do and requires NO electrical work (clamp meter on the incoming cable at worst).

Seeing what you use does not stop you using it - you already know that you're using it or not. If not, you either care about it (in which case why didn't you know that huge hot tub was sucking 10KW before?), or don't.

Now add on thousands of unnecessary smart meters, plus the infrastructure to monitor them wirelessly, plus the server-end costs of hosting all that information, blah blah blah. You're talking net loss, before you ever get close to things like policies and legislation costs on top.

Now consider why the electrical companies would care about that?

Now consider why they might otherwise have an interest in having new fancy controllable kit sitting in your meter cupboard if not for the above?

Re: @Oddlegs

The burglar argument is naff.

Want to know if someone is at home? Ring their home phone or knock on the door, look for lights on, etc.. No answer = 99.9% chance there's nobody home. And, besides, I have just as much running automatically when I'm not at home as I do when I'm at home and that's only going to get more true as time goes on.

Nobody's going to bother to use smart-meters for that. That's not the problem at all.

The problem is when they want to put smart-meters in that have the capability to cut power to non-essential circuits. Not burglars deciding whether 0.1KWh more or less means you're in or not when they still have to drive over to your house and knock on the door anyway.