Posts by Doctor Syntax 42276 publicly visible posts • joined 16 Jun 2014
It's decades since I looked at Access so I don't know if it looks much different now but back then it did seem like a reasonably user-accessible toy database product. In particular the visual database designer would have been a great help. Base was never an adequate replacement for that. Neither was Kexi which was supposed to be the KDE Office offering.
It's difficult to visualise a law mandating projects but simply policies regarding government use would be sufficient. It seems the more forward thinking European governments are already making their own choices so it's likely to be a piece-meal decision with the European Commission, if that's your "somebody" would be only one of those. I doubt an attempt at anything more binding on governments would go down well with those who have already made their choices which seem to favour LO rather than a cloud-based suite.
Of course such a policy might also specify open file formats in which case Euro-Office would have to make a switch there.
"LibreOffice is 35 years old and no longer the most innovative and fluid."
Translation: It's a mature product with less scope for tinkering. Ideal from a user PoV.
If someone wants to be innovative with LO there are a few big gaps.
One is to add a comms - email etc. cf TBird - contacts and calendar. There's scope for a lot of improvement over the competition there. For instance the comms side needs password management - why not roll in general password managment, KeePass style?
Another gap is that the document standards include a graphics standard which seems to make provision for multiple layers of both PNG and SVG. I've never seen any application use it. LO Draw is something different altogether.
Finally Base really needs revisiting. It's a commonplace that users use spreadsheets when they should really be using a databse application which probably means real database managers are too complecated for them to use. That needs fixing.
I wonder if it runs along these lines:
1. Microsoft comes from the US.
2. Trump has been assiduous in persuading Europe that, at least for SaaS products the US can no longer be relied on.
3. Therefore Europe needs a SaaS office suite that's European.
4. The existing options in that line are Collabora and OnlyOffice
5. Collabora comes from the UK.
6. They've remembered Brexit and in the current swirling atmosphere of distrust anything from the UK is also suspect, especially as Starmer doesn't want to break things off with the US.
7. OnlyOffice is Russian but that can be overcome by forking.
8. LibreOffice, with its large input from Collabora is collateral damage.
There may, however,be more than collateral damage in regard to LO. Ionos and NextCloud's interests are with online solutions and LO is a rival. If The Document Foundation can be persuaded to damage itself by breaking up with Collabora so much the better from their point of view.
Somebody needs to knock their heads together and try to knock some sense into them because this is just plain stupidity at a time when we need clear thinking.
The UI does matter. It's one of the objections you'll find about LO not (allegedly) having a ribbon. It matters so much that MS changed their UI after they'd been forced - after a fashion - to standardise their file format. By using their market strength to force every user to adapt to a different UI they managed to raise a generation of users who really don't know anything different than the ribbon nor that MS Office originally had a CUA-based (OK, Liam, partial. pace) UI like LO.
"customers are taking a long time figuring out how to use the tools in a way they can trust."
Perhaps that's because they are intrinsically untrustworthy.
"their customers expect Ai to create cost savings."
Either their expectations are of further ensittification or they're wearing rose-tinted AI-enhanced glasses.
"we are looking at using one of the big enterprise AI offerings to reduce time take on certain tasks"
Axe you prepared to pay what it actually costs to run the AI DCs instead of loss-leader rates?
"only slowly expand their use"
This may save you if you're only partly committed before the price goes up or your supplier goes bust (depending on which happens first.
"so someone just SSHs in"
From where?
I suppose if it has an IPv6 address it might be possible, providing the firewall is configured to admit ssh. Otherwise the implication seems to be that someone sshed in from within the company network and the machine is only a symptom of a bigger problem.
"I suspect much of this stuff like the coffee machine uses a ubiquitous SOC and runs Linux for cheapness rather than using an ASIC. The SOC system invariably provides wifi, ethernet, usb etc hardware and Linux the drivers so adding network/internet support is often a low cost marketing ploy"
There's still a gap between having a networked coffee machine with a default password and the same being programmed to become a trojan. Was it running Windows rather than Linux in which case it could have become part of the viral epidemic? If not, who and how was it got at? Was it supplied like that and got at in transit? Was the manufacturer installing [possibly innocently] a trojanised version of Linux on all the machines of that model?
I cannot think of a single use case for an internet connected Coffee Machine in a business environment.
It's a very common one - being expensive "This is a very important business with very important people in it. We have to have very important surroundings. We need a very important [i.e. expensive, the two are often confused by the confused] coffee machine to go with the very important [ditto] furniture."
Literally not one that makes actual sense.
Manglement thinking doesn't make actual sense, especially when prestige is taken into account.
I'm sure you're right. Even the word has an air of desperation behind it. OTOH I'm also sure that a lot of companies that dived head-first into somebody else's computer left behind them home-grown software that fitted them better than what they're now using. If there's anyone left in such businesses who remembers those days it might have a degree of attraction.
I think the distinction is between UK unions (at least of that era) and continental European unions. The only union I was ever in was of that era and was an even stranger beast - allegedly representing scientific civil servants it was quite happy to deploy its membership on behalf of the general service grades instead but did nothing to level up its members pay scales. Many of us left.
"not-random": Invitations may be random. In-person participation definitely isn't.
"people who don't understand privacy or tech": That's most people. The vast majority of people.
The second means they have a reasonable chance of avoiding anyone with understanding. The first holds out a bit of hope that someone who gets does understand will be motivated to accept should they be invited but it would still be an uphill task against the procedures. If anyone here is in that situation perhaps careful study of "Twelve Angry Men" would be good preparation.
"It is a classic uniparty policy, that can be started by one regime and concluded by the next, each blaming the other, whilst waving it through, like the OSA."
That happened with OSA. However this was tried by the previous Labour govt and got dumped after the next election although maybe the fact that the next govt was a coalition with the Lib Dems might have affected that.
"I already know that a device I can program with similar power to a Pi which can fit, battery and all, in my pocket is possible,... Now I'd like to buy that, but am only offered subsets of that in the hardware people sell."
I take it you mean "a device I can program with similar power to a Pi" but go on to say that what you can buy is only a subset of "that", by which I think you mean a Pi. In which case perhaps it's the difference between the subset and the complete thing which makes the complete thing draw more power That and all the optimisation that's gone into the phone and is spread out over an orders of magnitude bigger market.
"This is evidently so that Joe the Manager can log in from home to see how the work is going"
It is quite feasible for companies to work completely remotely. The precautions they take are alo available for Joe the manager to log in from home. Logging in from the coffee shop, not so much.
It comes down to a simple choice for the companies: do you want convenience or do you want to get hacked?
"Shareholders will not support an increase in opex for inforsec."
Is this because they're being kept in the dark about the risks to which they're exposed? If so, are boards are fulfilling their fiduciary responsibilities? Shareholders should be prepared to sue boards for such failures. Not sue the company which is only themselves, but the actual, named board members.
Perhaps this is an opportunity for class action lawyers to get involved although I suppose there's not the same money available from the the board as from the company.
What about a little risk analysis
Which unsupported Microsoft desktop is the £300k machine tool tied to? And the niche ERP system - is it even the same unsupported desktop as the £300k machine tool?
Would even have bought those particular products if you'd known what you were getting into long term? Do you have a safety plan that's more than keeping your fingers crossed?
Multiple sites? That's what private networks were for or, in the internet age, private virtual networks - they weren't originally for anonymous access to porn, you know.
But that would be part of your secure internal network, even if it does run between multiple sites on a VPN.
Externally, if you're taking orders then you need to look carefully at how orders get passed from the web site to your internal order processing. Whatever it is it needs to be something that only allows orders through and maybe stock levels the other way.
Placing orders? You probably will have to use the supplier's web site for that if you're doing it manually. but as has already been said, you keep your office network separate and do it from that. If you're more closely integrated then why not set up a VPN with the suppliers and, again, filter the messages that pass to and fro so that only expected messages are allowed. We were doing this years ago except it was actual dedicated fibre links and the messages were in XML which is maybe not looked on as trendy - presumably these days it's JSON or something newer. XML, however, allowed for testing for being well-formed (is it really XML and nothing else) and valid (is it structured exactly how it's supposed to be).
Internally, back in the day we used to use serial coms and VDUs for operations. ERP, sales counter, industry specific packages, bespoke applications - it could all be done via character-based screens. It still could be provided you don't actually need images - and do you really actually need images? That cuts out a whole lot of options for anyone to spread within your systems.
Not only is this stuff possible, it used to be done. It meant doing procession on prem. It meant designing networking to be partitioned. Now the whole shooting match is spilled out onto somebody else's computer and you scope for building in the partitioning is restricted to what's available. What's worse, from the reports we see here it also seems that it requires a whole lot of external suppliers to handle different aspects of it which enlarges the attack surface further.
Maybe it's more expensive to take proper precautions. Maybe it's less convenient. You have a couple of choices: you put up with that or you sit and wait to be taken. Which do you want.
And if it's a matter of budget, remember it's just a matter of timing. Lots of people couldn't find a budget upfront but they always found a bigger one when they'd been hacked (providing, of course, they survived).
Although I agree with the sentiment the common thread to many is some IT supplier of an IT supplier whose access control product is so much better than a simple, local username/password combination gets breached by having their own helpdesk blagged into resetting a password.
As per article, it's not so much that the manufacturers are exposing themselves directly, as the fact that they are outsourcing aspects of their IT to suppliers who in turn outsource aspects of their IT ...
In consequence the manufacturer is dependent on a chain and may not even know the extent of it. As we know a chain is no stronger than its weakest link. What makes it worse is that these links are common to a lot of end users so are worth far more spending effort on breaking than any particular end user company. "Hollowed out" does not seem adequate to describe the situation.
I used it for a while but then discovered that "ItJustWorks" was really "ItOnlyJustWorks" when it stopped recognising my digital camera which turned out to be someone had carelessly left something out of a config somewhere. Debian was much better for "ItJustWorks" and, as I also prefer prefer stability over bleeding edge on the desktop. I moved on to Devuan, of course, when Debian got mobbed by systemd lot.
"Well, now, incompetent managers have an excuse: they can fire all the other incompetents who were just pretending and replace them with bots who just pretend. It will stumble on for a while."
They'll also fire the components along with them. In fact they may well fire them first because they've always appeared to be the awkward squad and they've just become even more awkward. No wonder it stumbles.
