Posts by Doctor Syntax

FBI, CISA remind US voters that DDoS attacks can't touch election systems

OTOH Distributed Denials Of Sense are affecting the electors.

Microsoft whiz dishes the dirt on the Blue Screen Of Death's colorful past

"Put simply, because John's dev machine was a MIPS RISC box, and the firmware on that machine was white on blue.

"And in fact, his favorite editor at the time was SlickEdit, and the default text colors for SlickEdit were also white on blue.

And it's a nice bright colour to make the user feel happier.

Too late now for canary test updates, says pension fund suing CrowdStrike

Re: "We believe this case lacks merit"

"Company" is a collective word for people. Who are the people who comprise the company?

The directors shouldn't deceive the shareholders. The manglement shouldn't deceive the shareholders. It makes no sense to say the shareholders shouldn't deceive themselves at least not collectively and in the legal sense.

Re: Not the kind of lawsuit I was expecting

Not expecting shareholders to sue themselves? This is the US. It happens all the time.

And a canary icon.

Re: Unfortunatly your canary is really a (dead) parrot

"what they appear to be vending is a bright idea that was sloppily implemented backed by a first class marketing and sales effort"

Sadly yu could say this about too much of the industry..

Re: I hate to defend Microsoft...

Ditto but in this case it wasn't Microsoft's update, it was Crowdstrike's, delivered by Crowdstrike's channel, not Microsoft's. It was Crowdstrike's responsibility to test before release and theirs alone and doubly so because it was applied automatically so it would be difficult for customers to test for themselves.

Re: WTF did I just read?

I don't think checking the hash would necessarily work. Create a crap file, calculate its hash and all the hash will subsequently confirm is that it's still the same crap file. It needs actual validation of the contents of the file, for instance, look to see if the memory it's about to access is legal and reject it if log an error message instead of going ahead.

Re: Hurting investors

The original investors in your sense would have done soe in hope of a return, either by dividends or by being able to sell their share of the company to others. The existence of those willing to by shares in the after-market are ultimately responsible for the willingness of the original investors to invest at all. And they themselves are now investors because they now own a slice of the original investment and because they were prepared to invest in it. It's unfortunate that they haven't grasped the fact that, together with the other shareholders they are members of the company they're suing. They're suing themselves.

I suppose it's just possible that this is a vehicle to get some of their investment back before it's swallowed up by customers' suits.

Re: Hurting investors

And for that you got a downvote?

It's beyond belief that there are commentards who can't grasp that simple fact of company law. The word company refers to the company of people who have come together to own it by buying shares in it. Unfortunately some shareholders also seem to overlook this simple fact. Sue the manglement - that's reasonable - but otherwise congratulations to the lawyers who got the shareholders to pay them (the lawyers) to sue themselves (the shareholders) to maybe get some of their (the shareholders) own money less the cost of two sets of their own lawyers. Two sets? Of course, as plaintiffs they're paying to sue and as members of the company they're paying to defend themselves against themselves.

US sends cybercriminals back to Russia in prisoner swap that freed WSJ journo, others

Re: Cybercrime

Yes, it's more a feat of kleptocracy than democracy.

Ransomware infection cuts off blood supply to 250+ hospitals

Re: Private networks will be far more expensive?

If you follow the actual threading you will realise that I was using the "Reply" button to answer the question of why such a system would be put on the internet and the word "available" was used in that context.. Are you not familiar with manglements putting budget before everything else?

And before you start going on about the budgetary effects of being hit by ransomware, let me remind you that there may not be budget to do things right but there's always budget to fix things when they go wrong.

A central service needs to be available across all the places where it needs to be available. Private networks will be far more expensive - maybe prohibitively so - than using the internet.

Re: Data Stewardship License

A monoculture - of any sort - is extremely vulnerable. At present we have something approaching that. Leaving aside any questions as to whether any other given OS might or might not be more secure that Windows the fact that it is so ubiquitous makes it a profitable target for those seeking vulnerabilities. Even if all the clients are on Windows it would be far safer for the underlying database to be run on a dedicated server running on any other OS, be it commercial Unix. Linux or a BSD and offering not other connections other than the SQL service itself. No, not even an SSH for remote admin - trading convenience for security is where the problems start.

Boeing's Q2 nosedive buoyed by appointment of new CEO

Re: Great Man Musk

Perhaps Boeing etc management were more successful that Musk at getting in the way. After all there's only one of him (thankfully) and he can't be everywhere at once.

Re: Stargazing

The numbers of telescopes below Starlink and much greater than those above. They're also easier to service (although that didn't always happen. Availability of instrument time matters.

Re: Top Notch U.S. Aerospace

All those Starlink satellites have certainly been a gamechanger for astronomers.

Re: Boeing missed the mark on pretty much every analyst expectation in Q2

If the analysts expected better than what happened they need to start looking around them at what's actually happening out there.

UK court rules in Intel's favor in R2 Semi power patent case

Re: don't know if that's quite true

The UK judge provided clarity, the German didn't. Isn't that the former the better way of doing it?

Beetle mania: How bugs are inspiring the next gen of robot aviators

From TFA it appears that the deployment and folding of the hindwings is linked to that of the elytra so it's a bit of a stretch to say that no power is required. It's just that it's applied to the elytra with some form of mechanical linkage to the hindwings.

The elytra are curved in profile. I wonder if they contribute lift when the hindwings are driving the beetle forwards.

DigiCert gives unlucky folks 24 hours to replace doomed certificates after code blunder

So essentially somebody decided to fix what wasn't broken (or was there a scaling problem?) and do so in the most complex way they could think of. And then fail to review something which was extremely critical.

Let me guess. The developer of the original code was someone with a thorough grounding in the intricacies of certificate generation but was no longer with the company because they wanted younger, digital native, developers to work on this exciting new project.

More than 83K certs from nearly 7K DigiCert customers must be swapped out now

Given that the error has existed for 5 years, 24 hours seems a bit draconian. Surely this is an exceptional circumstance in its own right that should apply the the entire affected customer base.

Five months after takedown, LockBit is a shadow of its former self

"LockBit appeared to have 194 affiliates on its books, according to Operation Cronos, which found every single one"

What does "found" amount to here? An alias, a name and address or something in between that could be worked up into a name and address? If it's possible to identifiy them we should expect to see arrests unless they're all in Russia.

'LockBit of phishing' EvilProxy used in more than a million attacks every month

Banks are such a special case they really need to be dealt with by legislation. Send this sort of crap and receive a big fine. Send it again and senior management lose the right to work in financial services. Sent it a third time and lose their banking licence.

Treat any unsolicited email with links in it as probably phishing.

To make this work businesses need to start taking the high moral ground by not sending out emails that look like phishing emails - i.t. they are unsolicited and have links in them. They then need to publicise that emails claiming to be from themselves with links in them are phishing. They will probably need to enforce it by immediately terminating any employee who sends emails which look like phishing emails. Given that the "lets spam our customers because they're agog to learn about our latest brain-fart" mentality has spread so far into upper manglements that it will be very difficult to eliminate this.

UK Electoral Commission slapped for basic cybersecurity fails

Re: Methinks the political spin is strong in this one.

Much of the electoral roll is public anyway.

Delta Air Lines dials up Microsoft's legal nemesis over CrowdStrike losses

Are the T&Cs sufficient to defeat gross negligence? Do they cover pushed updates? Alternatively how would a defence that they disclaim the product's being of any use whatsoever help subsequent sales?

Meta to cough up $1.4B to end fight over 'unlawful' facial recognition of friends

Re: Meta does not admit wrongdoing.

Just prosecute. A conviction means admissions would be immaterial. Settlements like this come pretty close to buying and selling justice.

Microsoft's Azure networking takes a worldwide tumble

You need three teams and hope that two both point at the third.

Re: SaaS

DTaaS - Down Time as a Service

Tesla asks customers to stop being wet blankets about chargers

Looks like Poe's law in operation. Sorry.

"So far it looks like the new Supercharger team has done less to roll out improved charging infrastructure"

Makes sense. The car sales are falling off. Fewer cars need fewer chargers. Cause and effect at work one way or the other.

Proofpoint phishing palaver plagues millions with 'perfectly spoofed' emails from IBM, Nike, Disney, others

Re: did not expose any Proofpoint customer data

And, of course, with customers of that size the traditional "a small number" was all they needed.

Yup, weasels. Weasels of the first order.

Automation needed to fight army of AI content harvesters stalking the web

Re: Whac-A-Mole

"I am planning to integrate it with a better nonsense generator API in future (OpenAI)"

Maybe target the output of the actual LLMs that are doing the scraping to promote faster model collapse.

Re: Whac-A-Mole

This might have been a follow-up to a suggestion I made. What I had in mind was feeding a steam of randomly selected words from the contents of /usr/share/dict or its equivalent with the added refinement of occasionality selecting a pair or triplet of words from the stream and subsequently throwing them in at intervals so the stream would become a stream of meaningless word associations padded out with random words.

Revamped UK cybersecurity bill couldn't come soon enough, but details are patchy

"patching is a painful process that requires rounds of testing and monitoring to ensure it's safe to push"

With recent events in mind perhaps the bill neds to include sanctions for issuing patches which are not adequately tested and for not issuing them at all. The first part of that would be to encourage and enable faster patching by organisations and the second would be to prevent evasion of the first.

Linux Mint 22 'Wilma' still the Bedrock choice for moving off Windows

Re: No Bedrock choice without KDE!

"it does not honour Windows keystrokes. That, like it or not, is the standard."

Windows key? Do we have to assume a Windows keyboard layout? I have a couple of wireless keyboards that are only partially Windows-like in layout. What if it's installed on a Mac? Does Mac follow the same set of combinations?

I doubt there's a set of key combinations which will suit everyone. What would mightily piss off KDE users would be deciding it's time to change key combinations to match Windows.

Taking the Flintmobile for a spin

I hope you didn't have to drive it with your feet.

Re: No Bedrock choice without KDE!

"Today, KDE suffers from far too many options scattered across illogically and unsystematically organized menus"

I'm a bit puzzled by this.

Do you mean the application menu hierarchy? That's editable so the organisation can be whatever you find logical.

System settings - there are a few oddities but not many that strike me. I can't see why Appearance and Personalisation are separate but Users and Startup&shutdown really should not be in those but in System Administration. At first it does appear illogical that Applications is in Personalisation but it has to be remembered that this is intrinsically a multi-user system and different users may have different choices here.

Re: Hm...

Except that Ubuntu repository is not Debian's it's their own.

NASA gives Falcon 9 thumbs-up to launch Crew-9

Re: Redundant things are there for a reason.

Are the brain organoids being grown for transplant into the Boeing board?

Silicon, stars, and sulfur make Apollo's unlikely legacy

Nice Royal Mint you have there. maybe I should look after it in case something should happen to it.

Re: You mean like this:

Does it have anything to reconcile Intelligent Design with the human back?

Post-CrowdStrike, Microsoft to discourage use of kernel drivers by security tools

So they lowballed the numbers affected. By how many orders of magnitude?

Re: Blue Screen

It should only fail once in a Blue Moon.

Surely the fact that the instructions for recovery by booting into safe mode indicates that there is a state where either the driver wasn't loaded or else it didn't try to read the offending file if it did. There's a halfway house of some sort. It will be a matter of risk management as to exactly what is now and what that might be in the future.

"The Friday thing is unforgivable, absolutely."

That was my first thought but it new appears that they might release several a day everyday. That makes both the pre-release at source and pre-install at client tests even more important.

The updates are pulled in automatically so don't go through the IT department at all and if they did testing would be automated. Given that testing the specific functionality isn't going to be likely (do you want to keep samples of all the latest malware anywhere on your network?) about the only test is going to be determining whether it falls over or slows the system. Maybe some firewall rules that only allow intermittent access to the update server and not all the fleet at once might be possible, automateable and even allow for the inclusion of a sacrificial box as a trip-wire.

"it is cheaper and easier to reboot a PC into safe more and remove a dodgy file"

There was the Bitlocker issue for one thing and the sheer scale for another. Some of them may not have been very accessible - those in public information displays, for instance.

The port of the Windows 95 Start Menu was not all it seemed

Re: "it appears the setup/design team made the change after the code was written"

And the start of a long process.