Posts by Doctor Syntax

You don't get what you don't pay for, but nobody is paid enough to be abused

Re: Jedes Schrift'l ist ein Gift'l

Dammit!!! German.

Re: Process failure

You're assuming rules-based management. Small businesses owned and run by directors don't work like that. That's why we distinguish between managers and manglers.

Re: Jedes Schrift'l ist ein Gift'l

Not knowing Herman I read it as "Each script is a gift" which also works - but from the point of view.of the likes of Doug who was holding the script.

Re: is 10x $$$ normal?

"and ten routers needlessly consuming power in a cupboard somewhere."

The skinflint manglement probably insisted on those being the ISP's routers. In that case they could be remotely managed at the whim of the ISP. Been there with my home router the one time I used the ISP's box instead of my own. I needed to make some changes to the DHCP pool I'd set up & found that since the last set-up they'd locked local management.

UK government woefully unprepared for 'catastrophic' ransomware attack

Nothing remarkable here

It's just another easily identified risk for which HMG is woefully unprepared.

Re: Bit unfair

The last time that happened under the last but one Charles it didn't go well.

Adobe warns it may face massive fines for subscription cancellation practices

"Adobe doesn't think it was."

It sounds as if it really does think that it was but is hoping it might get away with it and has its fingers crossed behind its back.

Europe inches closer to insisting gig workers are treated as employees

I'd hope that, unlike IR35, such legislation also allows for the right to be in business in one's own right.

Re: Not difficult

"One of the main criteria is if over 80% the income is from one "client" then you're actually employed."

I doubt it's as simple as that. On that basis if a plumber comes to service your boiler then unless he's somehow simultaneously getting at least a quarter of the amount you're paying him from somewhere else he's your employee at the time. If a jobbing gardener spends a whole day working on your garden is he getting the equivalent of quarter of a day's gardening pay somewhere else?

Like you, I doubt this sort of legislation would be introduced in the UK. The equivalent already exists here: it's called IR35. It means that HMRC can take their pound of flesh from the individual worker, no need to take on larger businesses who might be better equipped to fight back.

Tesla to remote patch 2M vehicles after damning Autopilot safety probe

Re: "recall"

Ah, yes. Here: https://www.theregister.com/2023/12/11/tesla_california_autopilot_lawsuit/?td=rt-3a

Re: In Other News

"WTF was Tesla thinking, releasing a test vehicle like that?"

He was probably thinking he'd be praised to the heavens. As usual.

Re: There's a movie in there.

I has the makings of a horror movie. No, make that disaster/

Re: a sticky brown smear

One thing the police and forensic scientists have to do is list things and the lists include clothing. You have to be careful to get the adjectives right. An "old lady's coat" isn't the same thing as a "lady's old "coat".

Witness statements might not be on the GCSE-English curriculum. Perhaps they should be. English is a more subtle language than it's often given credit for.

Re: "recall"

Hasn't Musk already objected that it interferes withhis free speech rights to call it Autopilot irrespective of whether it does what it says on the tin?

Oracle share price slides as it misses revenue expectations

It affects the value of the C-suite bonuses. Who cares about the company?

Alternative AKA: we screw our prisoners customers harder.

Microsoft Forms feature request still not sorted after SEVEN years

Hasn't anyone worked out the simple explanation

They'd put in on their to do list except for one thing. They need to enter a time and the list doesn't have a time field becuase...

It's missing time fields all the way down.

And where's the turtle icon when you need it?

Re: Don't rush them!

Maybe he had a day off.

Final Patch Tuesday of 2023 goes out with a bang

Re: "Don't any of these outfits test the software"

True, but that doesn't excuse not trying harder, especially when you see reports of updates breaking stuff or failing to install. I don't know about OpenBSD but the weekend's Linux Kernel/Debian issue was a really rare event and quickly sorted.

I left W10 checking for updates, went to the dentist. did some shopping, came back and - still searching. Then threw an error. I very rarely use that and quite frankly, fail to see why anyone relies on it for serious work.

Britain's Ministry of Defence fined £350K over Afghan interpreter BCC email blunder

It's instructive to compare this and the PSNI breaches with https://www.theregister.com/2023/12/12/us_air_force_discord_leaker/

I can guess which one is going to lead to things being tightened up in practice.

Cloud engineer wreaks havoc on bank network after getting fired

Re: "Brody worked as a cloud engineer for First Republic Bank"

"Now, the only thing everyone knows is that he watches porn on the job and abuses his knowledge to wreak havoc when being caught."

Also FRB customers know their bank fires somebody who does that and doesn't get round to revoking their access for a few hours.

Discord in the ranks: Lone Airman behind top-secret info leak on chat platform

Having the entire chain of command disciplined or fired! is an interesting experiment It has to be called that as it's certainly not the norm. If it was the norm the deterrence effect we'd see some improvements in security.

Northern Ireland cops count human cost of August data breach

"consider the implications of the Report and a timeframe for the completion of relevant actions"

Another cause for delay in getting round to tackling with utmost dispatch for those officers put at risk.

Boffins fool AI chatbot into revealing harmful content – with 98 percent success rate

Re: Quis custodiet ipsos custodes?

Not "who?" but "what?". And the answer to that it is "the outcome". Landing you in court might be an extreme example. Losing all your advertisers might be another although Musk seems not to have quite joined the dots on this one yet. It all depends on what's done with the output.

One thing that might prove toxic for the vendors is using the technique to reveal copyright material in the training data. It would makes it difficult to maintain the argument that the model isn't a derivative work.

Epic decision sees jury find Google's Play store is illegal monopoly

Re: This is the mother of all Google trials

"She told me that overturning a jury decision is very difficult."

Burying it just required money.

Re: Where Could This Go?

To the appeals court, of course. It ain't over 'til it's over.

British railway system is getting another excuse for delays – solar storms

Re: So, let's review

Add wrong sort of diesel in the signalling generator.

Kernel kerfuffle kiboshes Debian 12.3 release

Just escaped that one!

The problematic Debian kernel version was 6.1.0-14.landed here at the weekend. I installed that about 6 pm yesterday but didn't immediately reboot so continued running on 13. I'd seen a news item about an ext4 problem but it didn't register that this might contain it. Later in the evening I rebooted and maybe an hour afterwards an alert came up for a new update. I checked that & found it was for kernel 15. Realising that 2 kernel updates a day meant that there must have been a problem with the first so immediately installed and rebooted and then looked into the history finding the references in the article and this discussion https://lwn.net/Articles/954285/

This left me with the problem - did I do the big sorting out of email archives before or after the reboot? I think i was after but AFAICS, no damage done. Deep breath! This, BTW, was in Devuan but as far as non-systemd stuff is concerned, it's Debian

Debian 12.4 with the corrected kernel was out by the end of the day, BTW. See amacater's post towards the end of the LWN comments.

As far as I can make out from the discussion the later patch was - ironically - supposed to deal with the possibility of corruption in the event of a system crash under certain circumstances which is the sort of thing that's like;y to get a high priority for back-porting and the earlier patch that didn't get back-ported may have been the performance-related one.

Systemd 255 is here with improved UKI support

Oxymoron alert

"Well-written daemons can still end up containing buffer overflow vulnerabilities"

Re: If you don't like it..

Don't need to for two reasons. A fork of systemd would still be a forked systemd and it's not needed as SysV init still exists.

Re: They're everywhere...

Once Debian went it was always going to be followed by most of the distros that are based on it (except for a few deliberate standouts such as Devuan). Chief among the distros that follow it directly is Ubuntu and that then dragged in all those that follow Ubuntu such as Mint.

I'm not sure why you would find Devuan more difficult than Debian. IME it Just Works as you'd expect Debian to do (if we draw a veil over linux-image-6.1.014 and Debian 12.3).

Re: I'll stick with a kernel panic message, thank you.

Who's this "they" you keep referring to. There are plenty of us who loath this stuff and make our views very clear. I agree that BSD developers wouldn't touch it, however.

Re: Merging /bin with /usr/bin and /sbin with /usr/sbin

"Part of me wonders if there's a Bloody-Stupid-Johnson type thing going on here, where patrons keep funding Poettering out of morbid fascination as to what he'll screw up next."

Remember who employs him and worry about

Systemd 365: It is a single binary blob. Everything else is eliminated and the entire system is now a thin client to run application in Microsoft's cloud. Google & AWS are complaining to the regulators and working on reverse engineering so they can fork it.

Re: There are places...

A log-file in plain text, Jake? What are you talking about? This is systemd.

Re: Everyone Hates systemd

In the IT world "modern" is a warning. It inevitably means that something that was important was chucked out and replaced with something that adds no value but possibly a vulnerability.

Re: /usr

A separate /var is useful, and I set it up to reformat at install time - I've seen an install messed up because there was prior content there. Of course this is a bit of an issue if the distro puts web server data and/or database data there. They should be in /srv and symlinked back to /var in case the system expects them to be there.

Re: /usr

You forgot the other bright idea: /u2

I'm with Vometia on this. The clean-up should have been to get the stuff that wasn't home directories out of there with maybe a /local for locally provided stuff. Letting /usr/bin gradually take over was just doubling down.

Re: K.I.S.S.

"with System V initscripts I can follow what happens"

You can even run them on the terminal to debug them with single stepping. Or you can insert some logging commands to see what's happening when run for real.

I spent a very long time trying to debug video on a MythTV box running Upstart because I couldn't work out how to monitor what was happening. It turned out that the TV was lying about its video resolution reporting itself as having the screen of a PDA. Then along came systemd like Upstart on steroids.

Re: systemd fixed a lot of issues

A well-written daemon wouldn't need to ban itself from doing what it doesn't need to do. A well-written daemon wouldn't have code to do what it didn't need to do. A well written daemon wouldn't need to ban itself from using code it didn't contain.

23andMe responds to breach with new suit-limiting user terms

"A user ID is supposed to uniquely identify the user. It's not supposed to be an extra password. So email address is perfect for that."

If the string representing the user is not unique to the user/password combination as well as unique on the particular system then it isn't unique. And therein lies the problem.

Re: First rule of business is make it easy to pay

You and I probably come at this from different directions. Mine is one where, in addition to spending about half my working life in IT, I spent another third investigating crime whilst fully aware that investigation was a poor second to prevention.

We know that many people will use the same password, don't we?

We know that many people have only one email address, don't we?

Is it a good idea to help save users from themselves?

Maybe you'd answer "no" to the last one although a moment's thought should tell you they'll blame you if something like this happens to them. However, if we answer "yes" what steps can a system designer do to implement this?

One is to insist on a strong password and hope they don't use the same password elsewhere; if they have trouble remembering a password they'll probably reuse it, even if it is a strong one so that doesn't necessarily protect them at all so you can't be sure it will be unique.

Another is to use 2FA. That's a pain if the text is sent to a phone with a flat battery (a common state of mine) or takes an age to arrive for some reason (been there too). That's failing your requirement of making it easy for the customer to pay. What's more it has its own set of problems. It becomes a problem if the phone is lost or stolen, especially if there's information on there which indicates which site the owner uses. If that happens to your phone you should quickly realise that you are no longer you; whoever has hold of your phone is now you. And if as a site operator you use a third party to handle the 2FA you've just increased your chances of a supply chain attack.

You could try checking Have I Been Pwned to see if the credentials are there, warn the user if they are and insist on a different password. It's not 100% as the combination could have been stolen but not made its way there and even if it hasn't been stolen yet it's still lousy forward security.

So it comes down to not trusting the user to use a unique password nor to choose a unique user name if asked but to simply assign an arbitrary account code and rely on the miniscule probability that the user doesn't have the same one elsewhere. There's nothing stopping you taking an email address as well - you'll probably need it anyway - but just realise it makes a crap user ID for anything other than the user's email.

My personal preference is a unique email address for anything that matters and a set of random characters generated by Keepass and stored there. For anything that doesn't matter they get the current email address for things that don't matter which will get replaced after a few weeks or months.

Credential stuffing. Same UserID and password. Same password because the user is lazy. Same UserID because sites insist on using email address for that and most users only have one. The reused password is irrelevant (the password's being weak is a separate matter) if the site issues arbitrary UserIDs. Email address as UserID is the gift that keeps giving - for the criminals.

And you can always deny getting the email with the objection in it.

Bank's datacenter died after travelling back in time to 1970

Re: battery powered network time clock?

That's tough seeing as it was the basis for the entire story.

Re: Priorities

See my comment above about the difference between a manager and a mangler. He failed the test.

Re: Priorities

They're simply repeating an instruction your mother gave him when you were born.

Re: Yearly tasks....

Having had trouble remembering the exact wedding date cal has been a great resource - just check which of the two alternatives was a Saturday.

Amazon's practices are 'the essence of competition,' it tells judge

Of course they're competitive. They're outcompeting all the little people, aren't they? How dare anyone say anything different?