Posts by Doctor Syntax

Council claims database pain forced it to drop apostrophes from street names

North Yorkshire is in no position to complain about meaningless names, given that the county extends as far south as Selby.

Re: BS7666

Ah, yes. The Indian S/W house that replaced their programmers every few months as their visas expired and we, on the receiving end, would be sent XML broken by an apostrophised Irish name because the new guy had fixed the bit of code he didn't understand and must therefore have been wrong.

Re: Tail wags dog

"Maybe SAP could sell West Yorkshire Council a version with sensible input validation"

We have enough problems here in West Yorkshire and especially in Kirklees without SAP or new versions thereof and it wouldn't make any difference to the North Yorkshire anyway.

Consultant charged over $1.5M extortion scheme against IT giant

Re: Security "consultancy" firm...

And irrespective of that the consultancy should have taken the precaution of cancelling his access to both their own system and the clients.

Ten years ago Microsoft bought Nokia's phone unit – then killed it as a tax write-off

Re: Beancounter in charge

HP

Re: Public Service Announcement

As a business which is doing fine but with their name used by HMD - what if they were to buy up HMD, bring manufacturing back in house with the build quality of the originals?

Re: Stack ranking

"Nokia would use its mobile experience to mold windows 8 into something marketable"

They might have moulded a mobile version of Windows into something marketable but trying to put a mobile UI on the desktop was always going to be the calamity we saw.

Re: Nokia menus

Cheap and cheerful certainly doesn't describe the older Nokias such as my original Communicator. The later one was definitely not so good. There's an eerie parallel to HP.here.

Re: "The... Maemo operating system failed to take off"

"Elop sold himself as a Microsoft Insider, so, perhaphs he should have known that the succesiove versions of the OS would arrive late and buggy"

Yes, but he'd also have considered that not just acceptable but normal.

Techie's enthusiasm for decluttering fails to spark joy

I'd expect telling apt to remove one dependency to prompt with whatever else it was going to remove. Perhaps Monty added a -y flag.

Re: Well-crafted tale of woe!

Don't leave the odd one to the end. Don't start with it either, leave it to second or third.

"servers should be sheep, not pets. Basically all identical"

Here in sheep farming country you can tell them apart. The farmer paints numbers on them.

Has Windows 11 really lost marketshare to Windows 10?

Re: "what happens next?"

Who would fancy the job of going to the beancounters to tell them they have to budget for replacing a fleet of PCs in good shape and working well before the H/W hits physical EoL just because Microsoft says so? Or alternatively explaining that paying Microsoft a subscription for extended support isn't really blackmail?

RHEL stays fresh with 9.4 while CentOS 7 gets a Rocky retirement plan

Would they have extended RHEL7 if Rocky hadn't been looking over their shoulder?

Once they start circling it that drain's hard to escape.

Dating apps kiss'n'tell all sorts of sensitive personal info

GDPR doesn't allow them. It needs to be enforced; pro-actively enforced.

Re: Never give out your correct information

"I have had ejits tell me I must hand over email addresses and personal details just to buy something over the counter with cash"

It's ceo@$(company's own domain)

Microsoft doesn't want cops using Azure AI for facial recognition

Obviously they don't want to be dragged into disputes arising from miscarriages of justice. I wonder what prompted them to think of that.

Windows users left to fend for themselves after BitLocker patch bungle

Re: Time to re-create recovery partition (again)

From what I can remember of reading the earlier version of the instructions the last two commands of your step 3 are dependent on some attribute of the recovery partition that you had to make a note of before you nuked it.

And all this CLI stuff to install a patch on an OS that's promoted as being GUI-friendly.

"A standard installation shouldn't result in them being laid out in the wrong order."

A standard installation should be supported by subsequent patches.

Re: Inevitable.

This zombie patch keeps trying and failing to install itself even on computers that don't use Bitlocker.

Re: Inevitable.

I think that would really be a step too unfamiliar.

"unfortunately we're invested in MS"

Try to find an explanation of the sunk cost fallacy in words simple enough for manglement to understand. I know that in this case "invested" will largely mean time and effort but after all, time is money.

BASICally still alive: Classic language celebrates 60 years with new code and old quirks

Re: BASIC

There are programmers who can write BASIC programs in any language.

It may take decade to shore up software supply chain security, says infosec CEO

Share/spare? I was going to say exactly that. We don't. Those parts of it that don't understand the meaning of "urgent" need to get dropped.

UK inertia on LLMs and copyright is 'de facto endorsement'

Re: Value of Data

The argument continues that if something has worth then anyone who has need of it should be able to take it freely. The corollary must be that, accepting at Microsoft's valuation that their software has worth, then it can be freely pirated.

Re: World-Leading

The fact that this is a response to a substantial, well argued report to the contrary tells us only that the responder has reading and comprehension problems.

"If you go too far down a path where it's very hard to obtain data to train models, then all of a sudden, the ability to do so will only be the preserve of very large companies."

Translation: We don't want to spend money on that.

Huawei's hidden hand in optics research contest shocks scholars

Re: "US government is no stranger to upgrading sanctions"

I understand a pair of tin cans with string stretched between them are a pretty good communications device.

Microsoft, Google do a victory lap around passkeys

Whenever this topic comes up the thoughts running through my mind are complexity = greater attack surface and Security as a Service = supply chain attack.

KISS.

Re: It's all about liability

If the password is salted and hashed that should deal with the risk of holding that. The problem sites aren't really those who realise the risk - they could mitigae it. It's the sites who don't or don't care who hold the entire database in clear and don't hold it securely enough.

Re: using passkeys with their face, fingerprint, or device PIN

"Identifiers are not secret -- they're commonly public knowledge"

Why? They don't have to be. Sites insist on using an email address as an identifier. They shouldn't, even if they collect an email as necessary contact information. All that happens is that the general public has been trained to accept that they don't have to remember/record unique ID/password combinations. If the site issues a user ID, maybe three random words, then even if the user always uses the same password the unique, secret identifier means that the combination is unique and secret.

Agreed, and the other downside is "access to my phone as I always have it on me" along with the unspoken "and it's always charged" and the OP's "most people". It creates a lot of cases where some people are permanently disenfranchised unless they get a phone they don't want or can't afford and others, including me, are often temporarily disenfranchised.

Re: Farcical

a list of email/passwords from some site and then re-uses those to login to a bunch of other sites because most people aren't going to bother with the whole "use a different password everywhere" thing

Don't require email as a login ID. Preferably have some other site issue a login ID. Unless the attacker can work out what ID a site might have issued that entire site list is useless for other sites. Collect an email address if needed to communicate with the user but don't use it as a login ID. Collect real names if needed but don't use them as a login ID. Set up a user handle if needed (e.g. on el Reg) but don't use it as a login ID. If that were normal practice we almost certainly wouldn't be having this discussion every year.

"Is it so hard to sell dongles that hold a cryptographic key?"

Whoever has your dongle/2FA device/whatever is you.

Re: This is the part I can't get my head around...

"or I suppose using 2FA with SMS which isn't that hard to defeat.

...

As mentioned above, even if you don't back anything up you can recover your passkeys one site at a time using the 2FA method you enrolled when you created it."

So you can recover a passkey site-by-site using a 2FA which may not be hard to defeat. That doesn't seem to add to security at all. And if you do have a protected backup you still need to preserve a means outside of the passkey mechanism - another easily defeated 2FA job> - to recover it.

Europol op shutters 12 scam call centers and cuffs 21 suspected fraudsters

Re: Why is this so prevalent

"Someone in Kosovo is making many calls all over Europe everyday and this goes unnoticed."

Presumably there are "legitimate" call centres making marketing spam calls and possibly really legitimate call-centres making bona fide outbound calls. Without a legal requirement to do so it wouldn't be the Telcos role to police this nor would they have the incentive to do so voluntarily.

I've previously suggested a means to incentivise them. Enable the subscribers to report a recently received call by dialling a specific code. The originating number, as opposed to the faked number would be traced. If that were a subscriber of the same telco the caller would be charged a fee on the recipient's behalf to be credited to the recipient's account plus the telco's handling charge. The fee would naturally be higher for a recipient on a scheme such as TPS. If the call originated outside of the final telco's control the charges would be passed back to the telco who had forwarded it. They could then pass it on with their own handling charge until it arrived as a charge on either the caller's account or with a telco which had been insufficiently concerned to keep logs. Naturally some statistical work would be involved to set a minimum number of reports from different recipients to prevent someone trying to make money out of legitimate calls.

On one level it would be to reimburse recipients of junk calls but would also help trace fraudulent calls. On another it would kill the whole call centre scam by making it unprofitable if the charges were paid which in turn would ensure telcos' credit control would make it much harder to set up anything other than bona fide call centres.

On another level it would involve telcos making investments needed to implement it with the knowledge that by stopping the calls they'd never get their investment back in handling charges.

On the real level bringing such a scheme forward as a serious proposal would very likely lead to telcos, ever anxious to help the authorities discovering some much simpler, cheaper and hitherto overlooked means to block what they adgreed was this disgraceful abuse of telecommunication systems.

Re: "plus cash and other assets totaling €1 million"

21 arrests from dozens of raids seems a fairly small number. Possibly the minions have been let off if they helped to finger some of the higher-ups.

Re: Why is this so prevalent

"Telcos seem to be powerless to stop it."

Telcos are not motivated to stop it. It brings in money and has no penalties for them.

Prof asks court to protect his Unfollow Everything 2.0 extension from Facebook's ire

It's a Zuck-off

Florida man gets 6 years behind bars for flogging fake Cisco kit to US military

"This case should serve as a warning to those who attempt to sell counterfeit goods to the US government,"

Or it could serve as business advice to the effect that you can get away with selling fake stuff for a long time provided you don't try to sell to the US govt.

Not a Genius move: Resurrecting war hero Alan Turing as your 'chief AI officer'

Re: Erm...

"Nobody is owned by their descendents,"

Their property will be owned by their heirs. Even those with no descendents will have heirs. That property may include various rights including intellectual property rights.

Re: Turing misinformation

May "not worldly wise" would be a better way of putting it.

Re: Well, yeah.

Passing the so-called "Turing Test" is fairly easy. Any idiot can do it.

Customer service teams frequently fail.

Block accused of mass compliance failures that saw digi-dollars reach terrorists

"Block claimed that's not uncommon after reviews of complex systems, and that hiring an independent review team shows that it takes compliance seriously."

The time to take compliance seriously is when the systems are being designed, not after they've gone live and become available for exploitation.

Microsoft confirms spike in NTLM authentication traffic after Windows Server patch

"New Technology LAN Manager – is a very old suite"

Nothing ages a product so much as calling it "New".

AWS customer faces staggering charges over S3 bucket misfire

Re: Use the tools that are there to protect you!

Yes, but this was just a test. After all texts are trivial. You can even test on the live system...

Re: Let's have an AWS singalong...

Well played, sir.

This is a bit puzzling in the article. How did he come to have the same bucket name as that of the unnamed tool? Alternatively how did the tool work before there was an actual bucket set up with the name it uses? It looks as if obfuscation of the original report has succeeded to the point of incomprehensibility.

Re: This is just one example

Most businesses don't have any of these things. The owner/user's PC sits on the desk, not in a server room. If the power goes off the whole business shuts down anyway, or at least reverts to whatever can be done without any powered machinery or even lighting. It seems to be an assumption in these parts that a business automatically has a server, a number of clients and an online presence.