Posts by Doctor Syntax

Microsoft rolls out safety tools for Azure AI. Hint: More models

Re: AI can turn any rushed oversight into a lethal footgun

In other words, having the experts train their replacements. I don't think that would turn out well once the trainers cottoned on to what they were being asked to do.

"a custom language model that evaluates unsubstantiated claims based on source documents"

Which source documents are these? The source documents that we really positively never touched because they're customers' property? The source documents that really are not in the model because the model is simply a statistical summary of lots of documents so it can't be a copyright infringement? Or the source documents which form a carefully curated, reliable training set as opposed to blindly sucking everything in sight into the general training set?

Pressuring allies not to fulfill chip kit service contracts with China now official US policy

At what point does this become state aid on behalf of the US industry? The sort of alleged state aid that the US usually takes as an excuse to erect tariff barriers.

Majority of Americans now use ad blockers

Re: If they had behaved themselves I wouldn't need to block them

" If someone wants to insist that I have to watch their video adverts, well I don't need to view anything on their site."

And I certainly wouldn't want to buy anything they're trying to flog me. Paying to show me ads for their competitors might be marginally effective.

"Anyone who can implement a decent server-side ad-dispenser will probably do well with it"

Sadly, probably not. Where's the complex tracking and targetting technology that the punter (the actual advertiser) can be charged for?

Re: I wouldn't mind reasonable ads

Of course if the advertising industry smothers them with statistics to show how accurate their targetting is they won't know they're wasting money. The two relevant data items the advertising industry won't be in a position to collect are that the lawnmower has been bought and the alternative one, that the potential buyer has changed their mind.

Re: I wouldn't mind reasonable ads

You're getting downvotes for coming so close to making sense here and failed.

How about they fling out the same ads to everyone visiting a site, without trying to make them any more relevant than "whatever the subject of the article is"?

The easiest and most accurate way to understand what's relevant to the visitor is the subject of the page. Why try to make them more relevant by tracking what the user has looked at in the past?

If, to take the example, I was looking at lawnmowers last week but looking at chainsaws instead this week it may well be that either I've bought a lawnmower, in which case ads for lawnmowers are irrelevant, or I've decided not to buy one in which case ads for lawnmowers are irrelevant (you might notice a theme emerging here).

There is, of course, one body of people who will make a profit by showing me ads for lawnmowers even if the evidence shows I'm now in the market for a chainsaw instead. They're the people who are selling my attention to lawnmower makers. It's not to fanciful to consider whether they're actually defrauding the lawnmower makers as well as invading my privacy by tracking me.

From the advertisers' PoV the best value is likely to be to show me lawnmower ads when I'm looking at pages about lawnmowers and chainsaw ads when I'm looking at chainsaws but then there's no expensive alleged targeting money to be made from that; the advertiser could contract directly with the site publisher and cut out the advertising industry middleman.

For avoidance of doubt I own a couple of lawnmowers, chainsaws, strimmers and garden shredder. I'm not in the market for any more so any advertising that I might fail to block would be an irrelevant waste of money but I would appreciate some decent weather to get out into the garden to use some of them.

Re: Hahahahahahahaah!

I rather think "advertisers" referred to people working in the advertising industry. The ones who sell advertising to the actual advertisers. Of course the actual advertisers may well not like other people's ads but they themselves are so special nobody would want to block their ads. Or maybe think they're clever to know about ad blockers but think their target audience won't.

Re: Hahahahahahahaah!

"I do it anyway because bad behaviour shouldn't be rewarded."

It certainly shouldn't. Don't use those sites. What's really alarming these days are the likes of FOSS projects who won't or, I suspect, can't put up a site to display anything useful without Javascript turned on. If a project can't do that I assume it has nothing useful to offer.

Re: Still too low.

Anybody who calls themselves a "cyber" anything is probably technologically incompetent.

Or selling their services to people who only recognise those words. Needs must & all that.

These 17,000 unpatched Microsoft Exchange servers are a ticking time bomb

Re: Those damned reboots

I'm sure she's adequately rewarded for the pain but rather her than me.

Re: Those damned reboots

"I don’t know how other mail servers (Linux, windows or other hosted) have handled updates and thus whether they are actually any better in this respect."

Looking back at emails from Mythic Beasts since May 2015 there have been just 5 which refer to the server which provides my email access being out of service. Two were for hardware upgrades and two for OS (Debian) major version upgrades. The other was unspecified. For the OS upgrades they were setting aside an window of 2 hours with the expectation of it only taking 30 minutes. On the basis that their servers are a bit niftier than my laptop and having done the equivalent Devuan upgrades I've no reason to disbelieve they achieved that.

What normally happens with less drastic Linux upgrades, say a new version of LibreOffice, is that new versions of programs or libraries are put in place and linked to the file names so that on the next invocation the new version is picked up and, when the old ones become redundant their storage allocation is released to the free list. To ensure that happens with a service such as the exim mail server the service is stopped and immediately restarted which happens PDQ. I've only once, in many years, seen a service which was so low level that it needed a reboot. Sometimes an update obsoletes a library entirely in which case the old one may be left there to be removed by the administrator or autoremoved. On a multi-user system the onlly person noticing what's happening will be the admin.

It's left to the new software to update per-user config files if that's needed. System-wide config files are also replaced but the admin might be given a choice as to whether to compare and leave the old versions in place. Updates to time zone data simply put in place the new file and restart the service.

With kernel updates the necessary files are files are put in place and the system can be rebooted as convenient to simply start running the new version (the service reboot I just mentioned was also on an as convenient basis). A reboot to a new kernel takes no longer than a reboot to an existing one - it's exactly the same process. How long it takes depends largely on the speed of the H/W and how many drivers, etc. have to be reinitialised. On my laptop, which is far from top flight because good enough is good enough, it takes about 42 seconds from pressing return on OS selection to having the desktop running, including time to enter the password. The process inevitably leaves the old kernel sitting alongside the new one and selectable at start time; some distros will remove the previous old version during the update, some will leave them for the admin to remove.

These days, at least for Debian, procedure for a complete version upgrade is not dissimilar except that everything gets replaced. The relevant config lines are pointed at the new version name and a variation of the normal update commands are run. The old system keeps running whilst replacing all its components underneath itself and then rebooted. (I think Mythic will have downloaded all the new files in order to get under 30 minutes.)

Basically, that's it. It Just Works, even at major OS upgrade level, let alone just updating a mail server.

Re: Those damned reboots

Perhaps you and your wife should be looking very carefully at whether she really, absolutely, unavoidably has to use Windows.

Re: Those damned reboots

"Updates to Linux systems that affect the kernel pretty much do require actual reboots, it's just that the update will remain pending until you next reboot the system."

Also, a Linux reboot is just that - stop what's running and restart with the new kernel which is already in place. From observation (because it's the only way to understand what might be in a black box) the Windows reboot for an update undertakes a lot of the update work in the course of an reboot so there's maybe a couple of orders of magnitude more time involved. And, of course, kernel updates are usually one every few months, not every month.

Re: Those damned reboots

Ah, yes, but remember that Linux still has to restart updated services so they'll be out of action for as long as a fraction of a second.

Re: 17000+

Just looking at the headline I thought it probably wasn't too bad considering how many instances there must be worldwide. Then realised it was just one country. Wow.

University of Washington's Workday woes leave research grants in limbo

Re: Testing? What's that?

I don't think you'd need to be a specialist to realise that it would be a good idea to run parallel with just one initial transfer from the legacy system to see if it works,pull back if it doesn't and only proceed to the next when you're sure its working.

Quotes such as "the necessary migration to Workday from our old legacy systems" suggests over-commitment to their chosen solution. It may have been necessary to migrate from their legacy systems. Migrating to something that's causing that much hold-up to paying invoices and processing research grants is very much not necessary.

"the update is currently on budget and on track"

If that's the case there must be something wrong with the projected track.

PostgreSQL pioneer's latest brainchild promises time travel to dodge ransomware

Re: Why the cloud?

You're licky it's just cloud and not AI and blockchain thrown in for good measure.

"putting the cloud operating system on top of a distributed DBMS"

And what's the distributed DBMS running on top of?

Hyperfluorescent OLEDs promise more efficient displays that won't make you so blue

Re: Monochrome World

Monochrome - single colour.

Yellow is a single colour.

"hyperfluorescence – a term coined by scientist Chihaya Adachi and trademarked by display materials specialist Kyulux"

Marketing getting to work early.

Meta accused of snarfing people's Snapchat data via traffic decryption

Ought to result in jail time. Probably won't.

Instead the TLAs will want copies.

Uncle Sam's had it up to here with 'unforgivable' SQL injection flaws

Re: Misleading paragraph

It seems to but doesn't. It can equally well, and should apply to string sanitisation. Not the finest bit of el Reg writing, I'm afraid.

Re: SQL is the problem

"One that looked like code and did enforce them could end up fixing the injection risk in such an ugly way that nobody used it."

And would be more prone to bugs.

Re: more likely that "input sanitization techniques" was meant

My GP's online system appears to be applying string sanitisation to passwords. That worries me they're storing the passwords online in clear.

Re: SQL is the problem

A good programming language is one which allows the developer to express the requirement clearly and should be equally clear to read for anyone who has to maintain the code afterwards. For its given domain SQL does just that and it's a good deal less verbose than what I understand COBOL to be.

I'm not sure of your preferred programming language but whatever it is could you give an example of how you think it should be done to extract data joining, say four tables, with selection criteria spanning at least five columns in at least three of the tables. At least one of the criteria should be a range of values and at least one other should provide the equivalent of a SQL OR clause to filter on multiple values for that column.

Then explain how the resulting code meets the clarity of expression and reading criteria better than the equivalent SQL.

The problem in TFA is not SQL It's in constructing the SQL on the fly as opposed to parametrising a pre-written statement. About the only benefit of your "real" programming language is that parametrising would be unavoidable. The downside is that you'd have to produce a complex set of statements for each individual SQL statement you replace.

I'm trying to cast my mind back 40 years to the time before Informix adopted SQL and we had to use a C library instead. Fortunately time is shielding me from that.

Re: “parameterized queries with prepared statements” are “brittle”

You're excused. The paragraph you're looking at uses "These" and "they're" ambiguously because it's not specified to what they refer.. You parsed them, quite reasonably, as referring to "parameterized queries with prepared statements" in the previous paragraph.. It seems more likely that "input sanitization techniques" was meant. If you read it like that it's consistent with your getting yelled at.

Lenovo scores deal to build supercomputer at UK's Hartree Center

Wait until somebody notices the Chinese ownership and the panic sets in.

CEO of UK's National Grid warns of datacenters' thirst for power

Re: off peak power

800kv applied direct to the logic boards should solve the problem and be quite illuminating.

The UK Digital Information Bill: Brexit dividend or data disaster?

Re: Growth & innovation

I used to think it was a law of political organisation that any party of sufficient size would develop a Dunning-Kruger wing.

Then I thought of the opposite. Any party of sufficient size develops a non-Dunning Kruger wing. That fits observed data much better.

They've all got one. The best we can hope for is that the main parties don't have their DK wing in the ascendency at the same time and even better if the one in power doesn't.

Re: Northern Ireland's retained EU personal data protection rights

Still no mention of how the Bill will "handle" Northern Ireland's post-Brexit protections

We can work out the answer to that one easily enough: as badly as it has handled every other aspect of the Good Friday agreement because that assumed that NI and the rest of the UK and Ireland would all be in the EU. The only way they could have kept the process on the rails would have been for the Republic to leave the EU at the same time. I doubt they expected that to happen because I doubt they thought anything through to that extent.

Re: A gift?

AFAICS it had two objectives.

1. Get themselves elected

2. Escape from adult supervision once in power.

This is part of step 2.

After some thrashing about in the ball-pit they'll have gone and leave somebody else to tidy up what's left.

Fujitsu set to be preferred bidder in UK digital ID scheme

Really??!!!

Twitter's lawsuit against anti-hate-speech crusaders gets SLAPPed out of court

I wonder what his reaction was? To send the judge a poop emoji?

Time to examine the anatomy of the British Library ransomware nightmare

From the incident report:

"A few key software systems, including the library management system, cannot be brought back in the form that they existed in before the attack, either because they are no longer supported by the vendor and the software is no longer available, or because they will not function on the Library’s new secure infrastructure which is in the process of being rolled out."

There's no substitute for having source: whether it's your own, open, available or in escrow matters rather less than making sure is will be available and can be rebuilt if needed.

AFAICT the report mentions no changes in personnel management, yet it's the personnel management who orchestrated this disaster.

Re: "Too old to be safe, too expensive in time and money to replace"

Once a piece of software is built it should essentially work, as in keep doing the same thing (functional defects may mean this isn't the "right" thing), for all eternity. We need to rethink how we deliver applications.

Two things there. 1. It may have as yet undiscovered vulnerabilities built in. 2. What it does when delivered isn't necessarily what it will need to do in the future.

Development is the process of launching a software product into the maintenance cycle. Eventually most of the work that has been done on it may well have been done by maintainers. They need to be at least as good as the original developers.

Re: What's the odds

One bullet point from the PDF dealing with improvements for the future:

"a holistic, integrated security suite that covers the whole organisation, backed by managed security partners for improved incident response, detection, and remediation"

I read that as "Single point of failure exposed to supply chain attack."

Re: The 21/22 annual report is instructive

They were getting round to it.

From the incident review document: in late 2022 the increasing use of 3rd party providers in the network was glagged as a risk. A review of security provision relating to is was planned for 2024.

Re: Reason #854637

"because I didn't manage staff and that's how the wagers were calculated."

And that goes right through the thinking and also a long way back. Investigating crime and giving evidence that could clear or convict someone on charges that could result in life imprisonment but don't manage staff? you don't have the responsibilities needed for promotion. (At least not until you hand in your notice at which time it's magically offered without any of the usual procedures.)

Re: Reason #854637

IT contracting is most definitely *not* the pot of gold it used to be.

It was only considered such by those permies who, for one reason or another, didn't want to partake of the fabled pot.

Re: Reason #854637

The is Britain, and the only "valued and rewarded" jobs are crap like sales or financial services.

And the only valued and rewarded qualifications are in the Humanities.

Boeing top brass stand down amid safety turbulence

Re: Whether they will look outside the company

Too big to fail lasts until it becomes too big to prop up.

Re: Whether they will look outside the company

"Ryanair ... already have their own QA inspectors embedded at Boeing factories."

QU inspection of aircraft is probably a chargeable extra on the ticket.

So it was the Alaskan Airlines blowout that was the watershed moment? Not the 737Max crashes? I suppose they didn't count as they were somewhere foreign, almost entirely out of USian consciousness.

DBA made ten years of data disappear with one misplaced parameter

If they didn't have all that busy-work to do somebody might notice that they're not really needed.

Re: This is why we ALWAYS test new procedures on a COPY of the production database

Not even it but because. We also COUNT the number of rows that will be affected. But is Oracle so slow that two month's worth of rows couldn't be SELECTed?

Labor watchdog wants SpaceX's gag clauses to disintegrate like its exploding rockets

Re: It is worse

"Reuters documented at least 600 previously unreported workplace injuries at Musk's rocket company:"

I'd have thought that the usual ambulance chasers would have latched onto these PDQ.

Re: "Those would be big no-nos under US law"

Didn't the union bosses manage to acquire some of that sparkle for themselves?