Posts by Doctor Syntax

Barts NHS hack leaves folks on tenterhooks over extortion

"I live in a country which is rather obsessed by paperwork ... There must be multiple insecure copies of almost everyone's identity documents spread around the net, a lot of them stored on e-mail servers in other jurisdictions,,,

Is there any place that gets this right?"

I think there are a number of principles which need to be built into data protection but seem to be absent:

1. Data subjects' rights are treated in the same way as consumer rights: any contract wording which purports to waive them is void. This is not restricted to consumer transactions. It applies in all circumstances, e.g. sharing data with an employer.

2. Drop all the verbiage about data controllers and data processors. There are two roles, data subject and responsible data holder. The responsible data holder is responsible to the data subject for the safeguarding of the subject, for their own conduct and that of any third parties with whom they share data. The responsible data holder is, in the first place, the party with whom the data subject shared their data. If the original data holder ceases to exist any third parties with whom that data holder shared data become responsible data holders.

3. The data holder is responsible to the data subject in a court in the most appropriate jurisdiction. In the first place this would be either the jurisdiction in which the transaction requiring the data sharing occurred (not necessarily that governing the transaction itself) or the jurisdiction of the data subject's normal residence. There would have to be good reason for the court to be in any other jurisdiction. The data subject's preference would be accorded most weight in such a decision.

4. The data protection registrar would be empowered and required to make unannounced data protection audits on any organisation in their jurisdiction, irrespective of any requirement to register.*

5. The data protection registrar would be empowered, if they believed the regulations were being breached, to order a data holder to suspend processing personal data and require any third party to whom they had shared data to suspend processing that data.**

* This, I think, would deal with such casual holding of data the OP mentions. That would provide a disincentive for departments or individuals to hold data contrary to company policy as it would very likely make it a sacking offence within the company.

** A similar provision was in the UK DPA 1.0; it was obviously a powerful sanction but I believe it also intended to act as a trip-wire in that it could be applied without having to go to court. Court proceedings would result in arguments and delay. It would be a last resort but could be applied at once after which continued processing would be an offence in itself resulting in a prosecution which would be very difficult to defend even if the DPR's original view could be successfully argued against. At least this was my reading of it; at the time the DPA was past my job was very much involved with the courts and this aspect of it struck me as likely - in fact obviously - being intended for use in this way should the need arise. I never heard of it being invoked as it was preferable to educate and, if need be, chivvy organisations into complying.

Re: Obligatory messaging on data usage for legal purposes

"forcing messaging the data owner on significant usage by third parties"

It would need to be very deeply embedded in the storage system as any data heist would be designed to avoid this as far as possible.

"For legal purpose any significant transaction or contract without messaging the data owner and confirmation by the data owner should be considered void."

The contract would also need to include penalty clauses in event of it being voided in this way, otherwise it would provide a very undesirable way of a company wriggling out of a loss-making contract.

"telephone number is 01234 567890"

A twist is giving them their own telephone number. They'd probably not notice that either, especially if you include the country code.

Re: How would I go about having my confidential records removed from NHS computers?

Ask Palantir politely.

"people's financial details, CVs, and copies of passports and driving licenses"

Regard such data as the equivalent of an unstable explosive which also happens to be extremely toxic and ask if you really want to store such material and how well you'd isolate it if you really had to store it.

InfluxData apologizes for deleting cloud regions without performing 'scream test'

"In hindsight, our assumption that the emails, sales outreach, and web notifications would be sufficient to ensure all users were aware of and acted on the notifications was overly optimistic,"

They were evidently acting as DBAs for their customers. I've said a number of times that the first requirement of a DBA is paranoia. That comes before any particular skills or product knowledge. Optimism of any degree is not a substitute; it's the exact opposite.

The other thing I've said here a number of times is something their customers are now realising: cloud is somebody else's computer and you don't control it.

Re: It seems like a mistake they won't want to repeat

Given that the customers affected might well sue them out of existence and whilst that's happening customers in other regions will, presumably, take note they might not have too much chance to repeat it.

Tech execs turn to drink and drugs as job losses mount

And they think that's going to make their work better?

Microsoft's 10,000 job cuts didn't quite do the trick

"the quality slips, the services slip"

How?

Re: Massively profitable company

"loads of the people that earn us those profits"

Either those people were earning the profits, in which case how do they make profits in the future, or they weren't in which case why were they employing them in the first place and wouldn't it make sense to start with the most highly paid of them?

EU gives its blessing to reopen data pipelines to the US

I think the central weakness of all these arrangements is that any disputes are to be heard in a US court. They should be held in the jurisdiction where the underlying transaction took place, assumed to be that in which the data subject initiated it, and between the data subject and the party with which the transaction took place.

If, for instance some transaction takes place between a customer is in Germany (I'd like to say the UK but obviously we're now mere spectators) and a multinational trading company with an EU base in Ireland who uses a data centre in the US where the data is misused by anyone - US intelligence, some adtech company or a malware-weilding North Jorean gang - it is the multinational who answers to the customer in a German court.

It should be the clear responsibility of a trading company to take care of any data it takes relating to an individual; if the trader relies on a third party they, having tasked that third party, remain responsible for whatever mistakes that third party makes.

Re: "limits to the access US intelligence agencies have to EU citizen's data"

"what's Plan B ?"

I think this is Plan C already. And Max Schrems will already have his counter Plan C to hand already and I doubt he'll wait for the US to not keep its word.

Ofcom proposes Wi-Fi and cellphones share upper 6GHz band

"On 6GHz, the issue at the moment is that everyone wants a slice of it, and it doesn't matter what China does if everyone else decides to use 6GHz for something else. "

My guess: US will make allocations completely contrary to the Chinese - it will save the effort of explicitly banning the Chinese kit.

Make sure that off-the-shelf AI model is legit – it could be a poisoned dependency

In order to be really newsworthy they'd have to have created a clean LLM.

Microsoft's Azure West Europe region blew away in freak summer storm

So the fiber went fubar.

Starlink satellites leak astronomy-disturbing EM radiation, say boffins

If they haven't done so already no doubt spooks round the world are now looking to see if any useful data is leaking out.

Musk sues law firm for overcharging Twitter when Twitter was suing Musk

Re: Elon Musk is suing the lawyers who were representing Twitter when it sued him

"he can perhaps sue the lawyers who agreed to represent him to sue the previous lawyers."

And then sue the lawyers who take on that case.

One thing about the US legal system - there are so many lawyers it'll take him a long time to get round the whole lot so that he has them all suing each other for him and has to start another round.

Re: When is This Guy Going to Get Britney Speared?

But life would be so dull - for the rest of us.

Re: I'm convinced

"If nothing else, it might make his future lawyer's fees even higher."

He has a plan to deal with that.

Re: Earned Their Pay

"rather than having what they dug up during discovery become public record"

I'm sure they'll enter that into their defence.

And how is he paying the lawyers who are suing the lawyers for him? Upfront?

Oracle pours fuel all over Red Hat source code drama

"We leave it as an exercise for the reader to puzzle out the rationale for Oracle's failed $10 billion lawsuit against Google over Android's use of copyrighted Java APIs."

Probably something along the lines of "my enemy's enemy is my friend".

Red Hat's open source rot took root when IBM walked in

"If you're running a mission critical workload without some sort of support, you're an idiot. If you're smart enough not to need support, then you're a Debian guy and you don't need Red Hat."

These are the extremes. There's also a variety of other situations such as you have a mission critical workload for which RHEL is worth the money but some ancillary uses such as testing and training which production environment compatibility is needed, a clones is fine but RHEL prices can't be justified or it's used in production but the profit margins won't support buying RHEL. The first of these alternatives is one where the RHEL customer is going to review the market and the second one where they will never sell anything anyway unless they drastically cut prices.

But the licence also says additional restrictions should not be added and may be removed. Those contractual shenanigans look awfully like an implied additional restriction.

Re: Well said

From a personal point of view it probably makes sense. IBM may have dispensed with their services by next year.

Red Hat has contributed a great deal over the years. That's why seeing it following what looks like the IBM path of circling the drain so unfortunate.

There's a school of thought that the whole SCO affair was an attempt to get IBM to buy them and IBM didn't want to play.

"They built their product upon the work of many thousands of others, which they did not have to pay for."

To be fair they did provide some of that work themselves. Some of it good, some of it involved pottering about.

But all under GPL which they're now trying to side-step.

Re: Don't underestimate the ability....

"never underestimate their ability to disorganize you"

Nice one --->

Re: not paying Red Hat for RHEL, but getting the majority of the value of RHEL for free.

And the contributions, like all others, will be under GPL2.

Re: Great liberators ??

"shirt term share value"

A typo I'm sure but you've coined a handy new expression - short term value means losing your shirt in the long term.

Re: Well said

"Nobody ever got fired for buying IBM"

I think those days disappeared a long time ago.

Re: Great liberators ??

"Don't get it."

Read the first post in this thread and EricM's reply. Remember that EricM is just one of a large number of RHEL users who took a similar approach. Then try again to get it.

Man who nearly killed physical media returns with $60,000 vinyl turntable

Get a whole lot of them so you can link them in series back to the generator. It's the only way to be sure a noisy, distorting oxygen atom can't creep into the supply.

Saw the headline, not in the least surprised on finding out who the company was.

Sarah Silverman, novelists sue OpenAI for scraping their books to train ChatGPT

"Only takes minutes if the info is already included in the LLM."

Also only takes a few minutes if it just makes stuff up hallucinates it if it doesn't have it already.

It sounds like this is information that should have been assembled and kept up to date anyway. The value of the LLM would appear to be compelling whoever it might be to do what they should be doing anyway.

"Can they show that they've suffered pecuniary damage from the alleged copying? If so, it can't be very much."

It will take an author quite a long time to write a book. If, after scraping a lot of novels, an LLM can knock one out in minutes then they stand to lose future income.

This is also true of me, not only in regard of this particular group of people but also of others who are supposed to be famous. I don't, of course, count this ignorance as having missed anything of significance to me.

BT CEO Jansen confirms he's quitting within 12 months

"Jansen is also the architect of planned upheaval at BT, much of which will happen after he's gone"

Upheavals cutting various numbers of staff have been BAU at BT for decades, e.g. a decision that they didn't nee to run a mobile phone system. Surely this couldn't have anything to do with the fact that customer numbers keep falling, could it?

Turning a computer off, then on again, never goes wrong. Right?

Re: Service != Server

"There was some further whining "

I think at that point I might have implemented your "or" branch without further ado.

Re: Sausage Factory

With all chambers loaded.

Re: PC Engineers...

Remember it's a server which will be running some application serving multiple users. There'd probably be a lot of data in un-flushed buffers. It will have left user data in an inconsistent state. The OS itself would likely boot up but not the application service on top of it.

Nobody does DR tests to survive lightning striking twice

Re: I've heard of more than one case

Summer grade diesel still in the tanks in the winter. It contains wax that solidifies in the cold.

I suffered that one, not in a data centre but a signal failure on a miserable wintery evening's commute.

Let's have a chat about Java licensing, says unsolicited Oracle email

Re: We "WERE" getting compliance emails from oracle wanting to talk about license changes

My response was that the users in my company that are using adobe creative suite

"who are still using" might have been a bit more pointed.

Re: Audit? We don't want no audit.

"EULAs aren't worth the pixels they're displayed on"

For consumer products, terms that purport to waive statutory rights can have no force in any jurisdiction that protects cunsumer rights. For commercial products you might find courts consider the customers to be big boys who can change their own nappies now.

Re: Obviously, I would know my compliance position

And how could he know anything about licencing compliance when the Oracle inspector had yet to decide on what grounds it wasn't compliant?

"He probably wouldn't mind companies asking Palisade for assistance before responding to that mail from Oracle."

I think he might have been encouraging companies to phone Oracle and then they'd be more likely to ask Palisade for assistance.

BOFH: Lies, damned lies, and standards

Re: Association of Servicepeople for Software and Hardware Over the Lifetime of Equipment.

"At my first job after Uni at what was then the Inland Revenue there was an idea to have specialist teams to deal with Appeals, Reviews, and the Self Employed. It actually happened but they did alter the order of the categories."

Reviews, Appeals & The Self-employed?

Now that you've all tried it ... ChatGPT web traffic falls 10%

Re: It will pick up soon enough

"Using the model opens them to the risk that they actually see the kind of stuff that we, who have either used it for our own curiosity ... have already seen, which indicate that accuracy from a model like this is just a game of chance"

Very likely people like ourselves will have tried it on areas where they already have considerable knowledge and are able to recognise when it spouts garbage. People using it to find out things they don't know will just accept the output because it's the internet innit. (They'll also accept the complete bollocks that it was trained on, of course, because it's the internet innit.)

Two new Linux desktops – one with deep roots – come to Debian

Re: Debian?? Really??

".I know there are IBM and RedHat haters out there.."

I think you're missing the point. The objections are that what's happening are, in the long term, damaging to Red Hat, Fedora and Linux as a whole - although Bob has a point in that RH has promoted some awful stuff.

Re: Beautiful? Really?

Not used KDE lately Bob? Running KDE here & it looks pretty much the same as it's done for years.