Posts by Doctor Syntax

Halfords suffers a puncture in the customer details department

Re: Halfords IT Always a bit odd

It may have passed through several hands but if management teams aren't replaced from time to time you'll get the nth generation of managers who kept promoting underlings in their own image.

If you didn't store valuable data, ransomware would become impotent

Let's settle for something easier. How about a standardised name and address entry form? For those who really can't - or can't be arsed - to type it in themselves they could have a matching text file and copy and paste it.

Yes, I'd put myself in the second category.

It would need some thought: no assumption that everyone lives in a "city", not assumption that all street addresses have a number and no assumption that postal codes are numeric.

Re: A pattern emerges...

Do you not already hold your name and address in your own head? Can you not enter them into an online order form as required?

Don't over-think this.

Re: So instead of...

There's a lot of data a business needs to survive. It's their data and possibly they may be a little more motivated to look after it. Maybe they won't but if they suffer a breach it's just their problem.

If it's customer data it's a lot of other peoples' problem. The significant difference there is trust: the customer's trust the business and the business fails to live up to that trust despite all the protestations about that after the event.

As to decentralising data, the general thrust of the article seems to be that it's the customer who looks after their own data. Let's say I want to order something online on this basis. What needs to happen in data handling:

1. I select what I want to buy, I go to the checkout page. I enter my name and delivery address. That's in my own memory where it's not open to a ransomware attack.

2. I enter my bank account details which I copy from my hard copy bank card. This may well be verified by the bank's own pop-up app. The bank already holds my details, that's inevitable. I hope that my bank is a lot more secure than the average retailer. It's not 100% but ultimately it's the bank's problem if they're not, they're regulated more effectively than the retailer. That last statement is worth reflecting on.

3. The bank confirms the purchase to the retailer.

4. The transaction is confirmed back to me on screen, possibly offering a PDF to download and I can take a note of that. No email is needed. I am, however, holding my copy of that, possibly on my computer although I could make a written note or print the PDF.

5. The retailer prints a picking/despatch note and a shipping label.

6. At this point the company doesn't really need to keep personal information online any longer and can delete it. A summary of the transaction without these details can stay on their system.

7. When I receive the goods I can retain the packing note and delete any reference to it on my computer or retain it at my own risk - I'm not placing anyone else at risk.

Before anyone gets het up about needing to keep this in case of delivery problems, warranty claims etc. they have this on the picking note with the personal data on it; once delivery is confirmed they can dispose of that. If I have a complaint down the line it's up to me to produce my copy of the despatch note or the electronic copy of the order acknowledgement if I chose to keep that.

The retailer's holding of my PII is limited to the time needed to print out the paperwork. My holding is at my choice. The long term holding of information by the retailer is more or less what they'd have held if I'd walked into a shop and paid cash for the item, a business model which has worked for a few thousand years.

If data is to be sold valuing it shouldn't present any problem at all. It's based on what customers* are prepared to pay for it. Ironically the data that's hard to value is that held by businesses who are more ethical and don't sell it on.

* That's the data customers, not the customers who are mere data subjects

Europol arrests nine suspected of stealing 'several million' euros via phishing

Your mate's bank wasn't unique in this. I've had a similar missive, not pointing to a login but to a page for further information.

"These messages included a phishing link that led to fake banking websites, which were used to harvest credentials."

Let's not forget the banks' culpability in this. They train their customers to be phished by sending emails, mostly marketing emails, with links in them. Two things should be made compulsory for banks:

1. No email sent to a customer should contain a link except for a few well-defined circumstances such as a password reset and certainly not without some previous interaction that ensures the customer is expecting it.*

2. Hammer home to the customers that any email purporting to be from the bank is fake, should be reported and the link should on no account be followed.

It probably wouldn't even be necessary for legislation to compel this. A regulatory requirement might be sufficient although legislation to make it a criminal offence to sign off sending such emails would be a good way to ensure the first requirement was obeyed.

* Ideally this should be eliminated by doing it off-net in a branch. Yes, real bank branches.

Bipolar transistors made from organic materials for the first time

Re: Gatekeeping @My-Handle

A few hundred quid would buy you a reasonable quality used microscope that could be used to project your mask image onto a die. But at best it would only get you down to micron resolution and at that resolution it would only cover a small area so for any reasonable sized die you'd need to do it in sections. With all that glass, of course, you'd have to forego UV sensitive materials and just stick to what can be activated in the visible spectrum.

The first step to a really wearable computer.

Leading Arch Linux derivative Manjaro puts out version 21.3

"The user guide compares the relationship between Manjaro and Arch as being similar to that between Ubuntu and Debian."

Apart from the fact that Debian is far from being a rolling release distro and, from this account, far better put together than Manjaro.

RISC OS: 35-year-old original Arm operating system is alive and well

The Master may have been a souped up Beeb. The one I had briefly on my desk wasn't; as per my post above it wasn't Acorn, it was by Torch - a 68k box running a Unix.

A little prodding has revived memories. Associated with Acorn was Torsh. I think it must have been this: http://www.computinghistory.org.uk/det/11268/Torch-Computers-300-Series-Workstation/

Dick Pountain's review describes the Master as a soaped up Beeb and it certainly wasn't that. Maybe it was something else - it was along time ago so my recollection is a bit shaky. It cersinly wouldn't have been something very expensive because buying expensive things for what was a speculative diversion didn't happen.

"In June 1987, Acorn launched the Archimedes A305 and A310"

What was the one that came out before that? Sort of pizza-box type machine. It must have been about 85 because I left the lab that had it in mid-86.

Re: Some features i would like today

As I recall they already had / as the escape character for end of line. It seemed to me that when those vast hard drives were added to PCs they tried to do a pivot from the rather DEC-like command-line syntax of CP/M and early MS-DOS to something more Unix-like to accommodate subdirectories and ended up being neither.

This startup says it can glue all your networks together in the cloud

Stitch all your networks together? ISTR someone had the same idea a good long while ago. It was called Arpanet. I wonder what happened to it.

Investors start betting against Bitcoin with short-trade products

Re: Investors or gamblers?

You are gambling.

If you buy a share of Dobby then you are investing because if Dobby wins you not only have your share of the prize money but Dobby has gained in value, not just as a more likely prospective winner of more prize money but also as a prospective parent of more race horses. And if Dobby loses Dobby is till Dobby.

It's a speculative investment with a greater than average value of failure but it's an investment because your money's going into something that might generate extra money in income (the prize money) or value (the stud fees).

Cash is accepted - by fiat if you like - as a medium of exchange in the economy. Its intrinsic value is that of the economy of the country that issues it (or countries in the case of the Euro). It may vary with the fortunes of the economy. If the economy tanks its value tanks. Its value in terms of pints of beer vs loaves of bread vs days' work might vary with the relative values of those items within the economy. There's no evading the effects of the real world but at least it is based on the real world. That's why Bitcoin and the rest are valued in dollars and not the other way around.

I can't imagine the company lasting very long before its work is finished.

AWS buys before it tries with quantum networking center

Re: Not entanglement

Then the man in the middle intercepts both photons and replaces them with his own entangled pair. Undetectable.

Re: "photons can't be amplified, so their range is limited"

Quite. They can't be amplified but they can't be attenuated either. They can be lost but, if you're dealing with specific photons, they can't be replaced.

Toyota wants 'closed loop' EV batteries in its future cars

"a move that researchers involved said could cut the cost of solar installations by half."

I was wondering why adding something to a solar installation could cut the cost by half - unless it came with free money. The quoted article says it cuts the cost of solar storage installations by half. As it's using second-hand components that's not surprising.

Info on 1.5m people stolen from US bank in cyberattack

Re: Identity theft protection services

The examples which have been mentioned in the past are the usual data slurpers such as credit reference agencies. Did they ask for your inside leg measurement?

"We keep hearing this canned response too. Maybe their staff are just not up to it."

And somehow we never hear them explain why they didn't live up to it. Personally I'd like the media to get together and refuse to report such statements unless they're prepared to answer questions on those lines.

Metaverse progress update: Some VR headset prototypes nowhere near shipping

Re: Prototypes

particularly with smal large softwarel firms

FTFY

Re: Meta != Metaverse

"If there was something compelling to actually do with it"

One person's "compelling" is another's "meh!". They need a produce that gets the ratio right.

"bet you'll fall over yourselves"

Very likely. That tends to happen when you go round paying attention to something other than where you're putting your feet.

Voicemail phishing emails steal Microsoft credentials

Re: I'm getting too old for this shit...

Hence treating it with utmost suspicion.

So using Teams as a full telephony solution is a phishing risk. I think the workaround is pretty obvious.

Re: But voicemail doesn't work like this

"an email with the incoming call as an mp3 attachment"

That's the difference. You get an attachment that can be played. This scam uses an attachment that requires you to log in. There's a simple rule to apply here:

Any unsolicited email which included a URL should be treated as phishing.

Corollary: if you don't want your emails to be so treated, don't include URLs.

Re: I'm getting too old for this shit...

I think the point is that if someone wants to end me a voicemail message the attachment should be a .wav or similar that I can play without logging in to anything (or, more likely, treat with utmost suspicion, report as phishing if it comes in to my hotmail address, and ignore).

Re: I'm getting too old for this shit...

Forget the drug-fogged bit. Thinking it's cool is all that's needed.

UK's Post Office shells out for SAP software it thought it had

Re: Nice business you've got there squire...

And yet companies keep falling for it.

Re: Nice business you've got there squire...

It's a shared culture.

End of the road for biz living off free G Suite legacy edition

Re: "In the thousands"

"Dad, I lost my password!" "I'll reset it for you" "You'll have to set up a new account. This time use a password manager."

That is a frightful idea. If you don't use unique email addresses half your log in credentials are essentially public.

Re: That's just the software

Relay on somebody else's computer for storage?

No.

Way.

Indeed I have a NextcCloud server. Email? I don't host that myself. I use Mythic Beasts. It's not free - although very reasonable. It's one of the very few things I'm prepared to pay subscription for.

"Free services simply can't be counted on, as demonstrated by Google's discontinuation of unlimited cloud storage for Google Workspace for Education customers, which takes effect in July."

Oh yes they can. Just download LibreOffice or one of the other FOSS alternatives

OK, not strictly speaking a service but that's for the better. As Google have illustrated numerous times, a service can be turned off; an unencumbered executable, running on your own hardware, can't.

CISA and friends raise alarm on critical flaws in industrial equipment, infrastructure

Ideally, yes. However the controllers may well have been designed before anyone started thinking about such things. For the last decade or more, however, the default assumption should have been that such equipment was inherently vulnerable and should be isolated.

Re: Hmm

That, or it's a subtle push to move our SQL servers (or maybe ALL of our servers) out to "the cloud".

Certainly not to the cloud. Put the servers for the plant onto the plant's network, separated from the office network. The tricky bit comes when you need to push reports back from the plant to the office.

NASA's SOFIA aircraft preps for final flights ahead of mission end

Re: Fun fact

I wonder whet the 2nd hand value is for a 747 with a big hole cut in it.

US lawsuit alleges tool used by hospitals shares patient data with Meta

"UK health company EMIS bought by US insurance giant"

Parhaps such transactions should require the informed and specific consent of the data subjects.

Know the difference between a bin and /bin unless you want a new doorstop

"using his deleted items to store emails"

That's the second instance so far in this thread. Combine that with everyone who stores their emails in the inbox and it's not hard to conclude that email clients do not do a good job with handling read email.

Re: My tale of woe...

I think I'd have just upgraded a few of them, then invited the district head to decide whether they were useless. If he stuck with his opinion I'd have pointed out that the upgrades so far had come out of my own pocket & the materials were therefore still my own property and I'd reclaim them.

mv can be quite interesting. It might be OK if you can catch it before mv, cp or cat have been moved but I didn't.

Re: Fail

Thumb up for having a separate /home but how on Earth did any instructions lead you to delete libc6?

Didn't you try copying back it from the USB device?

EV battery can reach full charge in 'less than 10 minutes'

Re: Full charge in 10 minutes?

Those destination chargers - that's a very substantial infrastructure that you've got to persuade everyone to build. I've seen one small hotel that had one charger but due to the awkward layout of the premises you'd need to be almost first in/last out to use it. Another, again with one charger. When I rolled up that happened to be the only parking space free so I ended up blocking it. Token charging points aren't going to cut it and 25 charger equipped places in a typical motorway service station will be tokenism. You're going to have to have a situation where nearly every parking space has a charging point so that those in desperate need of a charge can be assured of one being free.

The ultra-rapid filling station model might be the most practical.

Re: Full charge in 10 minutes?

Because of planning policies local mass employment (mills) is extinct. Commuting is likely to be several tens of miles each way. And good luck getting most workplaces to install an adequate number of chargers and then getting staff to be responsible about sharing them.

Inverse Finance stung for $1.2 million via flash loan attack

The "earnings" from the attack have gone down by an order of magnitude in a couple of months. Maybe that's a pointer.