Posts by Doctor Syntax

Bill Gates lays out a three-point plan to rid the world of COVID-19 – and anti-vaxxer cranks aren't gonna like it

Remind me again, what's the risk you'll get smallpox?

DuckDuckGo cries fowl after being expunged from Google's Android search preferences menu for most of Europe

Never heard of PrivacyWall so let's give it a try..

Hmm. It overlays the home page with an advert for its Firefox addon. With NoScript blocking the site the ad won't remove itself. Admittedly the ad only seems to be on the home page but it's not a good first impression for something with its particular claims.

Atari threatens to hit fourth VCS shipping deadline, provides pictures of boxes as proof of product delivery

Photo as proof. Like a well-known courier offering a picture of a parcel on a doorstep as proof that they'd delivered something to me. Only snag - sufficient detail to show it wasn't my doorstep but insufficient to show whose doorstep it was. Odd coincidence - in the middle of reading these comments I had to go and receive an equally heavy parcel from the same vendor, despatched yesterday but delivered by a different courier.

British Army develops AI shotgun drone with machine vision for indoor use

Re: Doors

No problem. Plenty of wide entrances to the average sub-volcanic lair.

Re: ReCoilLess

"The British Army is there to defend from external threats and not some Covidiots that fail to social distance when a little tipsy."

There's at least one Covidiot closer to Boris than that but he's more likely to be the one with his finger on the trigger.

With so many cloud services dependent on it, Azure Active Directory has become a single point of failure for Microsoft

Re: But meanwhile On Premises

In house IT: How large does the business that directly pays their wages look to your in-house staff?

Cloud IT. How large does your business which indirectly pays an undiscernibly small part of their wages look to Microsoft (or any other vendor) staff?

Re: "we will never be able to avoid outages entirely"

"I don't have to look embarassed and explain to a supplier that I've not received their email if they were unable to send it in the first place!"

You're relying on the supplier and yourself having the same, unreliable email provider and further, on the supplier having just one email provider without having any fallback. Even as a private individual I have my own domain email but also an ancient Hotmail address. The Contact page on a website that comes back to me is duplicated on gmail and outlook addresses.

Prepare your shocked faces: Crypto-coin exchange boss laundered millions of bucks for online auction crooks

"Who buys expensive stuff like cars from online auction sites when they know they have no comeback if the deal goes south?"

And is prepared to hand over the cash before even kicking the tyres?

EU's decision on UK data adequacy set to become 'political football' in broader Brexit negotiations

Re: Foregone conclusion?

Current DPA is GDPR plus a little wriggle room for HMG. I dare say they'll get away with it if they don't try to enlarge it. However as they've already shown with the Internal Market Bill, they're not to be trusted to do anything in good faith.

Square Kilometre Array signs off on construction plans – UK last holdout before building phase begins

I wonder about the smaller array in SA. If the objective was long baseline interferometry I'd have thought the two arrays would have been more or less the same size.

NHS COVID-19 app's first weekend: With fundamental testing flaw ironed out, bugs remaining are relatively trivial

Re: Elephants and rooms etc.

What you're missing is that after the initial fiasco a smartphone app suddenly ceased to be absolutely essential and was demoted to being a bit of additional aid to the absolutely essential manual test and trace system.

Re: Protect the NHS

"Help the aged - once we were just like you!"

And, if you're lucky*, one day you'll be just like us.

* And sensible, although that may also be down to luck.

Re: Call me Mr Cynical but...

How?

Remember that this is a system which, for security reasons, does not present any user data relating to the app to central servers.

Re: Call me Mr Cynical but...

one has to wonder how thorough the testing requirements analysis was.

Re: Police told not to download Covid app

I think they're anticipating a load of false positives what could easily leave the entire force self-isolating.

Amazon bean-counter, her husband, father-in-law cough up $2.6m after SEC collars them on insider-trading rap

"When do everyday-Americans going to get it: Insider trading is not for the faint hearted."

I'm sure everyday-Americans do it and get away with it. They just need to be a lot better at it than this.

"agreed to pay back the dosh"

To whom? They made an unfair profit and, therefore, somebody lost it's not going to be obvious who exactly lost out. Those who offered the shares for sale would have sold them to someone else irrespective of whether the buyer had inside information or not. My guess is that the dosh gets paid back to the US govt despite the fact they never lost it. I suppose it helps to make up for the taxes they didn't collect from Trump.

Too many staff have privileged work accounts for no good reason, reckon IT bods

Do your admin privileges allow you to edit the logs? If so it's not a nice compromise.

You have a marketing department that doesn't have access (probably inducing access they really shouldn't have) to names and addresses of customers and a lot of other contacts?

Explain to someone sufficiently senior to be on the hook when the shit hits the fan that they are on said hook and that it's their problem, not yours.

"I suggested that that server be disconnected from the work network"

Better still - it should never have been connected in the first place.

One client has a completely separate network for production data which included a lot of PII, some of it quite sensitive, which was being processed for their clients. In fact it was a condition of the contracts for the services they provided. Yes it was a little inconvenient to have to go - escorted - to the server room to find out what the problem was on incoming data* but it was just the way things had to be done and quite right too. (The same client also had pen-testing to see if staff could be inveigled into spilling data over the phone. They couldn't.)

* Thanks to the tame software house used by one of The Usual Suspects who rotated freshly qualified but untrained developers in on a 6 monthly cycle to make the same mistakes the last lot made.

"only after which process was whatever process granted"

And who then actioned that? What actual obstacles existed to prevent them granting such access to themselves at any time? If there are none then they have potential access which, as Lee points out, is no different from actual access.

Re: The sub-header: ever seen a Trello board...

"At a previous organisation Trello was rolled out by means of an unexpected mass-emailing from an external organisation inviting one to follow a URL and log in at an external website with one's company credentials."

How not to do that - and anything else.

Re: Opportunity Cost of lockouts

I think you're describing a situation where people who should be on a project team aren't. Lax security isn't a solution to non-security problems.

Re: Employ people you trust, trust people you employ

And many more before and since.

Re: Jumping through hoops for access

"There should be three levels of access:

1) no access

2) permanent access

3) "on-demand" access"

Access to what? Your three levels only tackle a small fraction of the job.

This reminded me of a time when I had to do a security review of a business. One of the points I raised was the excessive time taken to scan documents into the document server. They weren't available when needed.

Re: .. all the access they ask for ..

" The amount of time this person spends explaining, repeatedly and in depth, to people why they can't have all the access they ask for and why such access would be a really, really bad idea is astonishing"

Write it out once and give them a copy instead of spending time explaining.

"We could give ourselves access, but we don't."

These are the sort of trusted people to employ.

Why not spread the attack surface as wide as you can? It's only your livelihood at risk.

Re: Employ people you trust, trust people you employ

And the person who you trust clicks a booby-trapped email and their excessive access lets the destruction spread.

Then you start to wonder whether open access was a good idea. Experience is a dear teacher. Do you really want to learn lessons like that the expensive way?

Windows to become emulation layer atop Linux kernel, predicts Eric Raymond

Re: Sadly... this is the beginning of the end

"I think you'll find that there is a lot of 4.3BSD in SunOS5.0 (AKA Solaris), by way of SysVR4."

It's a long time back to stretch my memory but surely System V, like System III was AT&T. I suppose there was a System IV in between but I never used that.

AFAICR the original AIX was by Interactive who also did the V7 port to Z8000, Onix, wich was the first Unix I used - and that showed in the AIX I encountered later.

Re: Sadly... this is the beginning of the end

"To all the posters saying there are plenty of distros that don't use systemd -- how many of them are ones that you'd be happy to give to your non-techy parents or your great-aunt Lucy?"

Ignoring the implied ageism - I may well be older than your parents, I did provide a couple of cousins with Zorin but that was a long time ago.

But let's qualify this: statement:

"most people who learn to use Windows once can - for the most part - go anywhere else, sit down at a computer, and do their thing"

Which Windows? The Windows UI has changed a good deal over the years. How many complaints have there been here over just that thing. And not only the OS, the applications as well - remember all the complaints over the introduction of the ribbon? In fact if you sat down in front of my laptop you might wonder for a moment which variation of Windows it was running. W95 and KDE both seem to have started by adopting a good deal of the Unix CDE interface and IBM's CUI so there are quite strong resemblances between them. and other Unix/Linux window managers. In consequence the differences between any given Windows version and many* Linux UIs is not really greater than that between different versions of Windows.

* There is a good deal of flexibility but generally KDE based implementations usually default to having the main menu pop up from the bottom left with the panel (task bar) etc on the bottom. I'm not sure what the most common Gnome layout is these days but most distros using it used to put that sort of stuff at the top of the screen. But hey, if you want your task bar down the right hand side that's possible.

Re: Sadly... this is the beginning of the end

As I replied to Jake, I use Devuan. However, it was about 11 months between the release of the upstream, Debian Buster and Devuan Beowulf as stable. Of the two which is going to be used fro application development?

Re: Sadly... this is the beginning of the end

Yes, Jake. I know about Slackware. Personally I use Devuan. But these are not the mainstream distros. It's more likely that anyone developing mainstream applications will be using Ubuntu or one of its derivatives - it seems to be getting quite common to see .debs offered for Ubuntu but not Debian.

If ESR's dystopian future should arrive would there be any non-MS devs working on Linux, other than those working for H/W vendors? I'd expect them to either fork it at some point or move over to a BSD.

Re: ROTFL!

"most open source software is pretty limited, ugly, and not user-friendly"

So you've still not tried it for yourself.

Re: Am I the only one?

all kernel code will currently be looked at carefully by non-microsoft employees.

FTFY

Re: Sadly... this is the beginning of the end

It's getting hard to find a distro that doesn't use systemd. In consequence it will be increasingly common to find applications assuming that one of other of its tentacles is available for use.

Brexit travel permits designed to avoid 7,000-lorry jams come January depend on software that won't be finished till April

Re: More queues?

Ah bless. There's somebody here who still thinks BoJo & the other clowns are doing a good job.

Re: No one seems to be talking about other ports.

There'll be customs checks/no customs checks (it's a quantum thing) at Liverpool and Cairnryan for travel to that other part of the UK in NI. That means that the A75 will also become a lorry park.

Re: There is always Monaco

Perhaps this could be kept up until there aren't any Brexiteers left in Britain.

Re: More queues?

"and the rule of law"

Does this still allow breaking international law under certain limited and specific circumstances?

Exercise-tracking app Strava to give away data sweated out after four billion runs, rides and rambles

Re: Toll Bike Lanes

I suppose they'd be like bus-lanes - great idea if only the buses would stay in them.

Help! My printer won't print no matter how much I shout at it!

Re: Out of tree error

To proof read double-spaced single-side is how I'd want to see it. But I would expect her to it printed out.

You need it double spaced because comments and corrections go into the inter-line spaces as well as the margins.

Also, personally, I find it easier to manage a stack like that single-sided, putting each page to the back once it's been read. Perhaps that goes back to the old days of typewriters and cut & paste actually meaning cut & paste (well, cut & staple) which only works if it's single sided.

Not Particularly Mortifying: IEEE eggheads probe npm registry, say JavaScript libs not as insecure as feared

Re: Phew! We're safe then!

Add AppImage.

Re: Phew! We're safe then!

"static linking and fat packages"

Maybe it's worth while to start looking a bit more sympathetically at those. The trade-offs between the financial costs of on-disk storage and memory use vs security might have changed in the last few years.

Error-bnb: Techies scramble to fix Airbnb website bug that let strangers read each others' account messages

Re: Ahh! The classic cookie clearing fix to the rescue...

Never trust the server either.

Alphabet promises to no longer bung tens of millions of dollars to alleged sex pest execs who quit mid-probe

The foreseeable consequence: someone leaves under investigation, is cleared, sues and takes them for a bundle.

Second foreseeable consequence: investigations pressured to come up with the "right" answer whatever the facts.

Third foreseeable consequence: someone leaves under investigation, investigation comes up with the "right" facts, leaver sues, proves that the "right" facts weren't right and takes them for the biggest bundle yet.

IT guy whose job was to stop ex-staff running amok on the network is jailed for running amok on the network

So actually fired for not addressing MBA failings in less emotive language?