Posts by Doctor Syntax

GNOME alone: FOSS desktop folk to start counting in whole numbers again

Re: "especially from an engagement and marketing perspective"

"the desktop has become a more iterative experience, a continuously developing thing which isn't necessarily bound by maintaining backwards compatibility."

Too true. Some of us like backwards compatibility in things like continuing to be usable, not chucking out functionality, not slurping data to a mother ship somewhere and not suddenly starting to show advertising. We also like backwards compatibility for the under-pinnings, the libraries which applications rely on to display on the desktop.

Re: "especially from an engagement and marketing perspective"

"the entire premise of the article is that sub numbers get confusing"

And that's the problem. They aren't. A major release should indicate a change sufficient as to not be backwards compatible and minor numbers should reflect minor changes. We've lived with 3-part numbers - 3.8.2 and the like - for a long time. We've come to understand what the increments are likely to mean.

It's throwing all that away that is confusing. Will a change from 137 to 138 be equivalent to 4.11.2 to 4.11.3 or 4.11.2 to 5.0 in old money? Will it signal a change of underlying GTK version?

I think Jake's put his finger on it - marketing's in charge.

Adidas now stands for All Day I'm Disconnecting All Servers as owners of 'smart' Libra scales furious over bricked kit

"The problem with most IoT products isn't necessarily that they rely on back-end servers to run. It's that, for the most part, it's impossible to perceive the trajectory of a given company."

It's possible to make a reasonable estimate:

Does the operation of the server rely on continuing subscriptions?

If so then if the subscription operation is profitable it's likely to continue.

If not does it rely on the user as product?

If so then is that profitable? There are relatively few businesses that have succeeded. Even the past master at that model, Google, has a habit of discontinuing services. If it isn't profitable expect it to be shut down.

If it doesn't rely on a subscription or on user as product does it have some other income model?

If so, examine it carefully for credibility.

If not does it rely on burning through investors' money to run it?

If so expect it to be shut down once that's all burned.

If not it's dependent on sales of devices to keep it going. Once those fall off expect it to be shut down.

Before you buy that managed Netgear switch, be aware you may need to create a cloud account to use its full UI

Re: So.o.o.o.o.o.o 2014..............

"Why would ANYONE (never mind an enterprise customer) put up with network management via a third party cloud?"

Non-technical management. And as Cloud is the new shiny they may possibly believe this is a Good Thing. Maybe Netgear aren't as stupid as we think.

If it's a corporate purchase no PII would be needed.

If it's a new purchase was that term mentioned in the original specification? If so, buy somewhere else or if you've already bought learn to read specs more closely. If not it gets bundled straight back as not meeting specification.

If it's something that appears in a S/W upgrade to existing kit then read the licence terms very carefully and vote with your feet for future purposes, making sure your salesdroid knows that's what will happen.

She was praised by the CEO and promoted. After her brother and mom died, she returned from compassionate leave. IBM laid her off

Re: BTDT.

"employer had decided at the last minute to *phone in* rather than show in person as required by the judge"

One judge I remember would probably have sent an officer of the court, accompanied by sufficient police as would have been needed, to bring him in to face a charge of contempt of court.

Contractor convicted of pinching supercomputer cycles to mine cryptocurrency

Re: Economics 101

You don't think it possible that they asked CSIRO?

'I don’t want to see another computer for the rest of my life'... Brit Dark Overlord cyber-extortionist thrown in an American clink for five years

Re: Five years - Not Enough

It seems light until you read that that's what the prosecution asked for. Maybe he's been co-operative in putting the finger on the rest of them.

Have no idea WTF is going on with the Oracle-Walmart TikTok deal? Don’t sweat it, here’s our latest rundown

What checks and balances exist on executive orders? What limits?

Re: Muppetry

How dare you insult Muppets like that!

Have you? AFAICS the only thing thing that mattered was what they weren't doing - telling Trump who rained on his parade.

UK Ministry of Justice dangles £20m, seeks paper-free payroll services – this time for the judiciary

Such a system would hold PII about court staff in general as well a judges. This should be rate as particularly sensitive as at any one time there will be a number of toe-rags who'd quite like to pressure someone in that position. I hope this will be taken into account when awarding the contract but suspect not.

UK govt urged to bolt tough legal protections onto Arm and protect jobs – or simply veto Nvidia's £31bn acquisition

Re: Why sell Arm anyway ?

"Who benefits from this ?"

Softbank who need some readies after so many of their investments didn't wework out terribly well for them.

UK Parliament's human rights committee pushes for better protections of coronavirus contact-tracing data in law

I'm not sure any additional legislation would be needed. Just make sure that information is only used for the purposes for which it was collected, kept securely and for no longer than necessary for the original purpose.

All it needs is somebody in charge who understands this and has the ability and determination to ensure that it's adhered to.

MP promises to grill UK.gov over revelations that Uber handed '2,000 pieces' of user data to London cops a year

Re: Aw, Man!

David Davies was fine apart from the Brexit aberration.

We're not getting back with Galileo, UK govt tells The Reg, as question marks sprout above its BS*

Re: Hard Brexit

AIUI membership requires membership of the EU. As members of the EU at the time the UK pushed for it.

We don't need maintenance this often, surely? Pull it. Oh dear, the system's down

"rarely had anyone on the staff who could read it"

OTOH it could be quite handy for the vendor if the customer had someone available to debug the code. After having had two Friday lunchtimes interrupted when the weekly billing run exploded I spent an afternoon drilling down and found, buried several loops deep, a statement asking the server to allocate an object which wasn't released so the server process grew until it reached its maximum memory allocation. Followed by a phone call - not the last - to the vendor to tell them how to write software for that particular RDBMS.

Re: An ex employer did that too.

Had a similar experience at a client where two directors had one of their stand-up rows in the main office in front of their staff and several of us freelancers* about which way the application should make up production batches. This wasn't resolved.

A colleague wrote a work of art solution where every possible parameter affecting batching was held in the database with a big data-entry form so the operators could set it up in whatever way they were told. We set up some reasonable looking values before it went live and as far as I know they were never changed.

* Obviously their frequent toys out of the pram events were one of the facets of face-to-face communication, team integration & what-not that you miss when everyone's working from home.

Your anti-phishing test emails may be too easy to spot. NIST has a training tool for that

Re: Do as I say, not as I do

A UK bank or building society by any chance? All emails I get from such bodies raise those flags.

Phish Scale

Top marks for whoever thought of that one. It finished the job off nicely but as the A/C points out the offer of a PDF looks a bit like a phish tail.

This is how demon.co.uk ends, not with a bang but a blunder: Randomer swipes decommissioning domain

Nildram, swallowed by Pipex (who decided to roll out Nildram support to their existing customer base because it was better than their own), swallowed by someone I can't remember (who rolled out their own appalling support because that's the sort of thing they did) swallowed by TalkTalk (who were TalkTalk)

not with a bang but a cock-up

That's the way technology usually ends.

Oracle Zooms past rivals to run TikTok’s cloud, take stake alongside WalMart and ByteDance investors

This move places the whole of TikTok outside of China into the grasp of the CLOUD Act so it must fall foul of GDPR in the EU as the Privacy Figleaf has shrivelled to the extent that it can't even pretend to protect users' data.

Online fraud prevention biz fails to prevent CEO's alleged offline fraud

It looks like they're the all-time winners of the "Getting rid of the difficult bit in the title" award.

Woman dies after hospital is unable to treat her during crippling ransomware infection, cops launch probe

Re: It's money, as usual

The in the medical area make it a regulatory requirement.

Re: "Unix windowing goes back at least to 1984 with X."

"a large number of Linux UI applications are written in Java"

ROFLMAO

Re: ASCII art??

"updates are released to a schedule and can be easily installed"

My experience with Windows is that updates are a complete and utter pain to install. They're slow to download hang up the entire machine for as long as they want, they fail, they reboot the machine. Linux upgrades download and install quickly unless you're doing a complete OS version upgrade. They only need a reboot - at your convenience - if they're kernel upgrades (and there are ways of patching running kernels) although if a service is upgraded it will need a restart. In my experience upgrades of services ask before restarting.

It's worth remembering that most people who run other OSes have also suffered Windows and are in a position to make comparisons. If you only run Windows you don't know any better.

"How do you get electronic images out of a borked system?"

You start by looking at how to avoid getting the system from which the images come from being borked. Start off by considering the system to be standalone. If it isn't terribly useful what is the minimum set of remote access facilities needed to make it useful? You want somebody to view the images remotely? Just sticking it on the hospital LAN is not minimal. Minimal might be a connection running through a firewall that only allows X-11 protocol. Even if you run the X server* on a Windows PC that gets borked X-11 is not going to be the sort of protocol to tell the CT system to go bork itself.

It's like the old saying puts it - if you don't design a system to be secure it's hard to add on security afterwards.

* The server is the bit that supplies display services, the one with a screen attached, not the one that provides the images.

Re: Why?

"You can't apply security patches until they have been tested and certified by the manufacturer..."

And there needs to be an obligation on the manufacturer to do it promptly.

A certification process which results in the equipment becoming unsafe is not fit for purpose.

Re: Citrix VPN

And suddenly, all the "Shouldn't be using Windows, it's their own fault" types are looking a bit foolish.

Citrix VPN might have been the entry point. It was Windows systems that got encrypted. Who's looking a bit foolish?

Re: It's money, as usual

Hospitals in Germany mostly belong to large chains that are profit driven. If they can shave a Euro from the budget by buying cheaper mice, they will.

But if a security-measure costs money to implement and isn't obviously required by law, they'll just skip it "because we've been good so far, right?".

I assume they have insurance. The insurers should look at what they're on the hook for with badly protected systems and make sure protecting the systems is cheaper than paying the premium. If people will only do things right if it costs them less up-front then make it more expensive up-front to not do things right.

Re: Analogous to “Because I saw you tie your shoe laces, I ran over that kid”.

"Medical equipment is also certified, which means it can't get OS patches until they have been certified by the equipment manufacturer, which can take an age."

Let's deal with that one straight away. No commitment to prompt certification of OS patches, no certification for your potentially lucrative piece of medical kit. And all source code must be documented and escrowed - perhaps along with a dowry to enable someone to take it over if you decide to duck out.

"if the diversion is an hour away emergency patients should be seen and paperwork can be sorted out down the line."

Wouldn't it be great if there was a technology that would let you scan in paper-work, transmit it over an ordinary telephone line and print it out at the other end. Might not have helped in this case but as a fall-back it would be worth having.

Re: ASCII art??

A good Linux can make people regret they're still running Windows.

Re: Analogous to “Because I saw you tie your shoe laces, I ran over that kid”.

At a guess it's people like this, working in hospital IT or hospitcal IT procurement, that mandated Windows over earlier, better options and brought this situation about.

Re: Analogous to “Because I saw you tie your shoe laces, I ran over that kid”.

Unix windowing goes back at least to 1984 with X. The X protocol reached the current version, 11, in 1987. I'm not sure W95 was eve a gleam in Bill Gates eye in 1987. It was also possible view X with a dedicated X-terminal although I'm not sure if anyone still makes those. I'd hazard a guess that all early development of CT systems was done on Unix graphics.

If you really think Linux and other Unix and Unix-like systems are restricted to characters you really need to get out more.

I've done work for a company where production, handling lots of PII was kept well separate from the office system and its vulnerabilities. It was, in fact, a condition of some of their contracts. It might be inconvenient in some ways but it would have been a lot more inconvenient to admit to their clients that they'd been breached or to have production stopped for days because some toe-rag had encrypted their systems.

Re: Why?

The germ of the solution is in your cutting machine story. The owners were able to force an admittedly not very satisfactory solution. For medical equipment there , in principle, an easier way to do this and do it better. A couple of decades or more back it wasn't unusual for servers to have remote support via dial in lines which could be unplugged when not required. Medical equipment has to be certified. A certification requirement of remote support via a disconnectable channel would cut out one weakness. The politics of getting such a requirement in place, however ....

USA still hasn’t figured out details of WeChat ban but promises users won't be punished

From the US Gov PoV it's worse because they can't demand access to that data.

Elecrow CrowPi2: Neat way to get your boffins-to-be hooked on Linux from an early age and tinkering in no time

Re: "The kiddiwonks won't even know they're learning"

"grow up as one of those people cleaning their hands every two seconds with harsh chemicals"

Not a bad thing nowadays.

Thunderbird implements PGP crypto feature requested 21 years ago

Re: Thunderbird only?

"Possibly one reason that email signing and encryption never really took off, despite being more or less standard product since the '90s."

Two reasons, I think.

One was because it wasn't part of the email protocol so it had to be a lot of added on bits, not just to the clients but a whole added on separate key distribution system.

The second was that because of one very few people used it. If you didn't know anybody who used it you didn't need to go to all that trouble to add it yourself and you not using it meant that people emailing you didn't need to use it and because they didn't you didn't either. Critical mass hasn't been achieved.

Re: Encryption should be automatic

"A man-in-the-middle just need to intercept the email, remove the senders public key and put theirs in and sent the email to the destination."

Or just spoof the email address. How many people actually check the source of the email?

Re: identity and encryption

"Ultimately to prove identity is to meet each other face to face and exchange public keys, then sign them. At a key signing party. Unfortunately that is a barrier but that is the ONLY way to confirm beyond a doubt that it is YOU behind that address and if you do key signing correctly, behind ANY address and ANY key you sign."

Who's YOU? Even face to face you have to take somebody's word for who they say they are. If somebody tells you they're [e-mail] how are you to know that that's who they really are? A better way would be to have example.com's mail server tell you that [e-mail]'s public key is. You still don't know whether [e-mail] is Fred Bloggs, Fred Flinstone, Frederick the Great or my late uncle Fred of course.

Re: Encryption should be automatic

"Thunderbird should sent a public key with every email in the meta data."

How many public keys can HMRC and IRS have?

He was a skater boy. We said, 'see you later, boy' – and the VAX machine mysteriously began to work as intended

Re: The need for speed

An occasional client had offices on Banbury and Swindon both running SCO on tower servers.

On-site work was on Saturday mornings when the business wasn't running. I drove down to Banbury and he picked up the Swindon server and brought it to Banbury. No faffing about with tapes.

In relation to another of today's stories, he used fax to take orders. Online support was by means of him disconnection the fax and plugging a modem into his fax line and me dialling that on a Nokia Communicator.

Re: Wheeled office chairs

Maybe that happened if it wasn't bribed suitably rewarded.

Re: Wheeled office chairs

Really shouldn't let BOFH train the guide dogs.

Oracle hosting TikTok US data. '25,000' moderators hired. Code reviews. Trump getting his cut... It's the season finale

Re: Key fact missing

"Can't go after them, so go after the platform, and make an example of it."

Or go after the platform as a means of going after them.

Re: Why????

"It is difficult to get a man to understand something, when his salary depends upon his not understanding it!"

GCHQ agency 'strongly urges' Brit universities, colleges to protect themselves after spike in ransomware infections

"This trove of information puts a target on the back of every good-sized school, college, or university."

Just an idea but how about putting that trove on its own isolated network? Yes, inconvenient when somebody has to answer a query that came in by email. But look on it as a choice of that inconvenience vs the inconvenience of an attack on that trove and at best having to rebuild it from backups and at worst seeing it copied off and sold to the highest bidder - or all bidders.