Posts by Doctor Syntax

Radio gaga: Techies fear EU directive to stop RF device tinkering will do more harm than good

Re: Nonsense

"But the same lot regulated the power of a hoover so it now takes twice as long with a Euro hoover."

Current vacuum cleaner was bought because SWMBO found the previous one was so loud it made her feel ill. I chose the one with the lowest specified noise level. It meets the EU spec, not surprising being a European brand. It's also the most effective vacuum cleaner we've ever owned in half a century of home-making. It might be because the energy is going into cleaning, not making noise.

Re: Gonna ask what may be a stoopid question here...

"CE-marked"

China Export?

Re: Gonna ask what may be a stoopid question here...

"wiping out DAB signals"

So no harm done.

"More likely, people will just repurpose old computers to be routers and WiFi access points instead of buying commercial gear."

Forget repurposing the computer to be an access point. What about just using it as a computer if it is WiFi capable? Isn't this enough to push it into scope of the directive?

Re: What's the problem....

"avoid the low-level consumer s**t"

Why should it be acceptable to sell consumers shit products?

Re: What's the problem....

"I can't see the EU successfully mandating that every member must have a test lab that follows centrally-defined standards, nor would they have a hope of insisting that everything EU-wide had to be tested by, say, TUV or BSI."

It doesn't need to but it could mandate testing to an approved standard by an accredited lab. The accredited lab doesn't need to be in the member state where the device is made or sold, just that it meets the requirements for accreditation. Neither does the standard need to be specifically BSI, TUV, UL or anything else, just that it be appropriate for the device.

On the eve of Patch Tuesday, Microsoft confirms Windows 10 can automatically remove borked updates

How does a machine that's failed to start up start up to remove the update that made it fail to start up?

2 weeks till Brexit and Defra, at the very least, looks set to be caught with its IT pants down

The PAC needs teeth. How about them signing off each Department's top few tiers' annual reports?

Hyperscalers spunked modest sum of $120bn on bit barns, pipes and plumbing last year

Coming soon: the sector levels out to the amazement of all these pundits who believed it was expanding exponentially just like PCs, mobiles and every other product was, right up to the time it became clear that they weren't.

Small Brit firms beg for 'light touch' as only half are ready for digital tax reforms due next month

"It hardly inspires confidence when you are signing up for a BETA."

All HMG websites are beta. I think someone there is under the impression it means ready for production use.

Re: Error control in Making Tax Difficult ???

There's another failure of logic.

"HMRC have underestimated the admin burden and costs to businesses for MTD"

It's the essence of any estimation that the estimator believes it to be the best estimate possible. If it weren't they'd correct it. It represents the entire relevant knowledge of the estimator. If that knowledge is wrong the estimator has no means of knowing that. So if they have underestimated they will have no means of knowing that. Therefore the estimator is the last person on Earth competent to decide whether or not they have underestimated. The Dunning-Kruger effect may well prevent them discovering any error.

Uber driver drove sleeping woman miles away from home to 'up the fare'. Now he's facing years in the clink for kidnapping, fraud

Re: Are you kidding?

"Uber have some of the lowest ethical standards to be found in the corporate world."

And it's a competitive world out there.

Iranian-backed hackers ransacked Citrix, swiped 6TB+ of emails, docs, secrets, claims cyber-biz

"with other vendors unable to justify the significant levels of investment to produce competing products"

If other vendors face being pushed out of the market it didn't ought ot be too difficult to justify the investment. Oh, silly me. We'll still be OK for a few more quarters without it and who looks further ahead than that?

"it's"

Aaaargh!

Re: Ah...those naughty Iranians...how dare they!

"Of course they have to have intelligence agencies to defend themselves against tyrannies like Hitler's Germany or Stalin's Russia."

Your clock appears to be several decades slow.

Re: Sensitive Data

"r/woosh?"

Apparently not.

"I disagree - Huawei are a major threat."

This wasn't a Chinese company, it was a US one.

The US needs to get it's own house in order before it starts on others. Crude attempts to deflect attention elsewhere don't cut it.

Re: And, not likely to change...

"unless and until there are significant penalties for such laxity"

There are but they only come into play after the event.

There's need for pro-active inspection. Let's say a scoring system for the types of PII held and a need for audit-requiring certification where the total score over all the data subjects exceeds some minimum. If a business doesn't want to get into certification and the consequent regulation then it can dial down what PII it holds.

Yes, I can imagine the complaints about the cost of regulation but the fact is that far too many have failed to put procedures in place without regulation. It's a requirement that businesses have brought on themselves. I've written here many times that experience is a dear teacher but there are those that will learn by no other. If it was simply the likes of Sony and Citrix having their internal documents raided it wouldn't matter but when it's the likes of Equifax and Verification.io spilling millions of customer or 3rd party details it's too late for such businesses to learn by experience.

High-jacking the Box: Enterprise storage tool's customers leave secrets on web like sitting ducks – including Box itself

I wonder how many of these cloud accounts are set up by end users to bypass IT who want to make a big inconvenient fuss about how they do things. Or maybe even use then to do away with an IT department altogether. Is it surprising they end up like this?

Racist self-driving car scare debunked, inside AI black boxes, Google helps folks go with the TensorFlow...

"We're just emerging from winter here in the UK"

Or just entering into it!

"To be fair, it's also harder for a human driver to see a dark skinned pedestrian at night. I'm trying not to be racist here, but I don't see any way around that."

Exactly. Adding the capability for passive IR would be an advantage for autonomous vehicles over a human driver.

Lidar will presumably have about the same difficulty seeing black skin as it does seeing black clothing at night or, indeed white skin hidden behind a turned up dark collar or a dark hoodie*. Perhaps IR should be added.

I've had the experience, driving on a dark, wet night of seeing an apparently disembodied pair of white trainers crossing the road in front of me.

TalkTalk returns to the email hall of shame as Pipex accounts throw weekend-long wobbly

Re: Venn Diagram Please

Something like that. I was on Nildram which Pipex bought although we retained the old Nildram addresses. Support went downhill after the Pipex buy-out by Tiscali and was just too awful to cope with the next downward plunge so it was bye-bye Nildram a decade ago for me.

Freelance devs: Oh, you wanted the app to be secure? The job spec didn't mention that

It's not so much getting what you paid for, it's more a case of if you don't pay some reasonable minimum you get even less than you paid for. I'm not sure is that was what they sere setting out to demonstrate, that they genuinely didn't know what a sensible rate should have been or they simply didn't have a budget to offer sensible rates. If it was an add-on to a project testing students then the last might well have been the case.

Re: You get what you ask for

"Any experience developer knows that exceeding requirements isn't really as good an idea as it seems."

They should also know that taking on a job without adequate requirements also isn't a good idea.

Re: Requirements

"OK, so the study proves the blindingly obvious - if you haven't written down good requirements then you're not necessarily going to get back what you really wanted."

OTOH if you're providing a professional freelance service and you're given a clearly deficient spec then you should raise the issue with the client.

It's true someone who hires in a specialist may be doing so simply because they haven't the capacity to take on the extra work-load. But you can't be sure of that. They may be hiring a specialist because they don't know what they need. Yes, we all know that in that case they should start by hiring someone who can advise them but they don't know that either. It's up to whoever they took on to tell them that the spec isn't appropriate to the job and if the client insists on it being done badly don't take it on.

"Developers on a system like this don't have to, and shouldn't, be developing a cryptographic algorithm at the level of the actual arithmetic."

I doubt they were expected to. OTOH they should have known that they should be using an existing one and should have done so.

ICO, forgive me – it has been three weeks since I discovered my breach

What's missing from this is any account of the action taken by ICO to fine those who have delayed. They have now been given substantial powers. We need to see them used. Unless offenders see that there are very real penalties for delaying they will continue to delay and hope that the delay can become permanent.

UK peers suggest one big 'Digital Authority' to watch the tech watchers, tighten up regulation

"The chart lists MSN Messenger for Microsoft's Messaging. This is very recent."

It seems to have been copied out of a 2018 paper extracted from a 2017 paper by someone else. There seems to have been considerable shrinkage from the 2017 paper both in categories (28) and content (Microsoft Team [sic] in this particular case).

It's difficult to decide what the table is supposed to show. Where, for instance are Streetview.co.uk OpenStreetMap, Firefox and derivatives, Opera in just a couple of categories? It seems to be a handy list of a few things for people who don't want to look far (AKA people who want to get locked in)

Re: Unintended Consequences?

"But one driver for tech innovation is the prospect of being bought out by one of the Usual Suspects."

And quite possibly to kill it. That also dampens innovation.

"It would also develop a pool of technical expertise for regulators to draw on – a common lament in the sector is that the regulators don't have the tech know-how, which is both costly and prevents them from being effective."

Regulators won't have the tech know-how if they don't recruit it and it will cost them salaries if they do. The proposed body will also lack tech know-how unless they recruit it which will cost them salaries if they do. Not much difference there. I'm not saying the new authority isn't a good idea but this one comes down to spending money and it doesn't matter which body's doing the spending providing you're willing to spend it.

I get the notion that a single body of expertise being switched back and forth as required is probably more efficient than keeping several teams of under employed experts on the payroll at each regulator but if shouldn't require the ICO to recruit a DBA to tell them what an RDBMS is; if that's really a problem it's not a matter of not enough staff, it's a matter of the wrong staff.

An even more flexible approach to having sufficient staff is to take on freelancers (on non-IR35 terms of course) as needed. It goes against all Civil Service budgeting, of course, the notion that we have to make an unanticipated spend this year that we didn't make last years but if tried HMG might learn something about how flexible staffing works and why HMRC doesn't understand it.

Sure, we've got a problem but we don't really want to spend any money on the tech guy you're sending to fix it

Re: Reverse Penny-Pinching

"having sussed the weekend fare worked out better than Mon - Fri "

This is an asymmetry you have to watch out for. I had a few weeks freelance gig in NI. It was cheaper to take a single out the first day, get a weekend return for each weekend and then a single back rather than a weekly return. Freelance you can make these decisions instead of being stuck with some company rules.

Re: Reverse Penny-Pinching

"I shared it with ... one Mr N Edmonds of Crinkly Bottom."

Serves you right for being a cheapskate.

Re: Odd version of "cost cutting"

"Second, it was good practice from an environmental point of view (and depending upon the company, this may have been the primary reason)."

If environmental considerations were paramount the job would either have been done remotely or subcontracted to someone local.

Re: Travelling to client sites

"I never figured this out from people who do sales presentations to my workplace. You can literally say what you like in a face-to-face sales meeting, even without the IT guy present, and everybody will believe it."

Let them do the presentation. But it needs to be followed up by a written statement. If it isn't in the written statement it doesn't exist. And be careful that that also applies to stuff they shouldn't do (Microsoft privacy statement - so long, so reasonable looking until you realise that while it might be reasonable for them to keep records of your transactions with them it doesn't actually say they limit their records of transactions to just those).

Have had this happen with a finance software that claimed to pull all the customer info from our original system."

I had a salesman at a business I worked for promise that "our" product would be a drop-in replacement for their existing system. It was a major reason for my quitting. The product was to be based on work done for another customer and I'd spent some time looking at the new customer's system. Although it did the same job the data was structured very differently. No way could it be made to look anything like. There was going to be a long haul in getting separating ithe spaghetti out into discrete modules (any user in the existing customer could see and amend any record irrespective of whether it was part of their job or not). I didn't fancy managing customer expectations to be part of my job as developer.

Re: Travelling to client sites

All because the customer has this "if you want to deal with us, you must have this meeting face-face" rule.

Obligatory Dilberts: https://dilbert.com/strip/1996-06-05 and the one after it.

Re: Bah!

"So then. Why don't we say I rode the train up and drove back and you can send the train fare for the ticket that got lost with an easy mind?"

Alternative version: "Why don't you assume I'm still there and you can pay for another ticket for me to get back?"

"was assigned a task to push a button to test an ISDN backup"

What would happen if the test failed? I'd guess part of the expectation was that you'd be on site to fix the problem/take the flack if it did. What would have been the consequence if it had failed and the trip to fix it only started then?

Liz Warren: I'll smash up Amazon, Google, and Facebook – if you elect me to the White House

There is a non-political means of breaking them up.

I'm just waiting for an activist investor to move in. Why do they keep badgering the small stuff when there are targets of that size.

Thought you'd seen everything there is to Ultima Thule? Check this out: IN STEREO!

Re: Not doing that again...

It's the top pair on the linked page which is indeed a relaxed eye version which I find straightforward. The cross eyed version I find just plain weird.

Tech security at Equifax was so diabolical, senators want to pass US laws making its incompetence illegal

Re: We don't need more regulation

"It is applicable as information about Brits is involved."

Article 32 says ‘Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk’.

Rightly or wrongly the sort of management thinking illustrated here is likely to look at the mention of costs and decide they've got a let out.

In any case, I'd have thought US citizens required something better than 2nd hand protection. A business that carries data of this sensitivity and volume should in any case be subject to more active regulation than GDPR which is passive and part self-regulatory. GDPR depends on either an aggrieved individual making a complaint or the organisation itself reporting issues to the regulator. An active regulation would be a requirement for a license and annual audits of which the security aspect would include ensuring systems were patched and maybe some penetration testing. Without that there's a likelihood that management will adopt a wait and see approach and try to trade the cost of being caught against the probability of being caught.

With a license and audit approach things change from fines as a cost of doing business to doing the job right as a cost of staying in business. It's a difference that can focus the managerial mind amazingly well.

Re: GDPR down the throat

"More likely that they don't get enough revenue from EU people to make it worth the potential risk of a fine, even if they believe they are doing everything right."

Well, as the article shows, the light's even starting to dawn on your Federal government and some states are ahead of the curve. Such sites need to start thinking about how much revenue they're prepared to cut off as more and more governments wake up to the fact that abusing privacy and lax security aren't desirable.

There's also a network effect. It depends on the sort of site but even if it's not the sort that has user participation the site that allows traffic from the EU is likely to get talked about in other forums than one that doesn't. Positive feedback will then draw more and more traffic away from the refusenik until it gets regarded as a backwater.

Buffer overflow flaw in British Airways in-flight entertainment systems will affect other airlines, but why try it in the air?

"We are already aware of this issue"

Translation: Yes, we've read that too.

Nah, National Cyber Security Centre doesn't need its own minister, UK.gov tells Parliament

"These reports were something that the previous Conservative-Liberal Democrat coalition government led by David Cameron was happy to do."

It probably took months of tedious committee work to get rid of them although Sir Humphrey was helped by having a fully brain-washed Home Sec in Number 10.

I'm sure they'll tell you they are the top.

"it will actively try to remain a part of the EU's Networks and Information Systems Co-operation Group"

"Actively" sounds good. "Try" gives the game away.

Dear Britain's mast-fearing Nimbys: Do you want your phone to work or not?

Do they even have a wired kilostream link up there?

Re: Stop making sense!

"Yeah, I stopped short of that one for fear of causing more panic."

A lot of the NIMBYism in built-up areas is along the lines of "think of the children", especially when there's a school nearby. Those are the children they're buying phones for in deepest ignorance of the inverse square law and the fact that the phone adapts its power output to the distance from the base station. I suppose the problem is getting past the panic to the point where an explanation is listened to.

"But why would you? A wind farm is hardly likely to have a lot of people in it."

It's not so much the people in it. These days it seems to be getting difficult to find a spot in rural England without line of sight to a wind turbine.

"There are also plenty of upland areas where people only ever traverse a few fairly narrow paths, there being next to no reason to go tramping about on trackless upland moorland."

However, if you cover the paths and the moorland roads you'd find it difficult not to cover most, if not all, the surrounding moorland. The moorland is likely easier to cover than some odd corners of the adjacent valleys.