Posts by Doctor Syntax

2 weeks till Brexit and Defra, at the very least, looks set to be caught with its IT pants down

The PAC needs teeth. How about them signing off each Department's top few tiers' annual reports?

Hyperscalers spunked modest sum of $120bn on bit barns, pipes and plumbing last year

Coming soon: the sector levels out to the amazement of all these pundits who believed it was expanding exponentially just like PCs, mobiles and every other product was, right up to the time it became clear that they weren't.

Small Brit firms beg for 'light touch' as only half are ready for digital tax reforms due next month

"It hardly inspires confidence when you are signing up for a BETA."

All HMG websites are beta. I think someone there is under the impression it means ready for production use.

Re: Error control in Making Tax Difficult ???

There's another failure of logic.

"HMRC have underestimated the admin burden and costs to businesses for MTD"

It's the essence of any estimation that the estimator believes it to be the best estimate possible. If it weren't they'd correct it. It represents the entire relevant knowledge of the estimator. If that knowledge is wrong the estimator has no means of knowing that. So if they have underestimated they will have no means of knowing that. Therefore the estimator is the last person on Earth competent to decide whether or not they have underestimated. The Dunning-Kruger effect may well prevent them discovering any error.

Uber driver drove sleeping woman miles away from home to 'up the fare'. Now he's facing years in the clink for kidnapping, fraud

Re: Are you kidding?

"Uber have some of the lowest ethical standards to be found in the corporate world."

And it's a competitive world out there.

Iranian-backed hackers ransacked Citrix, swiped 6TB+ of emails, docs, secrets, claims cyber-biz

"with other vendors unable to justify the significant levels of investment to produce competing products"

If other vendors face being pushed out of the market it didn't ought ot be too difficult to justify the investment. Oh, silly me. We'll still be OK for a few more quarters without it and who looks further ahead than that?

"it's"

Aaaargh!

Re: Ah...those naughty Iranians...how dare they!

"Of course they have to have intelligence agencies to defend themselves against tyrannies like Hitler's Germany or Stalin's Russia."

Your clock appears to be several decades slow.

Re: Sensitive Data

"r/woosh?"

Apparently not.

"I disagree - Huawei are a major threat."

This wasn't a Chinese company, it was a US one.

The US needs to get it's own house in order before it starts on others. Crude attempts to deflect attention elsewhere don't cut it.

Re: And, not likely to change...

"unless and until there are significant penalties for such laxity"

There are but they only come into play after the event.

There's need for pro-active inspection. Let's say a scoring system for the types of PII held and a need for audit-requiring certification where the total score over all the data subjects exceeds some minimum. If a business doesn't want to get into certification and the consequent regulation then it can dial down what PII it holds.

Yes, I can imagine the complaints about the cost of regulation but the fact is that far too many have failed to put procedures in place without regulation. It's a requirement that businesses have brought on themselves. I've written here many times that experience is a dear teacher but there are those that will learn by no other. If it was simply the likes of Sony and Citrix having their internal documents raided it wouldn't matter but when it's the likes of Equifax and Verification.io spilling millions of customer or 3rd party details it's too late for such businesses to learn by experience.

High-jacking the Box: Enterprise storage tool's customers leave secrets on web like sitting ducks – including Box itself

I wonder how many of these cloud accounts are set up by end users to bypass IT who want to make a big inconvenient fuss about how they do things. Or maybe even use then to do away with an IT department altogether. Is it surprising they end up like this?

Racist self-driving car scare debunked, inside AI black boxes, Google helps folks go with the TensorFlow...

"We're just emerging from winter here in the UK"

Or just entering into it!

"To be fair, it's also harder for a human driver to see a dark skinned pedestrian at night. I'm trying not to be racist here, but I don't see any way around that."

Exactly. Adding the capability for passive IR would be an advantage for autonomous vehicles over a human driver.

Lidar will presumably have about the same difficulty seeing black skin as it does seeing black clothing at night or, indeed white skin hidden behind a turned up dark collar or a dark hoodie*. Perhaps IR should be added.

I've had the experience, driving on a dark, wet night of seeing an apparently disembodied pair of white trainers crossing the road in front of me.

TalkTalk returns to the email hall of shame as Pipex accounts throw weekend-long wobbly

Re: Venn Diagram Please

Something like that. I was on Nildram which Pipex bought although we retained the old Nildram addresses. Support went downhill after the Pipex buy-out by Tiscali and was just too awful to cope with the next downward plunge so it was bye-bye Nildram a decade ago for me.

Freelance devs: Oh, you wanted the app to be secure? The job spec didn't mention that

It's not so much getting what you paid for, it's more a case of if you don't pay some reasonable minimum you get even less than you paid for. I'm not sure is that was what they sere setting out to demonstrate, that they genuinely didn't know what a sensible rate should have been or they simply didn't have a budget to offer sensible rates. If it was an add-on to a project testing students then the last might well have been the case.

Re: You get what you ask for

"Any experience developer knows that exceeding requirements isn't really as good an idea as it seems."

They should also know that taking on a job without adequate requirements also isn't a good idea.

Re: Requirements

"OK, so the study proves the blindingly obvious - if you haven't written down good requirements then you're not necessarily going to get back what you really wanted."

OTOH if you're providing a professional freelance service and you're given a clearly deficient spec then you should raise the issue with the client.

It's true someone who hires in a specialist may be doing so simply because they haven't the capacity to take on the extra work-load. But you can't be sure of that. They may be hiring a specialist because they don't know what they need. Yes, we all know that in that case they should start by hiring someone who can advise them but they don't know that either. It's up to whoever they took on to tell them that the spec isn't appropriate to the job and if the client insists on it being done badly don't take it on.

"Developers on a system like this don't have to, and shouldn't, be developing a cryptographic algorithm at the level of the actual arithmetic."

I doubt they were expected to. OTOH they should have known that they should be using an existing one and should have done so.

ICO, forgive me – it has been three weeks since I discovered my breach

What's missing from this is any account of the action taken by ICO to fine those who have delayed. They have now been given substantial powers. We need to see them used. Unless offenders see that there are very real penalties for delaying they will continue to delay and hope that the delay can become permanent.

UK peers suggest one big 'Digital Authority' to watch the tech watchers, tighten up regulation

"The chart lists MSN Messenger for Microsoft's Messaging. This is very recent."

It seems to have been copied out of a 2018 paper extracted from a 2017 paper by someone else. There seems to have been considerable shrinkage from the 2017 paper both in categories (28) and content (Microsoft Team [sic] in this particular case).

It's difficult to decide what the table is supposed to show. Where, for instance are Streetview.co.uk OpenStreetMap, Firefox and derivatives, Opera in just a couple of categories? It seems to be a handy list of a few things for people who don't want to look far (AKA people who want to get locked in)

Re: Unintended Consequences?

"But one driver for tech innovation is the prospect of being bought out by one of the Usual Suspects."

And quite possibly to kill it. That also dampens innovation.

"It would also develop a pool of technical expertise for regulators to draw on – a common lament in the sector is that the regulators don't have the tech know-how, which is both costly and prevents them from being effective."

Regulators won't have the tech know-how if they don't recruit it and it will cost them salaries if they do. The proposed body will also lack tech know-how unless they recruit it which will cost them salaries if they do. Not much difference there. I'm not saying the new authority isn't a good idea but this one comes down to spending money and it doesn't matter which body's doing the spending providing you're willing to spend it.

I get the notion that a single body of expertise being switched back and forth as required is probably more efficient than keeping several teams of under employed experts on the payroll at each regulator but if shouldn't require the ICO to recruit a DBA to tell them what an RDBMS is; if that's really a problem it's not a matter of not enough staff, it's a matter of the wrong staff.

An even more flexible approach to having sufficient staff is to take on freelancers (on non-IR35 terms of course) as needed. It goes against all Civil Service budgeting, of course, the notion that we have to make an unanticipated spend this year that we didn't make last years but if tried HMG might learn something about how flexible staffing works and why HMRC doesn't understand it.

Sure, we've got a problem but we don't really want to spend any money on the tech guy you're sending to fix it

Re: Reverse Penny-Pinching

"having sussed the weekend fare worked out better than Mon - Fri "

This is an asymmetry you have to watch out for. I had a few weeks freelance gig in NI. It was cheaper to take a single out the first day, get a weekend return for each weekend and then a single back rather than a weekly return. Freelance you can make these decisions instead of being stuck with some company rules.

Re: Reverse Penny-Pinching

"I shared it with ... one Mr N Edmonds of Crinkly Bottom."

Serves you right for being a cheapskate.

Re: Odd version of "cost cutting"

"Second, it was good practice from an environmental point of view (and depending upon the company, this may have been the primary reason)."

If environmental considerations were paramount the job would either have been done remotely or subcontracted to someone local.

Re: Travelling to client sites

"I never figured this out from people who do sales presentations to my workplace. You can literally say what you like in a face-to-face sales meeting, even without the IT guy present, and everybody will believe it."

Let them do the presentation. But it needs to be followed up by a written statement. If it isn't in the written statement it doesn't exist. And be careful that that also applies to stuff they shouldn't do (Microsoft privacy statement - so long, so reasonable looking until you realise that while it might be reasonable for them to keep records of your transactions with them it doesn't actually say they limit their records of transactions to just those).

Have had this happen with a finance software that claimed to pull all the customer info from our original system."

I had a salesman at a business I worked for promise that "our" product would be a drop-in replacement for their existing system. It was a major reason for my quitting. The product was to be based on work done for another customer and I'd spent some time looking at the new customer's system. Although it did the same job the data was structured very differently. No way could it be made to look anything like. There was going to be a long haul in getting separating ithe spaghetti out into discrete modules (any user in the existing customer could see and amend any record irrespective of whether it was part of their job or not). I didn't fancy managing customer expectations to be part of my job as developer.

Re: Travelling to client sites

All because the customer has this "if you want to deal with us, you must have this meeting face-face" rule.

Obligatory Dilberts: https://dilbert.com/strip/1996-06-05 and the one after it.

Re: Bah!

"So then. Why don't we say I rode the train up and drove back and you can send the train fare for the ticket that got lost with an easy mind?"

Alternative version: "Why don't you assume I'm still there and you can pay for another ticket for me to get back?"

"was assigned a task to push a button to test an ISDN backup"

What would happen if the test failed? I'd guess part of the expectation was that you'd be on site to fix the problem/take the flack if it did. What would have been the consequence if it had failed and the trip to fix it only started then?

Re: Travel Policy

I think all this is the revenge of staff who are office bound but think it's a great privilege to be allowed to travel on business.

It doesn't help that the only thing that makes administrative work like that possible is treating every little thing as disconnected from everything else. If they didn't they'd realise how repetitively boring it is. It's necessary to have people like that to do that sort of work but it does inhibit the capacity for joined up thinking and ask themselves what the best overall arrangement would be.

Re: Here's my contribution...

Just a thought, but ShadowSystems is blind and might not be using the same form of input as you and I and also won't be able to see what the results look like.

Re: Nokia

"will eventually drop in the Atlantic"

The Atlantic pushes stuff away. It might eventually fall into the Pacific but well after what's west of the San Andreas does. The Yellowstone supervolcano'll probably get it first.

"what idiot invented Farenheit?"

Daniel of that ilk.

Liz Warren: I'll smash up Amazon, Google, and Facebook – if you elect me to the White House

There is a non-political means of breaking them up.

I'm just waiting for an activist investor to move in. Why do they keep badgering the small stuff when there are targets of that size.

Thought you'd seen everything there is to Ultima Thule? Check this out: IN STEREO!

Re: Not doing that again...

It's the top pair on the linked page which is indeed a relaxed eye version which I find straightforward. The cross eyed version I find just plain weird.

Tech security at Equifax was so diabolical, senators want to pass US laws making its incompetence illegal

Re: We don't need more regulation

"It is applicable as information about Brits is involved."

Article 32 says ‘Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk’.

Rightly or wrongly the sort of management thinking illustrated here is likely to look at the mention of costs and decide they've got a let out.

In any case, I'd have thought US citizens required something better than 2nd hand protection. A business that carries data of this sensitivity and volume should in any case be subject to more active regulation than GDPR which is passive and part self-regulatory. GDPR depends on either an aggrieved individual making a complaint or the organisation itself reporting issues to the regulator. An active regulation would be a requirement for a license and annual audits of which the security aspect would include ensuring systems were patched and maybe some penetration testing. Without that there's a likelihood that management will adopt a wait and see approach and try to trade the cost of being caught against the probability of being caught.

With a license and audit approach things change from fines as a cost of doing business to doing the job right as a cost of staying in business. It's a difference that can focus the managerial mind amazingly well.

Re: GDPR down the throat

"More likely that they don't get enough revenue from EU people to make it worth the potential risk of a fine, even if they believe they are doing everything right."

Well, as the article shows, the light's even starting to dawn on your Federal government and some states are ahead of the curve. Such sites need to start thinking about how much revenue they're prepared to cut off as more and more governments wake up to the fact that abusing privacy and lax security aren't desirable.

There's also a network effect. It depends on the sort of site but even if it's not the sort that has user participation the site that allows traffic from the EU is likely to get talked about in other forums than one that doesn't. Positive feedback will then draw more and more traffic away from the refusenik until it gets regarded as a backwater.

Buffer overflow flaw in British Airways in-flight entertainment systems will affect other airlines, but why try it in the air?

"We are already aware of this issue"

Translation: Yes, we've read that too.

Nah, National Cyber Security Centre doesn't need its own minister, UK.gov tells Parliament

"These reports were something that the previous Conservative-Liberal Democrat coalition government led by David Cameron was happy to do."

It probably took months of tedious committee work to get rid of them although Sir Humphrey was helped by having a fully brain-washed Home Sec in Number 10.

I'm sure they'll tell you they are the top.

"it will actively try to remain a part of the EU's Networks and Information Systems Co-operation Group"

"Actively" sounds good. "Try" gives the game away.

Dear Britain's mast-fearing Nimbys: Do you want your phone to work or not?

Do they even have a wired kilostream link up there?

Re: Stop making sense!

"Yeah, I stopped short of that one for fear of causing more panic."

A lot of the NIMBYism in built-up areas is along the lines of "think of the children", especially when there's a school nearby. Those are the children they're buying phones for in deepest ignorance of the inverse square law and the fact that the phone adapts its power output to the distance from the base station. I suppose the problem is getting past the panic to the point where an explanation is listened to.

"But why would you? A wind farm is hardly likely to have a lot of people in it."

It's not so much the people in it. These days it seems to be getting difficult to find a spot in rural England without line of sight to a wind turbine.

"There are also plenty of upland areas where people only ever traverse a few fairly narrow paths, there being next to no reason to go tramping about on trackless upland moorland."

However, if you cover the paths and the moorland roads you'd find it difficult not to cover most, if not all, the surrounding moorland. The moorland is likely easier to cover than some odd corners of the adjacent valleys.

"I note that we pretend that everybody wants phone coverage everywhere. Personally I'd be quite content to see a lot less of it"

Do I understand you correctly? Personally you'd be content with less coverage so it's a pretence that anyone wants more.

I'm not entirely sure the logic is completely sound.

Re: Maybe a solution

"If monuments to the wind god are taller and we already know they are effectively useless this could be a great way to save face."

The main one that .. er... graces my sky-line certainly seems to be inoperative a good proportion of the time including, I understand, a long period when its original owners had gone bust. The nearest phone mast, however, is located lower down on the hillside and is unobtrusive.

I'm not sure what the blades are made of. It they're metal or even metal-reinforced, I'd expect them to play havoc with the signal. Otherwise there's certainly the basis for a good rural network of structures.

"If it's about the square antenna not having line of sight to Holme Moss then they might be using Fresnel lensing to bend the beam over whatever's obstructing it."

The Holme Moss mast has a number of visible microwave dishes lower down but they're all below the horizon from where that phone mast is located. There's line of sight to the VHF antenna. The other end of that microwave link must be above that. Rather him than me climbing up the middle of an antenna broadcasting about a MW ERP to install that!