Posts by Doctor Syntax

Metal maker meltdown: Nucor stops production after cyber-intrusion

Why does process control at site A need to be linked to site B?

What are the execs doing with access to process control?

Why, apart from somebody's convenience, would furnace and/or rolling mills be accessible to anything an external attacker would be able to hit?

GAO finds billions in possible government savings, all without Elon's help

"duplicative IT systems"

Just make sure they're not the hot standbys for critical systems.

Snowflake CISO on the power of 'shared destiny' and 'yes and'

"Security Teams can never be the team of no."

They should for one very simple thing. No email addresses as customer IDs. That cuts off the possibility of address/password pairs leaked from elsewhere being re-uised.

The 'End of 10' is nigh, but don't bury your PC just yet

Here's some tools I've written that I can't compile because Windows didn't come with a compiler ... oh, of course, I'm running Linux and the compiler was just part of the basic install.

Re: Where are the native applications?

Likewise. Apart from anything else the sheer investment in perpetual licences and subscriptions for the equivalents of what I use would be punishing.

You do all that and what have you got? Windows 11.

Re: If I wanted to get there

In Europe I can see that situation arriving sooner than you might think as patience runs out with Trump on the one hand and the usual suspects on the other - not to mention the ransomware industry on the third.

Re: Not obsolete if you monotask singlemedia

The other day I tried Devuan on an MSI equivalent. I took it to the archives yesterday for note-taking. It wasn't until I got there I discovered I'd not set up the GB keyboard... Just remember to hit @ instead of " and it was fine.

Tomorrow I'm going to need the document camera so that will be the next size up Asus which is the test horse for Devuan next (Excalibur). Heavier than I'd like to be toting around but any Linux laptop is a good workhorse.

Re: not so great for a casual user, grandpa and grandma

"I AM a grandfather (81 this year)"

Snap but in my case SWMBO has been using Devuan for years although if you asked her she'd probably say Google and email.

It's Windows I find increasingly user hostile.

Re: Pinta is great

Agreed. I use it a lot with multiple layers of annotations for maps. It struggles a bit with, for some reason straight lines on large maps but I put that down to being based on DotNet

"Linux does not have the consistency of user interface and applications to be usable for this contingent."

An WIndows is?

"Great for you and me, not so great for a casual user, grandpa and grandma."

Would a 90-year-ld be a good comparison? Not a grandma - sadly her children let her down in that respect - but she's been using Zorin for ages. Even her Windows using children manage to use it on her PC.

Re: TODO

"why do I need to chose, is Linux not just Linux ?"

To which the reply is "You choose clothes, food, a home, a car, a partner. Some of these are much longer term commitments than choosing a variety of Linux".

Microsoft set to pull the plug on Bing Search APIs in favor of AI alternative

So that's Bing written off as a basis of privacy-respecting search engines.

Here's what we know about the DragonForce ransomware that hit Marks & Spencer

Re: And that's why you should NEVER pay a ransom...

The best way to ensure that ransoms are not paid would be to make them illegal. It wouldn't be immediate complete prevention but would be more effective after the first prosecution of a board that did.

Couple that with offering big rewards for information leading to the identification and capture of those responsible. There are probably a few who, in return for immunity and cash, might contrive to inveigle or otherwise exfiltrate their associates to somewhere where there's extradition.

Go ahead and ignore Patch Tuesday – it might improve your security

Re: Patch? Yes - but maybe the greatest threat lies elsewhere

Too simplistic. There are a whole lot of factors. Microsoft vulnerabilities are one and reliance on a (usually Microsoft) monoculture is another.

But I read somewhere that one of the recent break-ins was social engineering, getting the helpdesk to reset an IT password. If an attacker can gain an admin password like that it doesn't matter too much what the platform is (although NOT relying on sudo would make compromising a Unix-like system harder).

Lack of segmentation is another factor. If Joe User clicks on a booby-trapped email the damage shouldn't spread very far, preferably no further than his own PC. Given that entire store replenishment systems and contactless payments are getting hit it's quite clear that once in it's open house. I suspect "convenience" is the explanation for a lot of that.

Re: Patch? Yes - but maybe the greatest threat lies elsewhere

"most companies would see a greater increase in security by better educating their user base"

And strictly limiting the possible blast radius of any given user.

Re: Tell that to compliance (and ultimately the law)

"system stability (a known known)"

For some value of stability.

Meta's still violating GDPR rules with latest plan to train AI on EU user data, says noyb

"Meta has previously argued it needs to collect social media data"

Meta seems to suffer from a common vocabulary error: confusing "need" and "want".

VPN Secure parent company CEO explains why he had to axe thousands of 'lifetime' deals

That was also raised in the /. discussion referred to in the article. If that's right then none of the excuses will wash.

C-suite at Alphabet make B-A-N-K from 2024 equity awards

"$215 million in compensation"

What terrible thing happened to them that requires so much in compensation?

Europe plots escape hatch from enshittification of search

Re: Laughable

So what you're saying is "you can't beat crap so don't try". Is that right?

Qatar’s $400M jet for Trump is a gold-plated security nightmare

Take out the gold taps, install them in AF1. Tell him it's the new one. Job done.

Yes Minister fans will be reminded of the puppy from the French President to HMQ.

Judge puts two-week pause on Trump's mass government layoffs

I've no idea how expert you are on US law but I'll take a bit of a guess that a US judge knows more about it than you.

Re: And when the government ignore the ruling ...

A few minions inside for contempt of court? Harrison Fields called the judge's decision a "bogus order". That sounds contemptuous.

Microsoft facing multibillion legal claim over how it sells software

Re: Open source?

"so the C suite would like it (as in they’d have someone they could sue if it all went wrong)"

How many C suites have successfully sued Microsoft for things going all wrong?

I doubt Microsoft sales are actually making it a selling point so if C suites are actually thinking like that it must me some of Microsoft's fellow travellers pushing that line. Maybe somebody sitting in IT whose status comes from his big budget spent on Microsoft.

Re: The Register asked Microsoft to comment. ®

There seems to have been a bit of misunderstanding about which office of the county archives holds a specific document. When one of them suggested I reach out to the other I reckoned that things had come to a pretty poor pass. I replied that I'd contact them.

I suppose Microsoft's defence will be that they don't sell products. They just lease them with an upfront payment.

Nextcloud cries foul over Google Play Store app rejection

Re: No excrement on offer

Does Google provide a competitive service with similar requirements? If so does it pass these requirements and if so why does it pass and Nextcloud doesn't? Surely Google wouldn't be favouring themselves, would they?

"this is just Google's standard Android security protections."

Sensible security precautions tune the restrictions to the purpose of the application. In the case of Nextcloud app the purpose is to legitimately synchronise files with a Nextcloud server, usually to synchronise files with another device via the server. In that case being able ti access files is a requirement of a legitimate purpose. If it operates on a phone in the same way as it does on the desktop it will be restricted to files in a particular location to be selected by the user. If Google provides a similar service without restrictions then one might reasonable conclude that anticompetitive behaviour is in play.

"And it's just coincidence that Google's own synchronisation app just happens to be the only one that won't be summarily broken by the change."

Overlooking it might just be sheer carelessness on their part of course.

Re: But will the companies that benefit put back in ?

Do you actually have a point to make other than being triggered by mention of a FOSS project?

An excellent move by Google. The more people get to use F-Droid the better.

'We still have embeds in CISA': CTO of Brit cyber agency talks post-Trump relationship with US counterpart

DOGE can obviously see efficiency improvements in infosecurity. There are a pair of letters than can easily be removed.

Boffins warn that AI paper mills are swamping science with garbage studies

Re: Way Back...

Correlation implies causation but it doesn't tell you what it is.

Re: Drain the swamp

"In the past, there was at least some excuse for the costs of production and distribution of quality hard-copy printed journals for libraries, paying for professional proof-reading, etc."

<Cough>

Back in that one of my first tasks as a research assistant was to check the proofs (may have been galleys but I think it was page proofs) of a paper in one of the most prestigious Irish publications. It was written by a former student of my boss. I found systematic errors in conversion from imperial to metric units which had passed the editors, referees and others. True the proofs matched the original text....

Bosses weren’t being paranoid: Remote workers more likely to start own biz

Also need to bear in mind that some (?many) RtOs are disguised redundancy-without-paying-for-redundancy operations. As these fail to take into account that the first ones out will be those who can get jobs elsewhere, including starting up on their own, this has to count as the objective being met.

Re: A couple of things come to mind

"cost of job = salary of external contractor"

Wrong. Cost of job = contractor's billing. That is not the same as contractor's salary.

Out of the invoiced amount the contractor has to provide his own expenses, provision for being on the bench between contracts*, sick (including health care costs in the US), holiday pay, employment taxes as well as salary. It's disregarding all that that brought us IR35.

* From the engager's PoV this is "availability". The standard pimp to contractor greeting is "Are you available?"

Re: Spying tonite!

As far as I was concerned those three words read "disregard this paper". Real boffins describe their methods properly.

Critics of "return to office" mandates note that there are other possible motives, including office occupancy requirements as a condition for local tax breaks

Any jurisdiction seeking genuine green credentials should take a look at that one. Granting tax breaks to employers imposing unsustainable commuting requirements is jut plain stupid. Tax braks encouraging less commuting should replace them.

Amazon tested warehouse robots and found they're not ready to replace humans

Re: Capitalism is dying

My dream for retirement was to spend the summers watching ball-by-ball play test match play on the Beeb. Sky killed that.

Now to look at your contention. In my part of the world lots of older houses have a row of windows, often, now, partially blocked up, that let the light into the upper floors which were occupied by looms operated by home weavers. Some of them were clothiers, entrepreneurs who bought the wool, wove it and sold the cloth. Some were occupied by waged weavers who worked for clothiers. The textile industry had become increasingly mechanises - first it was fulling, then it was the carding and spinning. Eventually the entire production of woollen and worsted cloth was mechanised.

Did this result in those houses becoming derelict as fewer and fewer people were required to operate these machines? That would be what your logic would imply.

In fact mechanisation meant bigger and bigger mills. The C19th census returns show people moving into the area from other parts of England and to some extent, other parts of the British Isles as the population working in the textile industry grew. Some members of older families turned o other businesses as there were now more opportunities for shop-keepers and quarrying. The old clothiers had been par-time farmers and now some became full-time farmers consolidating the old small holdings. Mills needed engineering businesses to support them and these in turn diversified. What had become a small scattered population fo part-time textile workers, part-time farmers became a number of small towns with diverse businesses.

The moral of this? Societies and economies do not evolve along simplistic lines but Adam Smith is a fair guide.

OS-busting bug so bad that Microsoft blocks Windows Insider release

Re: LLM Process Scheduling?

It's tempting to think that but customers are cheaper.

M365 apps on Windows 10 to get security fixes into 2028

Yet another step in the frog-boiling. Keep paying the subscription and don't even think of switching to LibreOffice.

Linus Torvalds goes back to a mechanical keyboard after making too many typos

Re: Slow news day?

The editors know their audience.

Tech suppliers asked to support single electronic health record across England

1. The patient record should be held by the patient's registered GP. Not everyone will have a registered GP but this should not be an impediment to getting something underway, if they don't get an electronic record this is no different to the existing situation of not having a paper record and, if necessary, a separate procedure can be put into place if, for instance, they turn up at A&E.

2. In reality this will mean that the GP's service provider such as TPP.

3. Access from other practitioners such as A&E, consultants to whom the patient is referred gen access via a broker which checks for appropriateness, the broker to be run by NHS. If necessary such practitioners would be able to add to the record.

4. The service providers, including those used by those with access in 3. will have different systems. A common exchange format would be required. My suggestion for this would be XML. This allows processing aong the lines of Provider1 data > Provider1 XML >(XSLT)> Common XML >(XSLT)> Provider 2 XML > Provider 2 data

5. Start simple. One reason for suggesting XML is that it's eXtensible. Get a system under way with a minimal common data format ven if it's only a list of appointments and free text notes. Add more to the schema later. Trying to produce a bells and whistles version from the start will ensure it never happens.

6. It should take into account the patient's other registered practitioners such as dentists and opticians. If they have suitable systems they should have automatic rights to access and contribute a suitable subset of the data but again this need not be in the initial version.

The negotiation for access at 3. is critical for maintaining confidentiality as well as ensuring essential access. It's something that should be run in-house, not farmed out to the likes of Palantir nor should it be in a public cloud.

Lets, just for once, assume that this is proposed for doing the right thing. Then it can be designed with proper safeguards to ensure it meets data protection standards which preclude selling or giving away private data.

Eternal vigilance is one thing, eternal search for objections is another. The first enables us to deliver something useful, the other prevents it.

As US vuln-tracking falters, EU enters with its own security bug database

But, of course, these things are done for the greater good and that includes the US even as it deliberately changes itself from "greater" to "lesser".

CERN boffins turn lead into gold for about a microsecond at unimaginable cost

Re: Odd how what was "nonsense" is now fact.

I can't help feeling that dark energy and dark matter have a strong resemblance to phlogiston. Invoke something untouchable to explain whatever it is that's puzzling.

US govt's science foundation purges 37 divisions, equity unit among casualties

Re: Well, ...

Or Poe's law in operation. It really is coming into its own these days.