Posts by Doctor Syntax

I got 257 problems, and they're all open source: Report shines light on Wild West of software

Citation needed

"The bogeyman of the hoarders of personal data, GDPR, also reared its head. Black Duck noted that responsibility for compliance lies not only with auditing one's own code and processes, but also ensuring that any open source in use is also compliant."

In what way does GDPR say anything about code? It's all about data, specifically personal data, and what you do with it. It makes no difference whatsoever as to the technical details of how it's processed; even your salesman's little black address book is subject to it.

I'm building raised beds in the garden. I could do with some of their top-quality BS as a soil improver.

Git push origin undo-my-last-disaster

Everything old is new again.

But seriously, just how much did he wipe out at the start? Just code by the sound of it. He's not going to have got gigs upon gigs of data back from Git in that time. Don't these people need data in their systems or is looking after it SEP?

Brit prosecutors fined £325k after losing unencrypted vids of police interviews

If this was supposed to be court evidence they weren't taking continuity seriously. Having exposed this practice twice I'm sure defence counsel will have taken note. It should make for interesting cross-examination.

"Doesn't the GDPR do this (make a nominated person - probably very senior - ultimately culpable)?"

Even better. Although a DPO has to be nominated there are provisions for directors or other senior officers to be held responsible and although the actual words aren't used that's effectively ex officio. IIRC the relevant section of the new Bill (should it ever get through Parliament) is S191.

Blighty's super-duper F-35B fighter jets are due to arrive in a few weeks

If they're so stealthy perhaps we could claim we have a couple of full squadrons already operational but nobody can actually see them.

There was supposed to have been a fly-over of the Derwent dams in commemoration of the anniversary but it didn't happen because of unfavourable wind conditions. However I think they must have had the Tornado flypast; one appeared close to us yesterday afternoon.

Capita cost-cutting on NHS England contract 'put patients at risk' – spending watchdog

"It decided to outsource the service as it lacked the necessary skills to transform services through better use of IT, the NAO said."

This is the central problem. Those are also the skills needed to supervise an outsourcing contract. A successful IT operation must start with a core team in-house with adequate knowledge to understand what the business or organisation needs and what's available to meet those needs. With that in place they can then make a sensible decision about whether to outsource or to develop in-house, bringing in external help on an as-needed basis.

Trump’s new ZTE tweets trump old ZTE tweets

"Just what is being done about ZTE therefore remains unknown."

Including by Trump.

Zuck to meet Euro MPs for ‘please explain’ session

Could we arrange for his flight to be diverted into LHR and met by a party lead by the Sergeant at Arms?

Software development slow because 'Most of our ideas suck'

"So what does that say about developers that are proponents of this idea?"

They're paid peanuts.

I'm finally starting to see the reasoning behind it.

Re: Mud on a wall

Mud would probably be an improvement on what might be thrown at the wall.

Re: What's missing in this commentary

"The difference between good and bad ideas is whether or not they bring benefit to the customer."

Good = New, Bad = Old (the stuff we deployed a couple of hours ago). Customer? Benefit? What's that all about?

Lawyers for Marcus Hutchins: His 'I made malware' jail phone call isn't proper evidence

"so what's the motive now?"

General embarrassment of the NSA due to the damage done by their malware which they failed to control.

Whois privacy shambles becomes last-minute mad data scramble

Re: really, fear should be unnecessary

"I, at least, won't be expecting complete adherence on the date from registries that got no guidance."

The registries have had as much guidance as everyone handling PII in other lines of business. GDPR mandates various behaviours which affect registries. That mandate overrules any clause in the ICANN contract which is in conflict.

Re: Typical ICANN

"This puts the European registries in a tight spot."

It shouldn't. Like everyone else they've had plenty of warning. As you say, statute law overrules contractual terms so ICANN's contract terms will shortly become invalid with respect to any data subject resident in the EU irrespective of where the registrar is or the TLD of the registration. The registries should have realised this and made their preparations in good time. The only question remaining is what do the contracts say about terms being made illegal - does the contract remain in force with only the affected terms struck out or is the entire contract invalidated?

Privacy group asks UK politicos to pinky swear not to use personal data for electioneering

an exemption that allows registered parties to process personal data "revealing political opinions" for the purposes of their political activities.

Coming up soon: the registration of the Cambridge Analytica Party and others.

Agile development exposed as techie superstition

Re: Agile is b*llocks. Any non-idiot knows this.

" you think that going to a conference like this is actually making you a better person, then you're simply not very good and should be in another industry. "

To be fair, discovering the pointlessness of this is a rite of passage. If you don't grok what's wrong after the second conference that convincingly contradicts everything that was so convincing in the first then you really should be in another industry; probably management consultancy.

Void Linux gave itself to the void, Korora needs a long siesta – life is hard for small distros

That list at the beginning: you missed Debian. That's one of the most important distros. However it doesn't, AFAIK, have a multi-million dollar company behind it.

Julian Assange said to have racked up $5m security bill for Ecuador

Re: Stupid Question Time

Plus, the UK can deem the embassy "not an embassy" any time they like, totally legally.

But not without causing an international incident.

Re: It would have cost them something

"or #UK"

A hashtag? Are you Amber Rudd?

Re: Suing would backfire, badly

"Courts use video links for witnesses who cannot make it to the courtroom for whatever reason."

It depends on whether they accept the reason. Being a fugitive from an arrest warrant for skipping bail might not be a good enough reason.

"Under the Computer Misuse Act, such an action would be illegal without authorisation."

It doesn't apply within the Ecuadoran embassy although they may have their own legislation about that. If they were to charge him they'd probably have to take him to Ecuador to stand trial. The trip might go via a British court and possibly jail here. Sweden might get involved as well.

Eventually "Operation Saga"

Heat death of the Universe?

The scheme was first named "Operation Guest" before changing to Hotel, which may reflect the length of Assange's stay at the embassy.

Shortly to be renamed "Long Lease" and eventually "Here's the deeds".

Hey cool, you went serverless. Now you just have to worry about all those stale functions

Re: Who'll thnk of the data?

"You put the code the developers write on the same system as your data"

You put the code on some 3rd party "serverless" server. Now where do you put the data? In some other location? Then you expose the data directly to the internet so the serverless server can access it. Let's think of all the ways that could go wrong.

Re: BaaS

"There will always be vulnerabilities, just make sure they're somebody else's fault."

Scapegoat as a Service.

Who'll thnk of the data?

In the "serverful" world, deploying code has significant costs – you need to work harder to deploy the code (which takes time), allocate ongoing compute resources (which costs money), set up constant capacity monitoring (more time), and on top of that you need to continuously patch these servers and secure them against the bad people out there. These costs mean you only deploy code that is worth deploying, providing enough value to justify the price.

Has anyone noticed there's a word missing in there?

Data.

The servers that those allegedly all too expensive admins look after don't just keep the developers' code running, they also house the data. If, in this developer centric world, the "Ops" bit of DevOps is just seen as deploying code, then we can continue to see more and more TITSUP events resulting in data loss.

"While it clearly employs servers behind the scenes"

It's servers all the way down.

Oh Capita! Thirsty outsourcing titan finds small oasis in contract desert

Re: Oh God!

Conflict of interest?

You've been Zucked: Facebook boss refuses to face-off with Brit MPs

Re: It's the politics, stupid

"Send a subpoena or STFU"

Under what authority would they be able to serve a subpoena in the US? That stamping of feet you heard - have you looked down at the end of your legs?

"We were disappointed after providing a very significant amount of information to the committee at the last hearing that the committee declared our response insufficient,"

Not half as disappointed as the committee were with the response.

US judge to Facebook: Nope, facial recognition lawsuit has to go to jury

"I love seeing big data slurpers on the hook"

And meanwhile all the lawyers' children avoid starvation for a few more weeks.

"Should the UK police ask Facebook for help since their own face recognition software sucks?"

I was thinking the opposite. FB could try claiming its facial recognition doesn't work because it has 98% false positives.

Zero arrests, 2 correct matches, no criminals: London cops' facial recog tech slammed

Re: Surely though

"This system would might identify 50 people, one of which would be me."

It depends on the rate of false negatives but given your figures, what happens to the other 49? How many of them get picked up, held for a few hours, searched, miss trains, get locked up because they refuse to give anyone the password to their phone?

Re: Surely though

"It's a prefilter."

That was my reaction. If it was doing a good job at that it would be worthwhile. But even for a prefilter that rate of false positives is very high and raises the question of how many false negatives there are. Is there adequate reason to suppose it's doing a better job than picking faces out at random?

Openreach consults on shift of 16 MEEELLION phone lines to VoIP by 2025

" If the phone service were not provided that maintenance costs that are currently chaged to your phone line will simply be added to your broadband charges."

Let me amend that. In the fibre future you'll still be charged for the upkeep of the line and it may indeed at some point be less than it costs OR to maintain the current structure. However you'll also have to contribute your share to pay off OR's loans for the cost of rolling out the new system plus the interest charges on those loans.

So will the rest of us, irrespective of whether or not we wanted anything more than FTTC. The chorus of "FTTC is not enough" have done their work. Now OR have got a means of getting a price increase past OFCOM.

So we decide to do something and then try to find out how to do it. Have I heard of that somewhere else?

"If OFCOM drop the need for BT to maintain the copper OR may finally be able to replace copper with fibre and have a happy ending?"

Does this replacement happen automagically without any cost?

"I've no use for a voice line in the house but I've got to bloody have one to get broadband."

You may not have noticed that the broadband arrives in your house via the same set of wires as your phone. If the phone service were not provided that maintenance costs that are currently chaged to your phone line will simply be added to your broadband charges.

Get over yourselves: Life in the multiverse could be commonplace

Re: And I always thought it was Dark 'cos we can't see it

"It is attracted by ordinary matter - its gravity - but goes straight through it and out the other side. Why? because it is the electrostatic forces that present surfaces, that repel things when they get close."

On a cosmological scale it's gravity that counts. It's gravity that holds galaxies together, not electrostatic forces. Electrostatic forces come into play at smaller scales. Electrostatic forces stop your hands passing through each other but when we see galaxies interacting it's gravitational forces that determine the outcome.

We're also told that dark matter, like ordinary matter, forms its own structures on cosmological scales. What's not clear is why ordinary and dark matter cosmological structures don't coincide given that they have a mutual attraction. I'd expect to see a single set of structures with dark and ordinary matter being similarly distributed.

Re: And I always thought it was Dark 'cos we can't see it

"Your other option is something like MOND that says that things are different at the Solar system scale and on the galactic scale (effectively, gravity is not quite M/R^2 at large Rs). It has to make sure that you explain everything we know, and we have not observed any deviations from 1/R^2"

Aren't the observations that dark matter etc are invoked to explain just such deviations?

The problem I have with the idea of dark matter is that if it exists it should be very easy to detect. It (allegedly) interacts with ordinary matter by gravity so it should be attracted to ordinary matter (or vice versa seeing as how we're told there's a lot more of it). So it ought to be right here, where we are, and not somewhere out there where we can't see it.

UK's Rural Payments Agency is 'failing on multiple levels' – report

Re: What's the problem?

UK farmers receive about €3 billion a year in EU subsidies, there is no way the country can afford such an amount in the next decade so the total will have to come down we'll have to add more food imports to the (im)balance of trade.

FTFY

Airbus windscreen fell out at 32,000 feet

The article suggests the sequence crack seen, window disintegrates, pilot starts descent. Wouldn't it have been better to swap the last two around?

Re: Blown or sucked....

"blown out or sucked out. High to low pressure would suggest blown"

I suppose it depends which way you look at it.

How could the Facebook data slurping scandal get worse? Glad you asked

"If anyone ever thinks for a moment that Facebook won't stop collecting"

I think they won't stop, at least not voluntarily, which is why I'm not buying your bridge.

Re: On curves, and being behind them.

"By evolutionary principles, of course: anti-malware, like the immune system, can so far not respond to a threat until it appears."

OTOH if system designers built in security by design the bad guys would be lagging a long way behind the good guys.

Of course when it comes to something like FB the concept of "good guys" doesn't apply. We have to think in terms of bad and worse.

“Archibong”

Is he related to Steve? We need to know.

How many ways can a PDF mess up your PC? 47 in this Adobe update alone

Doesn't Okular have any of these CVE thingies? I'm feeling deprived.

FTC names its dirty half-dozen half-assed tech warranty bandits

"the federal agency was reduced to staff searching websites for infringing language, rather than a more serious (but expensive and time-consuming) investigation of illegal practices."

It's the same mindset as "we can't investigate crime because of encryption".

S/MIME artists: EFAIL email app flaws menace PGP-encrypted chats

Re: Who relies on this stuff?

I think the main reason encrypted email isn't used routinely is that nobody* knows anyone who uses it so nobody* uses it themselves and hence nobody* knows anyone who uses it. If we had a new version of SMTP that made it default it would take off. In the meantime those who need it really need it but, if they're focussed on their security they're likely to have HTML-enabled email turned off.

*Well, hardly anyone.

PGP and S/MIME decryptors can leak plaintext from emails, says infosec professor

Re: Defensive programming

"Well there is no actual use for HTML-E-Mail."

Certainly no good uses. AFAICS it was put together for B-Ark passengers who have so little confidence in being able to express themselves in words that they feel a need to put their message in fancy dress.