Posts by Doctor Syntax

OK, deep breath, relax... Let's have a sober look at these 'ere annoying AMD chip security flaws

If they're on the level they have just given potential clients notice of why not to deal with them. Or maybe the initial investment was running out and they had to whip up some publicity PDQ.

Re: Pot and Kettle

"Nice to see the un-educated like to down vote a question without realizing the true purpose."

Have you stopped beating your wife? A yes or no will suffice.

Re: Pot and Kettle

"your attempted snark is both unwarranted"

Don't be too sure. I think we can work out who might have warranted it.

Re: Timeline

A domain squatter has [registered intelflaws.com].

How about intelflawsareworse.com?

This could get really silly really fast.

Re: Odiferous Rodent

"If this is the case then why would they publicise the flaws?"

Maybe they think Intel are easier to compromise than AMD.

It's Pi day: Care to stuff a brand new Raspberry one in your wallet?

Re: Rats...

"...and I bought the previous model less than a month ago."

Less than a month ago? I bought one less than a fortnight ago. Another Kodi box.

Developer mistakenly deleted data - so thoroughly nobody could pin it on him!

"f some of the socketed chips (in those days that would be most of them) where a little loose, this reseated them, thus fixing the problem."

All except those which are jolted out of their seats completely. Phase 2 is to gather up the loose chips & decide which sockets to put them back into.

"Modern USB keyboards on desktops running Unix variants still do that in the terminal program."

It's not restricted to USB keyboards, in fact it's not the keyboard itself. The keyboard driver converts the key presses and releases into emulation of some sort of traditional keyboard input, typically that of the VT100 or one of its descendants.

Re: Bah!

"someone appears to be testing on the live Register server because I'm getting daft capcha requests on previews now"

Did you try typing in something that might have looked like a critical file name? I've seen that in the past and I just got the same thing by typing in the full pathname of the Unix password file and got the same thing. By calling it "the password file" I got round it. I've noticed it before. It seems to be some input sanitisation. My experience in the past is that the capcha doesn't work, possibly because I have NoScript firmly tied down.

In the real old days there weren't Unix commands for adding users, you just edited the password file.

Up and down arrow keys and the like on terminals issued escape sequence which tended to contain tildes. A bit of a timing error in transmission and the escape sequence would get misinterpreted and if you were unlucky vi applied the tilde to change toe case of the character under the cursor.

That's how I came to have the first name in my password file spelled "Root". I can't remember the reason why I couldn't then su back to root - possibly su didn't like the spelling. But also in those real old days if the first character you gave to a login prompt was upper case the terminal driver assumed you were on a TTY that only had upper case and obligingly changed all your characters to lower case so trying to login as Root failed because you were effectively logging in as root. Needless to say that back in those days sudo wasn't a thing. I had visions of crashing the whole machine with the power switch to gain root access in single user on reboot.

Fortunately I found someone had still got a root session open so we were able to fix it. But for a long time after that I got into the habit of having an alias of root - an entry with a different name but still with a UID of 0 - well down the password file.

"The other fun property of Sages was hard disks very averse to the computer being dropped."

Back in the day I remember a salesman dropping a Fortune (also a 68k box) from waist height - and it survived. I still can't understand how although the fact that it wasn't running probably helped.

OTOH I've dropped a hard drive about 6" whilst installing it and it was completely dead.

Re: Something odd going on here

"So if these indirect blocks get reused before `rm -rf /` completes (and while you're busy "backing up" the filesystem, other processes are appending to logs and writing data) then you'll only be recovering text files."

But that's still data. According to the article there wasn't any.

Re: Back in several past lives...

"When it comes to things like scripting and testing changes, that's all well and good if you have the time and warm bodies - and test platforms with representative data."

As a DBA you are responsible for the records on which your employer depends to conduct their business. To quote Len Deighton, the price of survival is eternal paranoia, vigilance is not enough.

What you do not have is time or sufficient warm bodies for getting it wrong because when (not if) you have to fix it after an over-hasty operation it will take a lot more of those resources. At the very least put a potentially destructive operation in a transaction and only commit if the number of rows affected looks right. As to test platforms, how often do we hear, right here in el Reg comments, of people thinking they're on test and then finding they've just done something terrible on live.

Scripts don't - shouldn't in this context - mean something with a high ceremony sign off. They simply mean typing something into a file instead of into a command prompt which can give you a chance of rehearsing it non-destructively - give that expression to ls, not to rm -rf, count the rows a WHERE clause returns etc - and and a chance to take a second look before it's too late.

More haste less speed. Or, if you prefer, the carpenters' motto: measure twice, cut once.

Re: Two years ago

"I'm still wondering why rm returns an error when the thing you are trying to delete doesn't exist."

Your intention: to delete a file called 0nefile.

You type in: rm Onefile

On completion of rm, 0nefile still exists because you didn't tell rm to remove it. If rm doesn't return an error you're no wiser to this unless you then run ls. Wouldn't it be handy if rm gave you some feedback to tell you you'd typed in an incorrect filename?

Something odd going on here

rm -r simply unlinks the data (including, of course, the directories themselves) from the directory tree. The data is still on disk if not organised in a friendly way; simply running od on the device sees it. Even if /dev is gone it should be visible if the drive is hooked up to another machine. If the data recovery company couldn't find any data then either they were not fit for purpose or something considerably stronger than rm hosed the drives.

Re: Back in several past lives...

"Once again, they'd managed to issue an UPDATE statement without any constraints on it. "

1. Always, always, ALWAYS do stuff like this as a script. Get into the habit so that you automatically won't run it straight from the command line.

2. Write the WHERE clause and test it in a SELECT. (If you know what to expect just select a COUNT without getting all the data streamed out to screen).

3. Ask yourself if what the SELECT returns is sensible.

4. When you're convinced it's right add BEGIN WORK at the start of the script and convert the test statement to your risky DELETE or UPDATE. Do NOT add a COMMIT to your script.

5. Run the script.

6. Check how many rows were affected. If and only if the result looks right type in your COMMIT, otherwise ROLLBACK.

Scripts are your friend.

Former Google X bloke's startup unveils 'self flying' electric air taxi

Re: Achtung! Lawyers at 6 o'clock high!

"The lift fans are unsafe: no ducts" etc.

There are these things called helicopters...

I remember going along to give evidence at a coroner's inquest. One of the cases before mine was about a squaddie who'd gone round the back of the helicopter he'd just left and into the tail rotor. In fact, it's that case I remember and not my own. I thought of it when I actually got a lift to a scene in one. The landing was on slightly sloping ground & I just remembered that case in time and decided that leaving down-slope was better than leaving up-slope.

Re: I can see a number of issues

"Who wants the job of doing nothing for extended periods, then suddenly being thrown into an emergency situation you have no prior knowledge of, and where the live of several people depend on your decisions."

Fire brigades, emergency ambulances, lifeboats... It wouldn't be a unique situation.

"Could you please tell that to the police helicopters that circle round and round and round near my house at 3 in the morning?"

What you should really be worrying about is what's going on on the ground to bring them there.

"Do most cities allow helicopters to fly over them?"

Lisburn is a city nowadays and when we lived there we got rather a lot of low flying helicopters overhead. I wouldn't have been surprised if our roof had tyre marks on it. We were rather close to Thiepval barracks.

Re: I'm not an aviation engineer...

"Also, also, if this is supposed to be a city-based air taxi why was the video flying over mountains and valleys"

Because the development flying has been done in the S Island of New Zealand where they have lots of mountains and valleys but relatively few cities.

Man who gave interviews about his crimes asks court to delete Google results

"YOU do not really need to know anything about a person's history if you are not employing them."

You may need to if you're buying some product or service related to past offences from them. You may not wish to hand over sums of money for safekeeping to someone who has a history of embezzlement.

Air gapping PCs won't stop data sharing thanks to sneaky speakers

Re: Relevance

"The people who build them and ship them have physical access so that's one hell of a big handful."

So what do you do, compromise all of them in hope that you'll eventually find one online that shares a room with an air-gapped one you're interested in? However, just to be on the safe side, if you're installing an air-gapped machine make sure it's a different make to any others in the room.

You're all forgetting the purpose of this research: published papers.

UK digi minister Hancock suggests Facebook and pals give your kids a time-out

You personally, Matt. *You're* the one who is supposed to be babysitting your children.

Really! Don't you know how busy he is babysitting everyone else's? You can't expect him to find time to look after his own.

Capita screw-ups are the pits! Brit ex-miner pensioners billed for thousands in extra tax

Re: crapita corner

"Corbyn has realised re-nationalisation (slowly) is a vote winner, so is punting it for the trains and other areas."

In that case I'm glad I no longer travel by train. I remember what it was like before it was nationalised. as per a comment above, they had to address announcements to "customers". They couldn't call us "travellers" when they were telling us why we weren't travelling or "passengers" when we were simply standing about on the platform.

Re: Typical Bureaucrats

"We sincerely apologise for any concern and inconvenience this has caused."

More like typical PR. It's another situation where the likes of el Reg should make life more difficult:

"Don't you mean 'the concern' rather than 'any concern'?"

"Then why didn't you say so?"

Weasel words contaminate the language. Journalists shouldn't let them get away with it. Even if they don't get chance to question the wording as I just suggested they should at least comment on it when quoting it.

Re: Outsourcing .....

"They paid themselves to do it so apart from what it cost to do it cost no more."

Actually it does. The Ponzi nature of Civil Service pensions is a cost for the future. The notional deduction from pay (the pay rates are supposed to take into account what would be the cost of pension contributions) doesn't go into a fund. If it did HMRC would probably take a rather less aggressive approach to what they see as overfunding. Instead pensions are paid out of current taxation. In consequence every member of the civil service doing something now represents a future pension cost. This is one of the things that govt. can dump on someone else by outsourcing. Of course when the outsourcer's pension scheme goes TITSUP* it might well be HMG picking up the bill in the long run.

*Typical Industry Titan's Shockingly Underfunded Pension.

HP is turning off 'Always On' data deals but won't say why

"And at least with 20Gb, if I use 19.9999Gb, they can't touch me and if they do, I can sue them for breach of contract."

They'll quibble about what a Gb means.

Tim Berners-Lee says regulation of the web may be needed

Re: Don't let the Gummint get involved

how about using DuckDuckGo, Wolfram Alpha, IxQuick, Yandex or Gibiru

Of that lot:

"Wolfram|Alpha needs JavaScript in order to work"

"Start Page by ixquick....enhanced by Google"

Yendex "It is the largest technology company in Russia" (Wikipedia)

"Gibiru is the preferred Search Engine for Patriots." and does absolutely nothing on my browser except a lot of self-praise.

"But increasingly things like Facebook are the ONLY form of contact for people too close too ignore, such as family."

Only if you allow them to be.

"As for the next billion users, most of them will not be English speakers, nor will they even be of Western culture. I do not think Facebook or Twitter will be able to brainwash them."

Their governments might, however.

"I'm simply saying that the modern world doesn't respect political borders like the government thinks it does."

Given the US's inclination to extra-territorial legislation I'm not convinced they respect political borders.

Re: The future GDPRs will take care of it

"One day, in the future an inflection point will be reached when social marketing scum will have to go back to selling double glazed windows to pensioners."

Oi, keep them off my lawn.

NHS Digital to probe live-stream spillage of confidential patient info – after El Reg tipoff

"However, NHS Digital has faced a number of problems over its use of apps."

Once is an accident. Twice is a coincidence. Three times is getting to being a habit. Doesn't the NHS run addiction clinics?

Less than half of paying ransomware targets get their files back

"That headline: Fewer... (please?)"

Is quarter of a pint fewer than half a pint or less than half a pint?

Re: Backups ...

"She once had to assist a company that at first glance had done all the right things"

It must have been a very cursory glance. If first glance at your tape store doesn't reveal a tape labelled "Full backup $DATE" or "Level 0" or such you should know it's time to do something about it. In fact, if they were running tapes on a 3 month basis then it should have been obvious that at the end of the 3 month cycle it was time for a new full backup.

Re: I actually am surprised

"I also assumed this just do to simple self-interest, that people will stop paying if they getg the word that they won't get the key anyway."

The initial wave of ransom-ware operators did indeed seem to operate in this way. They clearly looked on it as a business and had to be handled in a business-like fashion in order to keep the money flowing. If they didn't put the work in the ransoms wouldn't be paid and the income would disappear.

However, like all areas of business new operators came in looking for the quick buck and so we have a race to the bottom. Add to that a few nation-state operations where the sole intent seems to have been to cause harm.

The guys who started this must be fuming.

Pharma bro Martin Shkreli to miss 2024 Paris Olympics

Re: Justice is not always as blind as it should be

"When was the last time you were in court, Sir?"

Since you ask, about 30 years but plenty of times before then. In a professional capacity of course. And yourself?

Re: Justice is not always as blind as it should be

"I believe that if he had not been such a controversial person, publicly making unpopular business decisions, he might have been treated differently by the legal system, and spent less time in prison."

Yup. If he hadn't done bad stuff he wouldn't have broken the law and been charged.

Slingshot malware uses cunning plan to find a route to sysadmins

"the software suggest it was developed by an English speaker. Kaspersky thinks that the amount of time and money it would have taken to write Slingshot strongly suggests it was developed by a nation state."

You can see why the US govt. really hates Kaspersky.

Citizen Lab says Sandvine network gear aids government spyware

Re: Guns do not kill people

"is there something wrong with my logic this evening?"

Yes. People alone can't redirect users no more than people can thrown a bullet hard enough to do harm. People use tools. Toolmakers must also share the blame.

Good news: Apple designs a notebook keyboard that doesn't suck

Prior art

Spectrum keyboard for one and I'm sure that wasn't the first to incorporate a membrane.

DVLA denies driving licence processing site is a security 'car crash'

"Could you make a simple job any more difficult?"

Remember that well known training programme on all things relating to HMG administration, Yes Minister. Being sent to the DVLA was one of the ultimate threats for a Civil Servant (the other was RAF Lossimouth). They're all trying to exhibit their red tape credentials in hope of being posted back to London.

Re: Certificate chain

Thus if you run a web app, best to check it in all the major browsers.

Once upon a time there was just HTML. The marketing wonks wanted control over layout and it all went downhill from there. Just make your site work without stupidities such as loading stacks of executable stuff from sites over which you've no control and guessing at what browsers the punter might actually have available. KISS

"The security certificates of all of our websites meet industry standards and we use recognised industry best practice methods to ensure that all our URLs are secure. The security of our customers' data is always paramount and we constantly review our websites to ensure they are fit for purpose."

Translation: "I work in PR. Understanding what you said isn't in my job description. Here's some boiler-plate."

Europe is living in the past (by nearly six minutes) thanks to Serbia and Kosovo

Re: Mains powered clock

"t has always been the case in the past that you get much better long-term stability from mains-frequency-linked clocks than from a quartz oscillator."

Only if you don't have countries playing silly buggers with the grid.

"Perhaps radio would be better still, but you're adding cost at that point."

Just check your clocks & watches against the computer these days. That gets synced to some nice atomic clocks somewhere.

Most IT contractors want employment benefits if clobbered with IR35

Re: socialist agenda

"When Gordon Brown got in they found a sympathetic ear"

I always assumed the word for what they found was "mug" but you may well be right. His predecessors seem to have seen through the arguments, however.

I'm not sure whether it's a socialist agenda. I think it's simply that PAYE was designed by people in permanent jobs for people in permanent jobs and adding another way of doing things involves hard stuff like thinking.

"For example, of the 455 contractors employed by the Department for Work and Pensions"

I think they mean the 455 contractors engaged by DWP. If they're employed they're employees, not contractors. It's this sloppy thinking that lets HMRC get away with FUD.

"Government could just go back to employing professional staff as employees on good wages and stop paying contractors to do the work."

You must be joking. Government has been trying to cut head-count for years. For a start direct employees have pension entitlements and as the Ponzi-like nature of state pensions and Civil Service pensions are threatening implosion they want as little as possible to do with it. Why shouldn't they throw those and all the other benefit costs on the worker and them rip the workers off by pretending they're ordinary employees for tax purposes.