Posts by Doctor Syntax

A ghoulish tale of pigs, devs and docs revived from the dead

Re: YOU ARE LATE FOR A MEETING

The best reply is "Yes I know. I'm busy working through all your emails about meetings".

Re: Love it!

"demand blood sacrifice from any mortal working on them in the machine halls."#

That's why the metal-work has sharp edges.

Unidentified hax0rs told not to blab shipping biz Clarksons' stolen data

"But there's still nothing in the way of a targeted, determined, knowledgeable attacker finding a PHP hole in the parent portal"

Not using PHP would stand in the way of finding PHP holes. Of course it only moves the problem elsewhere.

UK data watchdog raids companies suspected of 11 million nuisance texts

Re: Prediction...

"At which point their spouse is listed as the director, and the cycle continues."

At which point they've moved themselves up onto a higher naughty step. One next to a window with bars on it.

FBI chief asks tech industry to build crypto-busting not-a-backdoor

Re: He's right, but no one here will accept it

"The OP has a good point. I think the the tech community (that's us) needs to get behind the concept of accessibility and start suggesting potential ways to keep both sides as happy as possible"

Fine. Here's my suggestion.

He puts out a tender for contract to build this supposed wonderful tech. He makes himself happy because he's Doing Something (politician's syllogism at work here). The winner of the contract is happy. The rest of us are happy because we know that (a) nothing will be delivered because it's not real and (b) it'll be one of the usual suspects who gets the contract so it will look like business as usual when nothing gets delivers.

Re: He's right, but no one here will accept it

"One solution would be to mandate that copies of all private keys be kept in escrow where only trusted law enforcement could access it."

You are, of course right. But you just move the problem to ensuring that only trusted law enforcement could access it and only in appropriate circumstances*. And a few others such as if the product is sold outside the US's jurisdiction how do you ensure that the private keys for those customers don't also go into escrow.

That, of course, applies to US products. It doesn't do anything about software produced overseas or open sourced; you know, the software that anyone wanting to do anything remotely dodgy would then turn to. That software would be made illegal? Let me repeat what I've said before. You do not inhibit someone intending to break laws by providing them with more laws to break.

* For avoidance of doubt appropriate circumstances don't include checking up on the neighbours and going on fishing trips. They do, however not just include but require due process of law to obtain a warrant.

More money than sense? Saudi Arabia invests $400m in Magic Leap

No doubt about it, Abovitz is really good at what he does.

Sci-tech wants skilled worker cap on PhD and shortage jobs scrapped

"If you think that someone with a PhD needs to be earning over 100k to demonstrate that there is a skills shortage then you are living in a fantasy land"

£100k is still less than the figure needed to escape the cap so it appears to be approaching the territory that the govt reckons would be result of a skills shortage. Unless, of course, the cap is the result of some other criterion HMG is working to and they don't actually mind skills shortages.

Defra to MPs: There's no way Brexit IT can be as crap as rural payments

The IT challenges posed by Brexit to the Department for Environment, Food and Rural Affairs (Defra) are "significantly less complex" than its woeful Common Agricultural Payments system

Of course. They'd be able to declare the requirement for their system to be whatever the system managed to do. It's so much simpler when you don't have to work to someone else's specification.

(In the past I've asked for a specification for S/W I was to write and, in effect, been told that whatever I did would be the spec. I lest.)

Fresh docs detail 10-year link between Geek Squad informers and Feds

Re: No problem

"I've got no problem with anyone reporting illegal child porn to authorities"

To find it they have to look at file contents.

If you take your PC in to a technician it will have your private stuff on it. Bank statements. Password lists. Contact lists. A diary. Your personal family photographs. Stuff you're working on which you regard as your IP and consider potentially valuable. Your employer's IP.

Do you still not have a problem with anyone knowing there's stuff to report?

Re: This is all wrong on so many levels...

"If you're a doctor, lawyer etc and have identifiable information about patients / clients then dropping your computer off at PC World is likely a breach of data protection legislation."

If there were a problem with it it would have to be handed over to a technician somewhere. That technician has to be trusted. The technician at PC World will take his medical ailments to his doctor and trust that he will be treated ethically. Why shouldn't it work the other way around?

PC World should be subject to the DPA and/or any other relevant regulation just like any other business handling data.

"Yup, however if a file name or image is seen that is suspicious"

File name, maybe in limited curcumstance. Image - why are you looking at images on a customer's computer?

Let's presume the customer to be innocent of anything, an old-fashioned assumption admittedly but an essential one if we wish to live in a free society. So what might be on the computer? All manner of personal stuff if it's consumer machine, all manner of commercial material if it's a business computer.

The default assumption must be that it's confidential to the owner and/or user. In the case of personal stuff, at least in Europe, it will arguably* be protected by existing personal data legislation and even more so under GDPR. In the case of a commercial machine there's likely to be commercially sensitive material on there, some of it subject to various regulatory regimes: financial, medical etc. To go poking around in contents, even listing file names, of anything not immediately relevant to the work that's being done is at minimum a breach of confidence and quite possibly a breach of other legislation or regulation.

TL;DR A tech has no right to go poking around in the PC's contents.

* There must be an argument that anyone accessing a PC is at the time the processor of any day data file they open.

Pasties in SPAAAAACE: Cornwall hopes for slice of £50m spaceport cash

"considerable investment from the European Union in the form of projects such as high-speed internet connectivity."

Cornwall should have rather a lot of internet. Porthcurno is still the landing point for trans-Atlantic and other cables,

https://www.theregister.co.uk/2018/02/15/geeks_guide_to_britain_porthcurno/

Suspected drug dealer who refused to poo for 46 DAYS released... on bail

I suppose they decided they might need to use the cell again and if they didn't get him out of there in time the next prisoner might complain of cruel and unusual punishment.

UK.gov cooks up code of conduct to enforce a smidge of security on Internet of S**t kit

Problem of definition

What's a connected device?

On the face of it my laptop is a connected device. Am I to be supplied with a unique password by the manufacturer which I can't then change?

What about something like a Kodi box? I can build one of those with a Raspberry Pi and as everybody but possibly Matt Hancock knows those can be given entirely new OSs simply by swapping the SD card. Is someone taking the Pis?

"The code states that all passwords on new devices and products are unique and cannot be reset to a factory default"

Not the best solution I'd have thought. A better one is that the out of box state is non-functional and requires a password to be set to become functional. A reset reverts it to out of box state.

I take Pen-y-gors' point about a remote reset by a hacker. The solution there would be that setting the password requires physical access to the device, say press a button on the device and you have a minute to set a password.

Someone places the device where they can't reach it and it gets remotely reset? There problem which is considerably better than being everybody else's.

Re: No password reset

"4) Owner stuffed."

Not necessarily the worst outcome. If Owner stuffed happens often enough and publicly enough we then have:

5) Vendor gains poor reputation.

6) Vendor fails to sell product in the future.

There is then an incentive to produce secure stuff.

US Army warns of the potential dangers of swarming toy drones on US soldiers

Re: Fixed wing drones

"The limit for number of simultaneously engaged targets in the most advanced missile systems out there is 40."

And against pump action shotguns?

Hackers create 'ghost' traffic jam to confound smart traffic systems

And in Norfolk...

http://www.bbc.co.uk/news/av/uk-england-norfolk-43242706/swarm-of-starlings-causes-roadblock-in-norfolk

Re: Spoof traffic entering the Intelligent Traffic Signal System

"It's not really user generated data; it's data generated by the vehicle system, and there's no reasonable presumption such a system would wilfully lie if working as intended."

There is, however, an unreasonable presumption that the system will work as intended and that nobody will get at it to make it lie.

Re: Braking News !!! :) <==== NOT a Typo !!!

"snarl up the Roads as a diversionary tactic "

Sounds like an Italian Job.

Women of Infosec call bullsh*t on RSA's claim it could only find one female speaker

A token male?

15 speakers, 14 of whom are women

ESA builds air-breathing engine that works in space

Re: Ionospheric ramjet...

"a) Who has sats that need to keep station around this height"

Without the ability to sustain them at that height there'd be no point in even considering something that would need it.

Microsoft builds Uncle Sam custom versions of 365 and Azure Stack

Re: Do some reading!

"Azure Stack is about havine MS Azure in your own data centre. "

And Windows 10 is about having Windows running on your own PC.

"Microsoft already have a security model that blocks the ability for their US employees to access data in other jurisdictions without local data custodian approval"

The only place I've read of this being used is in Germany. If it's deployed elsewhere they seem to have kept quiet about it. There's also a question of whether it would survive the CLOUD act whose purpose appears to be to make extra-territorial jurisdiction explicit.

They may be going after the US govt market but if they've any sense (admittedly a tall order) other govts world wide will be looking elsewhere, especially if the CLOUD act is passed.

Sacked saleswoman told to pay Intel £45k after losing discrim case

"Was she overconfident, a bit greedy"

She worked in sales.

MPs lay into UK.gov's planned immigration data exemptions

Hancock also shrugged off Cherry's statement that legal opinions suggested the immigration exemption would not be permissible under the GDPR, saying simply that "there are always legal opinions about everything".

Indeed there are and the place where these get resolved is in court. Maybe the prospect of a fine of 4% of HMGs revenue ought to concentrate his mind. Perhaps someone should ask the Chancellor if his budget contains provision for this.

Half the world warned 'Chinese space station will fall on you'

Re: Just an idea

"This thing should never have been allowed to be on an uncontrolled re-entry trajectory in the first place."

Given that the owners lost control of it and presuming this wasn't intended, "allowed" doesn't seem relevant. The situation is what it is, not what it ought to be.

Open source community crams itself into big tent

I wonder how many of the great and good at these dos write code themselves. I see Linus wasn't quoted.

UK data watchdog's inaugural tech strategy was written with... *drumroll* Word 2010

Re: Really?

"I really, really hope that English isn't K's first language."

I was wondering what word processor they were using. Probably one with rickety bearings and a few bits broken off.

Boffins discover chemistry that could have produced building blocks of life in space

Re: Very old news

"basic proteins required for DNA"

DNA is built from nucleotides, not proteins.

Re: Oh, the hyperbole

"Earliest forms of life on Earth had very little to do with oxygen, IIRC."

The organic compounds which living organisms are built of do contain oxygen. What the earliest forms didn't do was use molecular oxygen as part of their energy systems until, as you say, the blue-greens evolved photosynthesis which produced it as a by-product.

"After these molecules build up on PAHs like pyrene, if they’re exposed to ionizing radiation it can fire up another series of reactions to create amino acids, peptides and sugars."

Can this process produce the chiral asymmetry of these compounds that we see in biology?

Miner vs miner: Attack script seeks out and destroys competing currency crafters

"It seems as if it is the taste of things to come."

OTOH it seems like the sort of script for the user to run periodically. It would just need to be kept up to date.

Swiss see Telly Tax as a Big Plus, vote against scrapping it

Re: Short term vs long term

"One example is the BBC scrapping their weather website for the utter dumbed down crap run by a third party."

Cough. https://www.metoffice.gov.uk/

BOFH: Honourable misconduct

Re: who would play BOFH and PFY?

"Boss: Stephen Fry"

Given the rate at which Bosses are introduced to rolls of carpet and quicklime this would need to be a series of guest appearances.

Re: I think I even have a script for that.

"No unsolicited scripts. What a surprise."

Now think what the BOFH would do in that situation. He'd tell a Brit commissioning editor that Netflix were interested but taking their time and there was a small window of opportunity if the editor could make up their mind before the pubs open.

Knock, knock. Whois there? Get ready for anonymized email addresses after domain privacy shake-up

Re: fob off comlaints

"So how does normal people with a complaint about a website or something on it trace the owner ?"

Through the registrar and/or the hosting company. However, to get them to take notice the matter would have to be illegal in which case the police could take it up or contrary to the registrar or hosting co's T&Cs. In the latter case you'd almost certainly also need to be lawyered up to have an effect.

"Clicked their link to view the changes, and got asked for personal details (with no apparent way to skip), so I'd not (until now) seen what the cretins were planning on doing."

Are they keeping that running until after GDPR becomes operational? AFAICS that will be a breach in its own right.

Re: So UK addresses require UK residency?

"Can't speak for .org.uk though."

My registrar seems to think either applies. I'm not sure what happens if .co and .org have different owners. I have a .org and the corresponding .co is owned by a completely unrelated business. However, if they want the .uk they're welcome.

"not-quite-global businesses would be having you declare that you are not an EU resident and make it a condition to let them know if you become one (possibly causing a termination of your business relationship). "

I think such weaseling behaviour would increase the fines.

"Am I still covered by GDPR even though the address is in the states and I am in Europe"

The GDPR protects the personal data of people resident in the EU to the answer would appear to be "yes".

Re: I'm all for it

So at what point are you a real web publisher who should a public address and "just a individual website" ?

There are quite a few issues wrapped up in that.

If you are an individual registering a domain you will be entitled to keep your details confidential. You're not obliged to do so.

If you register your site for commercial purposes you lose the entitlement. That would, AFAICS, include operating as a sole trader. On the whole you'd probably not want to hide your identity unless you're a cowboy; regular traders want people to contact them.

If you're operating a business as a Ltd company you'd register under the company name and the registered address would be the appropriate address to use. However Companies House would register the names and addresses of the officers of the company (director, company sec etc) although the addresses given are often enough the registered company address. Even if you want to keep your identity confidential you can't if you're an officer of the company; it has to be on the company returns, those are public as a matter of law and as such they're excluded from any protection GDPR provides.

Re: So UK addresses require UK residency?

"Perhaps now is not the time to tell someone that I own a second-level .uk address"

If you're setting up something like example.uk there's supposed to be a UK residency requirement. Presumably it's up to the registrar to check. example.co.uk wouldn't need residency. Ownership of example.co.uk would give you preference in gaining example.uk if you wanted that as well.

Maybe you owned the .co.uk or .org.uk version and then gained the .uk on those grounds and nobody thought to check?

"How would icann know to hide the information?"

You wouldn't be dealing with ICANN, you'd be dealing with a registrar. It's up to the registrars as to whether they hide everyone's data by default but if they restrict that to the EU the address you give should be a big clue.

Re: I'm all for it

"Can companies and publishers decide that it is outragous that the address of the manufacturer of something you bought be available to you or the address of a newspaper office be available to complaints"

This has nothing to do with addresses of manufacturers or newspapers. It's to do with personal information, the addresses of individual people who have their own domain, that's all.

UK peers: Is this what you call governance of facial recog tech? A 'few scattered papers'!

"Private companies cannot arrest me and throw me in jail by mistake."

They may not be able to throw you in jail but google kingdom litter fines and wonder what might happen if that lot got hold of the technology.

Fear that you can be wrongly recognised by the mostly shite low quality cctv available in the UK.

FTFY

Another day, another meeting, another £191bn down the pan

Re: "all a meeting achieves is a mass downing of tools"

The Managers solution? 4 "Progress" meetings a day, designed to distract your train of thought and waste 2 hours a day.

At the first meeting ask (bulldoze your way into the talk if necessary) "Do you want me to stay in this meeting or do you want me to get the job done? Yes or no."