Posts by Doctor Syntax

Crypto-gurus: Which idiots told the FBI that Feds-only backdoors in encryption are possible?

Re: Anyone want to make a lot of money?

"With sufficient funds, we could subcontract the job to GCHQ and let them get into systems using more conventional, but tried and tested methods, such as social engineering."

That wouldn't work because it's not what the numpties in government want. It's something they have already. What they want is something new and magical that doesn't take any effort to apply. GCHQ know as well as anyone that a load of bollocks that is.

The answer, as ever, lies with Sir Humphrey's explanations to Hacker that seeing money being spent means that everyone's happy because something's being seen to be done. So, just let out a contract to develop this magic with GCHQ, maybe in conjunction with some independent experts, being the arbiters of whether it works without any risks.

That way, with some utterly rudderless guidance from themselves, HMG can persuade themselves that they're setting out to achieve this goal and maybe keep quiet about it - and even quieter about the ultimate failure. For good measure perhaps IDS can be put in charge; he has just the right track record for it.

Stop calling, stop calling... ICO goes gaga after home improvement biz ignores warnings

Re: Bigger teeth

"They'll just start the next one in the name of their wife/boyfriend/dog."

That really is serious territory. I think it carries the risk of jail time.

"The ICO and insolvency service need more powers to not only veto liquidiation of such companies but also to ensure company directors are prevented from phoenixing anything."

ITYF the insolvency service has those powers.

Also, it's about time that directors were tried directly. I'm pretty sure that while a Ltd company limits shareholders risk it doesn't shield against criminal behaviour.

While Western Union wired customers' money, hackers transferred their personal deets

Re: Blaming 3rd party data storage. Which vendor could it be?

"Sure, you have reduced your risk of IT hardware failure"

You've introduced a new one: the comms between yourself and the provider(s).

So host it locally, administered by recent graduates paid $24k PA? by administrators who know their jobs and their colleagues jobs depend on its security.

A business's data is its life-blood. Guard it accordingly. If that means paying an appropriate salary, pay it.

"Times have changed"

You say that as if it's a good thing. Evidence says not.

Repeat after me: "It isn't a cloud, it's someone else's computer that you don't control".

Roses are red, are you single, we wonder? 'Cos this moth-brain AI can read your phone number

Re: Y'think we're stretching this Valentine's date thing too far?

Yes.

IBM declares it's the 'backbone of the world's economy'

"in a start-of-year team-building video"

That explains it. These team-building things are always an excuse to insult the employees' intelligence. Either that or an embarrassing display of senior management's intelligence.

Roses are red, revenge is so sweet. Microsoft extracts a few quid from Corel Office Suite

Re: Well...

"Especially since it looks the main reason to introduce the Ribbon was exactly to have a patented UI"

After they got forced into the corner of having to use open (sort of) standards for file formats they needed some other approach to lock in users. This was it.

You'd think Microsoft never bothered to adopt standard interfaces. Or perhaps they think they invented CUA back in the day when they decided that confusing users with the unfamiliar wasn't a good idea.

We already give up our privacy to use phones, why not with cars too?

"Some see big opportunities in making connected cars work like smartphones, in particular targeted advertising."

Has the use of ad-blockers taught them nothing?

Six things I learned from using the iPad Pro for Real Work™

"To be honest, 1024 x 768 – the iPad's original resolution at launch – would have sufficed for browsing, email, writing, and IM. "

A frequent complaint of commentards is that wide-screen laptops don't cut it. When you actually pin down the cause of the complaint it's nothing to do with the aspect ratio; it's that they're only 1080 vertical resolution. For actual work - and by that I think they mean writing as many other tasks and applications benefit from a wide screen - they want 1600 minimum. So I don't think your contention that 1024 x 768 would find much favour there.

Rogue IT admin goes off the rails, shuts down Canadian train switches

Re: I said bye to an employee recently

"You were deputising for a day and fired someone?"

He didn't actually write that unless "saying bye" was a euphemism. People leave without being fired and managers, even deputising managers may even say goodbye to them.

"Bollocks"

Which post were you referring to? Without quoting what you think is bollocks your post becomes self-describing.

Despite the headlines, Rudd's online terror takedown tool is only part of the solution

"He said that the biz had balanced false positives with performance to tune the algorithm to be able to detect 94 per cent of Daesh propaganda with a 99.995 per cent accuracy."

Did you ask him what he meant by this? AFAICS if it correctly detects 94% of videos it's 94% accurate. What, then, if anything, is this 99.995% figure? Unless he has a sensible explanation for this then I wouldn't trust any figure he provides. It's simply marketing gobbledgook and deserves to be treated an the same way as any other garbage spewed by marketing mouthpieces.

Yes, Assange, we'll still nick you for skipping bail, rules court

Re: Good.

"Skipping bail does not excuse you from going to jail for skipping bail just because the original offence that you've been placed on bail for has gone away."

Which, with all appropriate detail, is what the court said. It's amazing how many commentards, mostly anon (is that you, Julian) fail to grasp that.

Re: Great news

"I'm pretty sure that's not in the sentencing guidelines for bail-jumping."

Maybe Jove misread it. These sans-serif fonts can be tricky.

Re: Sheltering Criminals.

He's granted political asylum. It pleases Ecuador - or at least it did at the time - to believe his claims. In general asylum overrides criminal charges. One option available to Ecuador would be to review his case, decide it has no merit and chuck him out.

"I think they'll probably go for the maximum"

If he was arrested, charged and pleaded guilty he'd be unlikely to get the maximum. I still think there's scope for a bit of negotiation, "come out, surrender to bail, plead guilty and we'll ask for a suspended sentence if you give an undertaking to leave the country forthwith". And heigh, ho, off to a new life in his new country, Ecuador. They made him a citizen didn't they? Could they revoke that the moment he's out of the door?

Icahn't get right Xerox Fuji merger spoils, cries activist investor Carl

Sadly, it's not all good news: "Fujifilm has already announced that it is sacking 10,000 workers at Fuji-Xerox"

The strange case of the data breach that stayed online for a month

"Nor have we used the names of the companies involved"

So he didn't find it on Google? Maybe it was Bing.

UK Home Sec Amber Rudd unveils extremism blocking tool

Re: Different Configuration

"We need more options/variation."

Such as "Don't ever put this one on a ballot sheet again".

Re: detects 94 per cent of Daesh propaganda with 99.995 per cent accuracy

What does that actually mean? Either it detects something as what it's looking for or it doesn't. If it detects 94% than that's a meaningful figure. But what does "with 99.99f% accuracy" mean? Unless it's a means of saying it has 0.005% false positives - which they could say more explicitly - I can't see that it has any meaning at all. I would instinctively distrust anyone who produces a statement like that. OTOH I suppose there might have been something meaningful that went into the Rudd "I don't really understand it but it went something like this" regurgitation mill.

I wish she and Davis would swap jobs. He seems to have his head screwed on right about the Home Office and its doings while she seems sound on Brexit.

IBM's chief diversity officer knows too much and must be stopped!

Re: Chief Diversity Officer?

" I make sure we don't hire too many straight white men."

At IBM her role is probably the converse: "I make sure we're not firing too few straight white men".

Oracle: We've stuffed automation in 'pretty much' all our services

Re: I read the headline differently

You and me both, Tim. It seems they mean "into", not "in".

Corpse! of! Yahoo! drags! emails! of! the! dead! case! to! US! Supreme! Court!

Re: Deep trust

I'm suspicious of the wording "court-appointed estate administrators" who might not be working in the interests of the heirs.

I'd expect it to mean that the deceased died intestate. In the absence of a Will appointing executors there'd need to be a court order to appoint them. They should work in the interests of the heirs, indeed, they may be the heirs themselves, but as this seems to be in the US, who knows?

Re: Yahoo mail deceased account

"I wonder why inheritance laws should not apply to such contents as well."

They may well do so. It might require test cases until this is made explicit by statute and vary from jurisdiction to jurisdiction.

Re: Another (sceptical) dinosaur

"Deleting files on most systems merely deletes the address, not the data. .... And what about backups?"

The space is likely to be written over at some point. Backups are a different matter. One hope that the media are eventually recycled.

Re: Yahoo mail deceased account

"Unfortunately, Yahoo cannot provide passwords or allow access to the deceased's account, including account content such as email. At the time of registration, all account holders agree to the Yahoo Terms (TOS). Pursuant to the Terms, neither the Yahoo account nor any of the content therein are transferable, even when the account owner is deceased."

Account holders may agree. Their executors won't have agreed. Are the executors bound by the deceased's agreement? They'd have right of access to other restricted containers (for want of a better word) such as safe deposits; on what basis can Yahoo hold themselves above this right?

Cryakl ransomware antidote released after servers seized

Re: "But but but, Kaspersky is one of Putins goons, in'it?"

"he just isn't very good at assembling words into coherent sentences."

The definition of a sentence I was taught, back in the days of Eng. Lang. O-level was something along the lines of "A sentence expresses a thought.". Hmmmm.

"Kaspersky Lab provided technical expertise to the Belgian authorities."

So if any US govt users got hit they won't be availing themselves of this option because Russians?

UK ICO, USCourts.gov... Thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned

Re: Don't load third-party scripts

@veti.

5. If it's marketing driving this adopt some combination of 1 and 2 and charge the work to their budget.

Re: Don't load third-party scripts

"but they are undeniably good at keeping their jobs and budgets."

They're going to need their budget if the GDPR fines they bring down are charged to it.

Re: Don't load third-party scripts

now you spend your whole life saying "no" to the marketing department.

Definitely a good idea. Every business should appoint someone full time to do just this. Come GDPR time, now only a few months away, they're the ones most likely to bring big fines down on your company.

Re: Don't load third-party scripts

"A lot of use"

Us, dammit. And dammit to the forum saying it's still in the edit window and then refusing to accept the edit.

"Copy the code to your own server and you'll find you've not kept up with updates and you get hacked."

Why are so many updates required (it seems to be a given in a number of comments)? If it's because the code is a bundle of bugs you'd be better off not having it. If it's because of new "features" (did someone say Agile?) then those updates may be adding more vulnerabilities, not removing them.

Re: Don't load third-party scripts

"If the 'purpose' is e.g. a website to advertise a product that will earn your company £50K p.a. you can't afford code audits of JQuery, Ruby or whatever the current flavour of the month is."

If, for want of a proper audit - or reducing the amount of flavour of the month - the consequence is that you end up damaging your would-be customers the loss of reputation, damages and maybe fines is also something you can't afford.

Security may be expensive. Lack of it can cost more.

Re: Don't load third-party scripts

"And then we're all repeatedly taken by surprise when stuff like this happens."

Who's this "we" you're talking about. A lot of use aren't.

"True, but on the other hand, massive amount of work for you making sure your local copies are always up-to-date"

In this case it was the "latest version" that was the problem. You don't need the latest version, you need a good one.

Are you an open-sorcerer or free software warrior? Let us do battle

Re: "But the latest version is incompatible with the one you've got."

"And what's wrong with that?"

Thus speaks the Stockholm Syndrome.

Re: Well... that was vague and woolly

@ Flocke Kroes

There's another aspect to lock in. Our S/W only cost £. But the latest version is incompatible with the one you've got. You want to read the file someone just sent you? That's another £ for the latest version. In a couple of years it'll be another £ when someone else sends you a file.

Re: GPL is not freedom at all.

"GPL fits only Stallman vision that you have to be forced to open source your code, and relinquish any copyright on it."

The GPL depends on copyright. If you relinquish that, say by putting the code in the public domain, you can't apply the GPL.

Meltdown's Linux patches alone add big load to CPUs, and that's just one of four fixes

Re: Patches applied yet?

"I'm not really getting this, any explanations would be welcomed."

It depends on what you're doing. If you're busy typing a document, reading mail or commenting on el Reg there'll be a burst of activity every time you hit a key. The waiting time until you hit the next key will be an age in terms of CPU cycles so that you'll not notice that the brief burst of activity was slightly less brief. Even the time spend dragging the next mail or page from the net doesn't disturb the CPU's peace that much. If you look at the processes running on a modern OS you'll see there's other stuff running beside what you think of as your application but they only typically consume a few % or less.

If you're doing something more compute-intensive, especially something that involves a lot of /IO such as streaming lots of data from the network or disk then you might well see a slow-down. The reason for the I/O effect is that it's the OS that handles the I/O and it's the switches between application and OS kernel that are affected by the mitigation. In there's still some slack time on your CPU you might not notice but you're likely to find the fan running faster because more work is being done and more heat generated. If the extra work is sufficient to push you from having some idle CPU time to being 100% all the time then you'll find the system slowing down somewhat. If your CPU was running flat out before the mitigation you'll find it a lot slower because it's now trying to do the original work plus the extra and the only way it can achieve that is by taking longer.

Re: For procurement...

"In modest size postgresql virtualized servers I see 18% loss."

It would be interesting to see the effects on well tuned examples of different database engines.

Re: For procurement...

"from the same page"

That'll be the page dealing with SPECTRE, not MELTDOWN. You're failing to distinguish between the two and to note that the OP's question was specifically about the latter. That's why you're getting downvoted.

Military techie mangled minicomputer under nose of scary sergeant

"500MB hard drives the size of a clothes dryer, but much louder."

My only experience with Prime was at the end of a few hundred miles of telecoms cable. At that distance they were inaudible.

You can resurrect any deleted GitHub account name. And this is why we have trust issues

"but in this case I did not find any redeeming features worthy of upvote."

Likewise. He did say he didn't necessarily approve but that's not good enough.

Some of us have been around long enough to look at DevOps and realise that that's what we were doing long ago - one team developing, managing the system and supporting our users. We were also aware that what the users were doing was what brought in the money to pay our salaries so not only did we take care to provide what they needed but were also paranoid about protecting the integrity of the data. As we were running systems which weren't internet connected it was second nature to us to keep control of source ourselves. Had the opportunity been given to us to store source elsewhere that sense of responsibility would have precluded it anyway. That's how you build a business to last decades - assuming the manglement doesn't have other ideas.

Re: Source code, source code, source code

"I've been saying for a while that GitHub (and Bitbucket, and GitLab, etc.) are doing open source a disservice, by making the primary route to accessing a project's source code be tied to a particular identity - either that of a single person, or a single organisation."

What do you suggest? A project site has the same issue: somebody has to own the registration of the domain, arrange for hosting, etc. A distributed model without its own domain has the problem of keeping all the copies in sync in the absence of an agreed master.

"As for GitHub permitting a new account to be stood up with a previously used name - terrible."

Agreed. But is there a need to allow the original owner to re-open the account?

Due to Oracle being Oracle, Eclipse holds poll to rename Java EE (No, it won't be Java McJava Face)

"Why not ask James Gosling to choose a name?"

Maybe he'd suggest MeaCulpa.