Posts by Doctor Syntax

'Treat infosec fails like plane crashes' – but hopefully with less death and twisted metal

"there are no lessons to learn."

There's one: it can happen to us.

Fujitsu imagines adjusting your rear view mirror for better hearing

Re: Neat technology, but...

"If there are other people in the car, they *should* be making/receiving the phone call instead of the driver."

If use of the hands-free distracts the driver then listening to one end of the call, telling the passenger what to say or even conversing with the passenger when not on a call is likely to be at least as distracting.

Are they going to turn the interior of the car into an anechoic chamber? The sound is going to bounce round and the passenger will hear it anyway. Or is this intended for extremely noisy cars?

Another toothless wonder? Why the UK.gov's data ethics centre needs clout

At least it's from the Ministry of Fun and not the Home Office. That's a start.

A certain millennial turned 30 recently: Welcome to middle age, Microsoft Excel v2

Re: Smartware

"It included a database application"

The company was bought by Informix for no good reason except that their (Informix's) then management suffered from a lack of BOFH and openable windows in their offices. They did some work to use Informix as a back end. But only as a back end to the spreadsheet.

Back when Excel was introduced Smartware was the king, at leas for the PC users where I worked back then. It was an integrated office suite in the same way that MS Office, OO and LO are but for DOS. It never made it into the Windows era, at least not in any timely fashion.

Linus Torvalds on security: 'Do no harm, don't break users'

"Which would you rather have: a system that doesn't work or can't be trusted?"

It's a false dichotomy. The effort that goes into the break it now fix should go into the fix it properly fix. What I want, and which I expect Linus to provide, because of this approach, is a system that works and can be trusted.

"So why is it right when Linus says effectively the same thing?"

Linus isn't saying the same thing. What he's saying is fix the problem instead of hiding it.

AFAICS what's happening is that the security researchers are sending in patches which will throw an error if a dubious bit of code is hit even if it wouldn't cause a problem in that instance. They're then expecting him to incorporate that code in the kernel tree for the next release.

What he wants is that the code itself is fixed. That can then be backported into older kernel versions* (that, of course, could also be done with the just kill it fix). However the effort that goes into the just kill it patch could either be put into a proper fix by the researcher or, if that's too difficult, into a proper bug report so it can be fixed. Either fix is likely to go into the same kernel release cycle anyway and it's vastly preferable that it's a real fix. If he allowed just kill it fixes in the real fixes are likely to be delayed.

* Linux distributions don't always run the same kernel version. These appeal to different types of user.

Production systems tend to be very conservative with LTS vernel versions and only security fixes made available as kernel updates. Consistency of operation is highly valued.

More adventurous distros exist for those who must have the latest, greatest, coolest toys. These value novelty over consistency and can expect breakages from one release to the next. A release will have the latest kernel available at the time of packaging.

Users who want to test new stuff - equivalent to the Windows Insider Fast Ring can either go for a bleeding edge distro or install RC kernels in other distros.

"But even so; any user who cares about the sanctity of their data probably agrees."

What if the crash the system approach leaves the user with corrupt data?

The effort should go into fixing the root problem.

"What do you do when you biggest issue is PEBCAK?"

The kernel hardening approach would seem to be switching off the computer and removing the keyboard. And maybe the chair.

"I'm not sure what you take from the article but maybe you should read the previous article as well to get some understanding."

Even better, go and read the actual post.

Stick to the script, kiddies: Some dos and don'ts for the workplace

Re: Issue with Scripts

"The real issue is not scripts but a lack of a proper life cycle including a rudimentary spec (why are you doing this), peer review, testing, version control, and documentation."

You say that as if they're good things - which they are, of course, as is repeatability. Because, as you say, scripts are small programs these can be applied and more easily than into manual operations; even if the latter are written down in your ops manual as an - errrm - script you still rely on the operator following them.

Re: I'm technically under a NDA

"It's not Friday....I don't need mental images like that in my head!"

You do on Fridays?

Re: Really useful article.

"Haven't you been following the whole systemd debate?"

What did you think my comment was about?

Re: Do not run with scissors

"Scripts can be useful, but be careful with them."

Be even more careful just going in there and hacking it by hand.

You should not be relying on them for everyday tasks, or even "every year" tasks, because you're just opening yourself up to problems.

This is just what you should be using them for. As you say, you can get them ratified, check into the source code revision system of your choice or whatever in order to have a repeatable set of operations on which you can rely. For rarely performed operations this is even more important than daily ones.

Effectively you are then doing software development, whether you're a tiny one-man operation or a huge multi-national, and the same standards as you'd expect a software developer to use should apply - testing, verification, dummy-runs, early bail-outs, stop on every error, etc.

Yes. Why would you fly by the seat of your pants doing operations manually when you have this option?

Re: Something missing?

I would also suggest that the differences between scripting an operation and performing it manually is little different from performing it "manually" (on a computer) and actually doing the operations in person.

1. It can be reviewed by yourself and others. That way it can be checked for errors, including typos such as rm -rf ~fred /*

2. It's repeatable. If you have a saved script that was successfully yesterday you know it will perform exactly the same operations today and tomorrow which you might not do yourself if sitting there thinking "Now what did I do next?".

Re: Really useful article.

"For the rest of us, I suspect this is bread and butter stuff."

That's what I thought until I realised it was aimed at Windows admins. However I suspect Linux could be going that way; how else does one explain init scripts as being too difficult?

Sci-Hub domains inactive following court order

Re: re: I think the advantage is supposed to be ...

"That's no different to saying that thieves operate a better service than the original manufacturers."

The journals get their material written for free, edited for free and refereed for free. Then they sell it back to the sorts of people who wrote, edited and refereed it and, they hope, will write, edit and referee the next issue.

I'm finding it difficult to decide just where to place the idea of theft here, especially when I see JStor charging for access to stuff I wrote for a very cheaply produced and distributed publication.

'Data is the new oil': F-Secure man on cartels, disinformation and IoT

"IoT is not about users wanting internet access on appliances," Hypponen said, "it's about vendors wanting to connect them to the internet so that they can collect data."

Now tell us something we didn't know.

Mythical broadband speeds to plummet in crackdown on ISP ads

"traffic shaping at peak times"

And that their peak times extend from something like 2am to 1am?

Re: About time....

"have shared storage"

Genuine question...what's that got to do with a router?

It's something a lot of routers offer these days - stick a USB socket on the side of the router and let the punters plug a thumb drive into it and it appears on the network. The good news is you don't have to use it.

Re: Well...

"A better guide would be a table"

Too complicated for those who just want to look at a single number. How would the likes of Amber choose their ISP?

Re: Use median speeds instead

Silly idea of course, because the adslingers would have to understand what "median" means in the first place

And so would prospective customers.

'Gimme Gimme Gimme' Easter egg in man breaks automated tests at 00:30

Re: Obviously "gimme gimme gimme" refers to the Swedish pop band ABBA's hit

"Thanks for explaining the reference - I wouldn't have had a clue."

Even with the explanation I still don't find my life enriched by it.

Re: Unprofessional bollocks

"Adding unnecessary code is highly unprofessional."

Somebody had to say it: systemd.

Re: Aww, Linux only...

"on FreeBSD is only a shell script."

And if a shell script is all it needs to be that's all it should be. Leave the bloat to Windows.

"removing the easter egg altogether is unwarranted"

Its presence caused an error when another change was made. What other errors could it cause in the future? That seems a good reason to remove it. It's maybe not a huge increase in the attack area in comparison with other things but it's there.

Permissionless data slurping: Why Google's latest bombshell matters

Re: So, if I want the benefits of a smartphone, without the (opaque) slurping....

"My Google Nexus 5X is pretty much everything. It''s my plane ticket, train ticket, bus ticket, tram ticket, taxi ride and method of paying for most transactions < £30 (and many other things)."

Looks on with sympathy - but not much.

Re: Not GDPR relevent

"it's not about data protection."

It looks very much like a data protection issue to me.

Re: Are we surprised?

'possibly with a "no" answer binning you out'

That will be a big no-no under GDPR.

"This entirely changes the terms of that human-machine relationship."

It's not a human-machine relationship, it's a human-corporation relationship. By casting it in terms of the machine you're allowing Google to distance itself a little.

To fix Intel's firmware fiasco, wait for Christmas Eve or 2018

Re: I wonder about motherboards

"You looked at a software licence recently?"

But the CPU is sold as hardware.

Microsoft scoops Search UI out from the gaping black maw of Cortana

Re: Bring Back Windows XP Search

"select whether you want to search inside files or not, and where to start searching from etc., with a very good UI."

Like this: https://www.kde.org/applications/utilities/kfind/ ?

Possible cut to British F-35 order considered before Parliament

Please sir, can we have our Harriers back?

Apple quietly wheels out 'Voxelnet' driverless car tech paper

"A voxel is a point on a 3D grid."

It's actually a small volume, not an actual point, just as a pixel is an area on your screen. https://en.wikipedia.org/wiki/Voxel

Hence the description: "a group of points within each voxel" (my emphasis).

OTOH what's a "trainable deep architecture"? It sounds like a ventilation shaft above a railway tunnel.

London mayor: Self-driving cars? Not without jacked-up taxes, you don't!

Re: So..

"Yes, I know most people refer to VED as Road Tax, but that doesn't mean it is."

Shhh. HMG don't wish people to know that. They want them to go on thinking that VED is spent on roads and NI on health and social services. If people didn't believe that they'd have to start thinking about a transparent taxation system.

Re: Khan being an idiot on this one

"a moronic reason to continue supporting fossil fuel burning ICEs."

Remember that the EVs will simply move the fossil fuel burning to power stations. That's probably OK with Kahn; they're not in his manor.

"Or alternatively, they could, you know, just stop maintaining the roads."

If motoring taxes were actually spent on roads we'd have superb roads. Taxes are taken from road users but not spent on roads.

They give with one, then take with the other both.

Re: What about the downsides?

"not taxes for taxes' sake but specifically to fund road improvements and maintenance"

We've been here before. There used to be the Road Fund. Then it was morphed into the VED, sucked into the Treasury and the roads see less and less of it. In part new roads and bridges which the Road Fund should have financed have instead been built on a toll basis, taking us back to the late C17th.

Impose a new tax to fund road improvements and you'll see (a) even less Treasury funding for roads and (b) the Treasury getting its hands on the new tax.

Linus Torvalds 'sorry' for swearing, blames popularity of Linux itself

Re: Linus' viewpoint on security

Thanks for that link, Richard. I think there are quite a few commentards who really should read and reflect on that.

'Urgent data corruption issue' destroys filesystems in Linux 4.14

Re: Slackware-current ...

"Or you can just bitch about those of us who do, if that makes you feel good about yourself."

I didn't see any bitching, just a reminder to use the appropriate distro for the task in hand. Running a bleeding edge distro is a bit like running Windows Insider.

Re: That's open source or you...

El Reg, please provide a broken record icon. J J Carter needs it.

Cops jam a warrant into Apple to make it cough up Texas mass killer's iPhone, iCloud files

"How much of an effort should Apple expend if they're forced to walk the plank?"

If pushed enough they might just walk; de-list from the US stock exchange and go to live with their money on some island that has a climate to match California's.

Level 5 driverless cars by 2021 can be done, say Brit industry folk

Re: Lab rats, the lot of you

"Your government is using you as lab rats. They want to find out how many fatal traffic accidents by autonomous cars you are willing to tolerate."

Either that or the AV industry is using the government as lab rats to find out how many fatal traffic accidents bring down a government.

"complete with its flaws and vulnerabilities."

With the added characteristic of being repeatable.

"There are actually special satnavs for trucks that know all about restrictions."

I'm not sure how effective they are.

Most if not all the routing websites seem to know that the junction at the bottom of my road is too sharp a right turn for an HVG so will advise me to turn left and then turn back to avoid that. Because they don't ask what sort of vehicle I'm in I assume that they're taking restrictions into account when they know about the,

But the same websites have traffic cross over the route I'd normally drive out to to pick up the motorway and direct them down a twisty set of lanes from which the larger vehicles have had to be rescued. So I'd guess in that case that the navigational databases are sharing data which doesn't mark this as a bad route for HGVs.

Re: Exactly...

"Will also pretty much dispense with the need for a personal vehicle since you just 'call' one on demand"

You can call and call but if you're calling at peak times you might have to wait a couple of hours.

Iran the numbers – and Persian internet is the cheapest in the world

Re: Chin up mate.

"At the moment the intellectual pygmies of Westminster are trailing through the newspapers the idea of paying the EU €40bn for the privilege of the Germans being able to sell their cars to us."

I thought it was the other way round. If not all those car workers in Sunderland, Derby and Swindon are going to have a nasty shock when they found out what they actually voted for.