Posts by Doctor Syntax

Boss put chocolate cake on aircon controller, to stop people using it

Re: It's not just cake which can annoy the real folk.

"piece and quiet"

Dammit. I'm having a bad weak with my tiepin.

Re: It's not just cake which can annoy the real folk.

"a small pair of wire cutters"

One former colleague who preferred piece and quiet in pubs was known to carry a pair of wire cutters in her handbag.

Re: The first I have ever said this

"Cake is not the solution"

Of course it is. What's the problem?

BOFH: Do I smell burning toes, I mean burning toast?

Nice false ending in the middle.

NHS could have 'fended off' WannaCry by taking 'simple steps' – report

Re: Easy to mitigate

"oh the system supplier wont allow you to citing that their system is a medical device, not a computer system"

Which makes a big difference because it carries certifications against it in its original state and it costs time and money to recertify it in its patched state. It's time that whole arrangement was looked at again. Should certification lapse after some interval unless equipment has up-to-date patches?

NSA bloke used backdoored MS Office key-gen, exposed secret exploits – Kaspersky

Re: "How are they going to guarantee that every single copy is correctly configured"

"This is the NSA we're talking about."

This is some NSA staffer's home computer, not a work computer. Given what he seems to have been up to I doubt he'd venture to ask a grown up.

It's entertaining to imagine to conversation though:

"I have a machine at home. I want to install a cracked pirated version of MS Office on it an also play about with some of our own software on it. How do I secure it?"

"Just come with me to the security office."

Re: The mere fact Kaspersky can provide such a detailed account

"They know the timeline of everything he was doing with his computer, and with the DEFAULT SETTINGS downloaded the NSA's treasure trove (the presence of which on his computer is on the NSA guy and the NSA itself)"

Could you point out to me just where this timeline or everything is mentioned? All I can see are a few dates when the AV was run and found malware. In fact they specifically say that they don't know when some things happened because the AV was turned off? They also say that an archive containing samples of suspicious material was sent back. This is what AV systems need to do to get early detection of new variants. Given that a supposed security pro dumb enough to get infected didn't turn the default off what chances are there that there'd be enough community-minded folk dumb enough to be infected would turn the early warning system on if it was defaulted to off?

Re: perhaps I'm just paranoid?

"Doesn't mean that you're wrong, though."

Nor that they're not out to get him.

"No. It's a bunch of non-executable letters. Source code."

From TFA (my emphasis):

"The archive itself was detected as malicious and submitted to Kaspersky Lab for analysis, where it was processed by one of the analysts. Upon processing, the archive was found to contain multiple malware samples and source code for what appeared to be Equation malware."

I read this as indicating that the archive contained both binaries and source and that it was the binaries that triggered the detection and subsequent upload of the entire archive. No need for the AV to have recognised the source.

Sour grapes

Kaspersky AV acted just like malware detection systems are intended to. This wasn't just malware, it was NSA malware. It sounds like a pretty good recommendation for anyone in the market.

If, like the NSA, you're in the business of producing malware you should expect malware detection businesses to be looking out for your work.

Re: Wait a minute

"An NSA employee with access to highly classified information is STUPID enough to run a crack? And disabled his AV to enable it to run?"

It's a conspiracy versus cock-up moment. Was he really that stupid or was this a sting operation with some chickenfeed to justify blacklisting Kaspersky?

"How is Kaspersky recognizing NSA source code anyway?"

It's malware. Detecting malware is what Kaspersky does for a living. Why would you expect them not to detect it?

So long – and thanks for all the phish

"This Temperature Check of 330 IT professionals"

Trying to find out if the bodies were still warm?

EU law bods closer to baking new 'cookie law' after battle

How about a compromise. You can put cookies on the browser providing you pay storage charges?

Even more warship cuts floated for the Royal Navy

Re: Not sure what the UK could do about it.

"If you poled the entire UK then 90% would be against Scottish or N. Irish independence - doesn't mean the country is totally united"

I'm not convinced by that. I think if the Scottish independence vote had been UK wide it might well have been Yes that won.

The launch

I name this rowing boat...

UK.gov: Use police body cams to grill suspects at scene of crime

"their abilities to change the behaviour of cops and people has been repeatedly called into question"

I don't see changing behaviour as being the essential function. I'd regard them as being a source of evidence of what the behaviour actually was. Of course evidence means the expensive business of putting together and presenting a court case. If someone was wanting them to change behaviour they were just trying to save money. It looks as if they still are.

HMRC boss defends shift to AWS, says they got 50% knocked off

Re: in the lowest tax jurisdiction

Creative accounting defines where you accrue the profit, not where you do the work.

creative accounting still makes sure that no profits are generated in the lowest tax jurisdiction

And that's perfectly proper if govts. let that situation arise.

Re: Why the negativity?

"Why on earth do HMRC have to defend anything?"

Data sovereignty.

Re: Of course not

"They can fine Microsoft all they want, but it's no longer physically possible without approval from a local data custodian in Ireland."

Is this actually the case? The only thing I've read on these lines is about this arrangement being put in place in relation to the new DC in Germany. It's possible they've rolled this out elsewhere and I've missed it.

Re: tax dodging

"And thank God none of them have anything to do with running the country."

Thanks withheld. They did enough damage when they were running the country.

"He said the data would be held in the UK and would not be shared with the US."

Wrong verb. It should have been "could not be shared". And I'd have liked then to have asked what due diligence he'd done to verify this.

The UK's super duper 1,000mph car is being tested in Cornwall

"Also, to qualify for these speed records, the same vehicle is required to perform the journey in reverse within an hour. It's possible this may present a few problems for your Corolla."

A big spring at the bottom. A VERY big spring.

Re: Beware break failure.

That joke would have worked much better if you'd have spelled "brake" correctly

Dammit. Have an upvote.

Re: Love them

"The land-speed record hasn't been held by a wheel-driven vehicle since the 1960s."

No, they've all been low-flying aircraft records since then. That's low as in zero altitude.

What is the current record for a wheel-driven vehicle?

Beware break failure.

Cornwall, Devon and half of Somerset.

Smart? Don't ThinQ so! Hacked robo-vacuum could spy on your home

"manager of smart development team"

A really smart development team would have sorted this out before shipping products.

Hop on, Average Rabbit: Latest extortionware menace flopped

Flopp bunnie?

Maybe potential marks are finally starting to realise how to take care of themselves.

WhatsApp? You still don't get EU privacy laws, that's WhatsApp

Re: Helpful tips to make the above concept better welcome.

"Unfortunately not using them is not always possible, unless you want to cut yourself off from people and so on."

No problem with cutting myself off from people who do use them.

Re: If they don't toe the line

"Could they (and by implication) and Facebook be closed down in Europe?"

Just wait until next May and then issue the fines.

BTW, can it be one fine for the whole EU or one for each country in which they operate?

Re: Interesting

"At least when you give companies money directly they have some incentive not to totally screw you."

It's an incentive far too many choose to ignore.

Slowly, slowly

"The group first raised its concerns last year after WhatsApp updated its small print. In November 2016"

That's right. They're on the hook. Keep playing them slowly until next May. Then go for the 4%.

Dell forgot to renew PC data recovery domain, so a squatter bought it

Re: How do domain names expire?

"it should always go to [e-mail] which is aliased at the main server to whoever's employed to handle it."

1. Assumes that company policy allows names to be set up in this way.

2. Assumes someone is (still) employed to handle it.

BigCos, especially BigCos intent on becoming LittleCos (tto many of them these days) can be their own worst enemies.

"the management school of thought arising from not reading the book"

ISTM that reading the book instead of thinking is the problem.

Oracle ZFS man calls for Big Red to let filesystem upstream into Linux

Is ZFS shipped by Oracle in their Nonstop Linux? If so either Stallman's concerns don't apply or they do in which case Oracle would be obliged to release it under GPL2 anyway.

"May I suggest Debian GNU/kFreeBSD https://www.debian.org/ports/kfreebsd-gnu/ ?"

Unfortunately see also: https://lists.debian.org/debian-devel-announce/2014/11/msg00005.html

"We discussed kfreebsd at length, but are not satisfied that a release with Jessie will be of sufficient quality. We are dropping it as an official release architecture, though we do hope that the porters will be able to make a simultaneous unofficial release."

Humble civil servant: Name public electric car chargers after me

"the bill will, if passed into law in its current form, make insurance companies liable for driverless car crashes – unless the driver is uninsured"

What driver? It's a driverless car.

Panic of Panama Papers-style revelations follows Bermuda law firm hack

"News of the breach of Appleby follows nearly 18 months after the release of the so-called Panama papers"

So they had an opportunity to look and learn but didn't.

Experience is a dear teacher but there are those who will learn by no other.

International data watchdogs: Websites don't tell you who sees your privates

"Then again, almost no one reads EULAs or other T&Cs"

As I understand it GDPR is going to require much greater clarity. I don't think they'll get away indefinitely with claiming this gives informed consent.

Fines for crossing roads while TXTing enacted in Honolulu

Re: Need in UK

"take on pedestrian rules"

Fine, providing they get off and push the cycle.

Re: Need in UK

"yes, regularly, aside from the above examples the police regularly do it to red light jumping twats at regent's park"

Good. What I'd like round here would be prosecutions for causing obstruction.

However things might be improving; I actually saw one yesterday keeping to the cycle lane.

Re: Need in UK

"motorists who flaunt them"

Downvoted. You used the term more than once so it's not a simple typo.

Other common errors:

Stationery/Stationary

Principle/Principal

Have/Of

What if you're crossing the road, looking where you're going but someone in front of you is actually holding their gadget with its screen facing you?

Oracle users meet behind closed doors: Psst – any licensing tips?

Re: "the murky world of licensing and software asset management"

"I prefer per person OR per server (per Core/vCore) "

How about per connection?

The meeting reception desk should be interesting. Checking attendees from lists of pseudonyms and handing out redacted name badges.

Please activate the anti-ransomware protection in your Windows 10 Fall Creators Update PC. Ta

Re: Great feature!

"No. You are the kind of doofus that the feature is designed to obstruct."

Whoosh!

UK financial regulator confirms it is probing Equifax mega-breach

Re: What Exactly Was The Breach ???

Not everything - there is a "legitimate interest" exception.

Nevertheless it raises a number of issues. If, under legitimate interest a data subject's bank passes data to a CRA who then gets breached what are the responsibilities of the bank? If it were they and not the CRA who had been breached then clearly they could expect to be fined under GDPR. But they decided they had a legitimate interest in passing on the data. Should they not still be liable?

The data subject-facing business should remain liable under both civil and criminal law for any breaches further along the line, irrespective of how far the data gets passed. Apart from anything else it's the only way that the likes of Safe Harbour and Privacy Figleaf can be made to work. They should have to make judgements about the reliability of those to whom they pass data. It's not sufficient for data subjects to have to go to law in some other jurisdiction against a company with whom they have had no dealings although that should not preclude action under GDPR against all businesses in the chain.

"we welcome this opportunity to learn the lessons from this criminal cyber-attack in order for all businesses to better protect consumers in the future."

There seems to be an implicit message that this was a big mystery. How on Earth did such a thing happen?

They know perfectly well. They left themselves unsecured. They shouldn't have needed to learn anything. They should have kept on top of securing things. The only way they'll really learn anything is to be handled penalties by every regulator in sight to the point where they can't pay management salaries let alone bonuses.

What's HPE Next? Now it's unemployment for 'thousands' of staff

"take upper management on holiday for a week?"

Take them on holiday for a week to somewhere where communications and transport are non-existent and leave them there.