The Register Home Page

* Posts by Doctor Syntax

42414 publicly visible posts • joined 16 Jun 2014

Page:

Ad-filtering fiend Eyeo: Morning has broken, like the first morning

Doctor Syntax Silver badge

"the ad industry has got serious about removing the worst excesses of ad design."

I haven't seen any evidence of that but then I wouldn't - I'm running an ad blocker

But whatever the responsible end of the ad industry* does the ad delivery channel is also a channel for delivering malware so the need to keep blocking as a basic security measure isn't going to go away that easily.

* A quiet and lonely place, I suspect.

Today is your last chance to pick up a piece of channel history

Doctor Syntax Silver badge

Re: "Misco is synonymous with glamour."

Journo needs to get out more.

Dawn of The Planet of the Phablets in 2019 will see off smartphones

Doctor Syntax Silver badge

"by the time it comes around and their predictions don't pan out, everyone will have forgotten they said it."

However I do wish journalists would ask them for their predictions from a couple of years ago and the outcomes. Or simply dig the figures out for themselves if when IDCarnter don't respond.

Doctor Syntax Silver badge

Re: IDC?

Could IDC share a few comparisons between predictions from a couple of years ago and the eventual outcomes?

Hey girl, what's that behind your Windows task bar? Looks like a hidden crypto-miner...

Doctor Syntax Silver badge

"We pay nothing for no-script"

Be a good A/C and give them a donation now and again.

Doctor Syntax Silver badge

Re: 'If malvertising wasn’t bad enough as is'

"Speculators made millionaires of a lot of wannacry extortionists and hacker scumbags etc this month."

Until that bubble bursts.

Doctor Syntax Silver badge

Re: Finally, a reason to move the task bar

Just set the task bar to autohide.

Doctor Syntax Silver badge

Re: Because you can't be arsed

"why would anyone take time out to find a way to secretly run it on a unix box"

It's written in Javascript so no effort at all is needed to make it run on a Unix box. The browser provides the platform. Pop-under windows are also a feature of the browser so what works on the browser on one OS is going to work on another.

Noscript is your friend.

Night before Xmas and all through American Airlines, not a pilot was flying, thanks to this bug

Doctor Syntax Silver badge

Re: Or, as we would say in English ..

"They didn't give us the chance to screw even more money out of the company."

The company probably wanted sorted out for this Christmas, not the year after next.

Hacked Brit shipping giant Clarksons: A person may release some of our data today

Doctor Syntax Silver badge

The announcement notes the firm is "working with the police in relation to this incident".

No mention of having reported it to the ICO - or have they emailed them a copy of their PDF?

Why does no one want to invest in full fibre broadband, wails UK.gov

Doctor Syntax Silver badge

"when it comes to supermarkets you do have the choice of driving further to get to the type of supermarket you want."

There are still premises who don't get any options beyond ADSL. Should they continue to lose out because someone else, who already has FTTC, wants something better still?

Doctor Syntax Silver badge

"I hear what you are saying, but it would be preferable if more consumers could make the choice to take a better service, rather than be stuck on the minimum possible the telco can get away with providing."

I hear what you say. But would these customers who want to make the choice be prepared to pay the full price on their own. And would they still want it when they found what that would cost? And what about those customers who don't have the choice of FTTC because the backbone for that isn't complete? Should they still stay on ADSL because resources have been diverted into FTTP?

Canadian! fella! admits! hacking! Gmail! inboxes! amid! Yahoo! megahack!

Doctor Syntax Silver badge

Re: why don't we:

We won't generally go on the record and clearly state that "yes" we're prepared to make things easier for terrorists, paedophiles and assorted other nefarious characters.

It certainly isn't the binary alternative you present.

A backdoor is a backdoor for anyone who comes past to try turning its handle and they're not all good guys. Introduce a backdoor to aid law enforcement and you're also aiding some of those nefarious characters as well. Was that what you wanted?

Another factor is that a society that believes in freedom under the law has got to build on elements such as due process and presumption of innocence. Backdoors are antithetical to these.

And, for the record, I spent a good proportion of my working life in a job gathering evidence to prosecute, terrorists, sex offenders and other nefarious characters. One thing that I take away from that is a strong belief in due process of law and the presumption of innocence. Terrorists would remove those if they got their way so why should we give in to them by removing them ourselves?

GCSE compsci kids' work may not count after solutions leaked online

Doctor Syntax Silver badge

They began teaching the course in Sep last year, the assessments began in Sep this year and they have a consultation which is still running? Perhaps their scheduling's a bit out for the consultation. OTOH I suppose does have a hint of IT reality about it.

However, if the consultation wants an idea to deal with the situation here's one. Halve the contribution to the total marks for each copy found online.

Doctor Syntax Silver badge

"I was a first year Biology undergraduate and we were set the task of writing a BASIC program to do some statistical analysis."

You were denied the pleasure of watching mechanical calculators in operation doing the same thing. A Marchant calculator performing division could actually walk along the bench. I keep hoping to find one in an antique shop.

Judge stalls Uber trade-secret theft trial after learning upstart 'ran a trade-secret stealing op'

Doctor Syntax Silver badge

Re: "Stealing trade secrets"?

"surely the onus is on you to keep it from being stolen."

And to that end you would place employees privy to the secret under contract terms not to disclose it. If - and I'm not saying this happened in any particular instance - a rival bribed such an employee to disclose the secrets I'm sure there'll be various statutory offences covering this in most jurisdictions.

A more interesting point is "stealing". Normally theft involves taking something with the intent of permanently depriving the owner of it and simply copying it fails on the deprivation part. But if something is a secret taking a copy means it's no longer secret so there has been deprivation; maybe theft really applies in such a case.

Doctor Syntax Silver badge

I suppose they've got a spare ex-CEO they can throw under the bus taxi when things turn really nasty. And no shortage of taxis to throw him under.

Pro tip: You can log into macOS High Sierra as root with no password

Doctor Syntax Silver badge

"It requires physical access so it's not a vulnerability."

To be fair it's not necessarily the worst problem you could have if someone has physical access. But if it's also available remotely as commentards have reported it goes to the top of the class.

Moral - always set a root password - and remember it.

Doctor Syntax Silver badge

Re: Another workaround

"changing root's shell to /usr/bin/false"

That should work but AFAICS it would break katrinab's suggestion of how to get a root shell from sudo should you want it. sudo sh would still work.

Doctor Syntax Silver badge

Re: This is a deliberate feature and it's because Apple cares.

"sudo su

[my user password]"

or sudo sh

Doctor Syntax Silver badge

"Would you have root in linux with no password ?"

Ubuntu & derivatives. No password but root logins disabled. You're supposed to use sudo and re-enter your own password so if you're in sudoers and someone gets your password they've got root. Wonderful. I don't often use Ubuntu these days.

Doctor Syntax Silver badge

Re: How worse than Single User Mode?

"That's why a lot of distros prefer the "sudo" approach. You never actually log in as root, you just temporarily give the account root permissions...just long enough to run that one command, then you go back to a standard user."

I'm not an Apple user but from the account it seems as if this is how macOS has been supposed to work. It hasn't turned out well here.

I'm old fashioned enough never to have been a fan of sudo. It's always struck me as being an additional attack surface. I suppose it's more convenient than having multiple admin IDs with access to restricted subsets of root functionality such as bin to own system S/W & lpadmin to administer printers & the like but convenience and security don't often mix too well.

US intelligence blabs classified Linux VM to world via leaky S3 silo

Doctor Syntax Silver badge

an intrusion that malicious actors will have attempted

s/attempted/carried out/

Still no charge.

Rolls-Royce, Airbus, Siemens tease electric flight engine project

Doctor Syntax Silver badge

Re: Greenwash?

"Basically, they're going to use a jet engine to power a generator, to power an electric motor, which means that you're going to need an additional nacelle for each generator"

It would depend on how big the motor is. Possibly the entire assembly could fit into a single nacelle.

Apple embraces El Reg! iOS 11 is now biting the hand that types IT

Doctor Syntax Silver badge

Re: Here is my theory

"I suspect that some posts on El Reg forums could be the proof of it."

Are you telling us amanfrommars is really an iPhone?

Surveillance Capitalism thinks it won, but there's still time to unplug it

Doctor Syntax Silver badge

Re: Good article but what's the fix

"Every phone tracks your location and everything you do on it."

Given the number of times I forget to take my phone it's not very good at tracking my location and not much gets done on it.

HPE GreenLake: Enterprise takes another splash at pay-as-you-go private cloud

Doctor Syntax Silver badge

"on-premise...shift from capex to opex"

I think I could come up with an alternative name for that: Local Enterprise Assets Sold Incrementally Next Generation (or is the next generation thing passé these days?).

Everything old is new again.

.GIF garage Imgur plugs 1.7 million-subscriber creds breach

Doctor Syntax Silver badge

Re: SHA-256 brute force?

"Though the worst are the ones that use a short password and do not tell you that they have just truncated the long password you entered!"

Or barf on some characters but don't tell you which.

Doctor Syntax Silver badge

Re: SHA-256 brute force?

"unless you're announcing to the world that you plan to store the plaintext"

That doesn't follow, it could just be a string limit somewhere between the input form and the hash algorithm.

Doctor Syntax Silver badge

Re: SHA-256 brute force?

"Have these people never heard of /dev/urandom? Or the entropy-gathering daemon that preceded it?"

Just a date-time stamp should be enough.

Doctor Syntax Silver badge

Warning - shill alert.

"Three years and no one noticed they had been breached? "

They don't realise you can see them a mile off.

Doctor Syntax Silver badge

Re: "most awesome" my a*se!!

Well, the sub-head does say "self described" so any business with a half conscious marketing bod will have claim some such puffery. Even a fully conscious marketing bod will still lack the self-awareness to realise how naff it is.

Doctor Syntax Silver badge

Re: no PII but

only "paranoid" keep different emails for distinct "junk" accounts

Why would you not do that? You don't need to be paranoid about security, just pissed off with spam. Even if you don't use your own domain let Google or Microsoft choke on the spamverts, just use a given address for a couple of months then set up a new one.

An address to be used for a service you're going to keep using needs to survive for longer than that so make it unique to that service. If it leaks to spam you can discontinue that particular address and either set up a new one or drop the service.

SagePay's monster wobble... On the third day of sale week, UK retailers start to weep

Doctor Syntax Silver badge

Re: Only one decent company to deal with

"PAYPAL......customers like it too!"

From the customer's PoV - mostly. One thing not to like is that they pass the customer email address on to the merchant. Not good as some merchants then spam and, worse, PayPal seem to have no effective method for disciplining offenders. Worst of all, the email address is the login ID.

PayPal really need to do some serious thinking about this between now and next May. Actually between now and now would be even better.

'Treat infosec fails like plane crashes' – but hopefully with less death and twisted metal

Doctor Syntax Silver badge

Re: Good luck

" Even if that many existed wouldn't it be better to use them to make critical code more secure rather than do useless investigations?"

Not necessarily the same skills and coding doesn't help when the errors are operational.

Doctor Syntax Silver badge

Re: Zero interest

"It'll be a cold day in hell when a statutory body is established with the power to shut down organisations"

I don't know if it's still there, and even if it is I doubt it's ever been used, but the DPA Mk I gave the regulator the power to order a business to stop processing data. It's a bit chilly today.

Doctor Syntax Silver badge

Re: Triumph of sensationalism over common sense

"Constantly chasing buzzwords they read rather than doing any analysis to understand what is really needed. Rather than aerospace grade discipline spreading to the world of IT what I see is the crap-of-the-week club taking over aerospace."

You do at least have the possibility of the existing regulators forcing that discipline onto the buzzword chasers.

Doctor Syntax Silver badge

Re: Infosec ≠ cyberattack

"that is more for blame attribution rather than learning lessons."

And usually looking for a driver to blame. It's just coincidence that so many of the drivers being blamed were at a particular road junction.

Doctor Syntax Silver badge

"Experian, Uber or Talk Talk"

These companies were not the victims of data breaches. The victims were those people whose details were leaked. Let's not forget that.

Seek 'passion' and tech skills will follow, say recruiting security chiefs

Doctor Syntax Silver badge

"But you can guarantee on the few hours when I'm in work I'm way more productive per hour than those that live in the office."

I often found that the most productive time was on the way home, even just walking across the car park. Without the focus of what was on the screen the sub-conscious seemed to be able to take a wider look at whatever problem I'd walked away from and come up with a solution.

Doctor Syntax Silver badge

The passionate people will not only learn the task at hand and deliver on time, they will read more on the train home, they will go home and play with the technology in their own time, evenings and weekends, they will step outside the remit to learn the "satellite skills" too.

But how many would describe themselves as "passionate"? Or treat a job advert that specifies it as anything but wanker-speak to be avoided?

Logicalis lands mega air traffic computer deal. Yes, that Logicalis

Doctor Syntax Silver badge

Burbled

Yup. Burbled just fits.

Pokémon GO caused hundreds of deaths, increased crashes

Doctor Syntax Silver badge

Re: Cleaning in progess

"Gene Pool Cleaning only works if there is a positive correlation between the 'dirt' you are trying to clean out and the removal process."

There probably is. Correlation does not mean causation equivalence.

Neural networks: Today, classifying flowers... tomorrow, Skynet maybe

Doctor Syntax Silver badge

I suppose the next we hear they'll have invented cluster analysis just like we had 50 years ago.

http://www.clustan.com/

10 years of the Kindle and the curious incident of a dog in the day-time

Doctor Syntax Silver badge

Re: Other eReaders are available

"But then I started doing Science back in the 1980s when you had to actually go to the Med or Science library to read the literature as pdfs and the web hadn't been invented yet."

The journal publishers have done their best to ensure that that still applies. If your target market is also prepared to provide your product FoC why shouldn't you keep charging extortionate prices even if your cost of sales falls to a fraction of what it was?

Another toothless wonder? Why the UK.gov's data ethics centre needs clout

Doctor Syntax Silver badge
Coat

OK, you known someone had to say in and the rest of you have had your chance.

Ethics? Isn't that north-east of London?

Mines the one with the UK Road Atlas in the pocket.

Linus Torvalds on security: 'Do no harm, don't break users'

Doctor Syntax Silver badge

They're either being purposefully...

"It is difficult to get a man to understand something, when his salary depends upon his not understanding it"

Doctor Syntax Silver badge

Re: “Because without users, your program is pointless..."

"Maybe the important factor is that it's widely used even if the Linux or Unix label is hidden on the inside."

A few disconnected thoughts along this line.

Firstly, mobiles, Macs and Chromebooks have got users out of the notion that a computer has to be Windows. That's moved on from the time that the original Linux netbooks were maybe a step too far for the average user. So is there a way of introducing something that isn't Windows and at the same time isn't tied to a service that's trying to monetise the user?

ARM kit is now capable of running a full-featured desktop Linux for a low cost. One problem the original netbook vendors ran into was Microsoft muscling in with a sawn off version of Windows but only on a cut-down H/W spec which prevented Linux showing what it could do. Given that the vendors were generally PC makers as well MS had some arm-twisting ability. A mobile maker with no place in the Windows market wouldn't be in that position.

OTOH the big vendors have conditioned users into expecting some sort of cloud service. A service that doesn't pay for itself by treating the user as the product is one that the user would need to pay a sub for. Could a service (?NextCloud) be sold to users on this basis? Maybe there'd be resistance to buying a piece of kit and then adding on a monthly charge for some additional service.

Mobiles have got users used to the idea of renting a device as part of a service for which the charge itself is accepted.

One charge which users do accept is their ISP. Is there scope for a device which is provided as part of an enhanced ISP package which also includes storage?

Users also expect a 3rd party app store Most distros have a repository facility which could easily support that.

Doctor Syntax Silver badge

Re: “Because without users, your program is pointless..."

"Linux's visibility frankly sucks and most who a 'nix are completely unaware of it (MacOS, iOS, Android, ChromeOS)."

Let's bear in mind that two out of that list are actually Linux. Maybe the important factor is that it's widely used even if the Linux or Unix label is hidden on the inside.

Doctor Syntax Silver badge

"So... I discover a TOTAL lack of authorisation and type-checking on the backend API methods?"

You raise a bug report and get it fixed instead of trying to hide the problems.

Page: