Posts by Doctor Syntax

Don't panic, but Linux's Systemd can be pwned via an evil DNS query

Re: Hang on, all y'all ...

"nice one, you just proved you no nothing about systemd"

By failing to quote what you replied to you've just shown you know very little about responding on forums.

Re: At some point in the article

"https://devuan.org/"

Debian LTS.

Re: If THIS isn't a reason to hate systemd...

@ Missing Semicolon

Whilst I agree with the sentiment the article makes it clear that use of the systemd resolver isn't compulsory. Yet. At least not if you use Debian.

Re: Hang on, all y'all ...

"And because a ton of scripted code has been replaced by a ton of C code"

ISTR a rubric which went something like:

Never do in C that which you can do in shell.

Never do in shell that which you can do in awk.

Never do in awk that which you can do in sed.

Never do in sed that which you can do in tr.

Re: Only 14 responses (at time of writing)

"Our's seem have come across phishing attacks for the first time"

Be grateful that they finally have..

Re: Just like to point out..

"A timely reminder that this stuff is written by journalists, technical journalists, but journalists all the same."

That's right. Journalists who put this paragraph in the article:

The bug is technically present in Debian Stretch (aka Debian 9), Buster (aka 10) and Sid (aka Unstable), however "systemd-resolved is not enabled by default in Debian," according to the project's Salvatore Bonaccorso, so either you have nothing to worry about, apply the patch yourself, or hang tight for the next point release.

It helps to read the article as well as the comments.

"Given how this octopus spreads its arm in so many modules, this is probably only the very tiny tip of a very big and cold iceberg."

Regret I can't give you a second upvote for a glorious mixed metaphor.

O Rly? O'Reilly exits direct book sales

Re: As long as they're still publishing dead tree books ...

"I think your living in the wrong century... beside, I was not pointing to historical material, but rather modern publications that already exist in or were created in digital formats."

Date of publication 2015.

Don't get me wrong here, if the translated and edited publication had been in digital format it would actually have been better. It's easier to cut and paste or otherwise process stuff when it's in digital format. Some of the earlier published volumes were scanned and I have them in that format.

The point is that if you require a specific item that's only in printed format then that's what you use. There's no value at all in taking the approach of phablet (or, come to that, print) only.

Re: O'Reilly have been publishing some of the best Tech books for years

[Although I must admit that the recent "Practical Statistics for Data Scientists: 50 Essential Concepts" is quite a bit below O'Reilly's usual standard.]

My view of O'Reilly's usual standard took a big tumble years ago when they spammed me about a book on dealing with spam. It never really recovered.

Re: As long as they're still publishing dead tree books ...

"Personally i've not brought a print book in almost 10 years.. these days I use phablet which acts as book reader, email, basic browsing, music and the oh so occasional phone call!"

And, of course, your use case fits all.

Could you please point me to the electronic version of this book which I have to hand and which I bought in print the other day: Wakefield Court Roll 1658-59.

NHS WannaCrypt postmortem: Outbreak blamed on lack of accountability

Re: Outbreak blamed on ....Windows.

"One of our Linux servers went flat on it's arse the other day.....because Marketing didn't bother to patch Wordpress (they insist on using it, so they deal with it)"

Marketing insist on a particular application. It's had a reputation of having security holes for some time. So IT didn't insist on ensuring it was patched. What's the IT department's role there if it isn't to maintain the IT facilities that users need for their work*?

*Given that it's marketing "work" is used in its loosed possible sense. OTOH, because it's Marketing they probably need a closer eye kept on them than most.

"Just needs a little planning and agreement"

The latter is the more problematic It's just IT getting in the way again right up until it's IT failing to protect us against this.

Re: Best thing that's happened in years

"it's very hard to convince someone they need to expend funds preventing something they haven't seen happen"

Unless it were established as a general principle in law that those withholding the funds would be held personally responsible when it happens.

Hint for PowerPointers making a pitch for such funds. Put a picture of a hook in the corner of the template. During the pitch make the occasional reference along the lines of "..and there's the hook". Inevitably someone will ask "What's the hook". "That's the hook your balls will be hanging from if $(predicted disaster} happens".

Re: Chartered Institute For IT?

"And registered professionals means ones who are our members."

Quite. The whole tenor of it - e.g. "assure hospital Boards that computer systems were fit for purpose" - suggests a dedication to the paperwork than the reality. Wouldn't "ensure that computer systems were fit for purpose" have been a better statement?

How to avoid getting hoodwinked by a DevOps hustler

“A strong background in not only the technical and tooling side of DevOps, but also in driving enterprise-wide people and process changes.”

Translation: "At least twice as long in $LatestFad ad $LatestFad has existed"

"Any organization that’s successfully changed is tripping over itself to tell others how awesome it went."

Translation: "Any organisation that's persistently chased rainbows to no good effect is ever going to admit to itself let alone anyone else that it's gone nowhere and will take any chance to boast how great it is".

Robots will enable a sustainable grey economy

"By the mid 2020s you’ll be able to buy autonomous vehicles from nearly every major manufacturer at a variety of price points."

But will we bale able to avoid them? I'm assuming we won't be able to completely rely on them avoiding us.

Re: Dumb yanks

"That said, public transport is tricky anywhere the street plan is basically still based on the medieval roads that Farmer Giles used to get his cows to the river a thousand years ago."

I think you've misstated the medieval history of Bristol.

Re: Hurrah we can work forever

"Let 'em all retire at 60, and then expect the rest of us to pay for them and their health care for the next quarter century?"

OTOH we keep getting told that AI and robotics are going to take everyone's jobs and it's difficult to see how anyone will be able to work at any age.

Somewhere between the extremes there should be a compromise.

Re: Hurrah we can work forever

"Hey I know, maybe we could have some residential work facilities for those people who didn't come from a fancy management job, I'm sure everyone would feel so fulfilled with that."

Careful now. More sarcasm that might be misunderstood.

"Seriously, the autonomous car could reverse the decline of the country pub."

You think you couldn't still be done for DIC even if the car was driving itself? You underestimate your political masters.

Re: Dumb yanks

"For those not in a big city, how often do they drive?"

Let's see.

Mondays SWMBO to gym. We each pick up one of the grandkids from school.

Tuesdays SWMBO to her patchwork class (used to be me who drove her before some equipment changes were made & a smaller car was enough). Then SWMBO to art class.

Wednesdays SWMBO to gym then one of other of us take grandkids to tennis.

Thursdays Me take SWMBO to charity shop, collect her later then go for meal, one week in 3 go to local auction viewing.

Fridays SWMBO to gym, then often both of us out to where-ever (it's often the only weekday with nothing fixed for the afternoon).

Shopping? Oh, mostly me, two or three times a week.

The thing is, we both grew up in a time when private vehicles were rare. When they became generally accessible it was a change which had probably only been equalled once in human history and that was the introduction of the bicycle. It represented a huge expansion of individual freedom to travel at will. The introduction of railways probably came somewhere close but even then there was a constraints of distance from station, routes and timetables.

I suspect the entrenched hostility of TPTB to the private car is an expression of their instinctive opposition to any form of personal freedom - much the same as their current opposition to privacy of communication.

Re: Dumb yanks

"What makes you think that all old people should or want to live in a crowded city as they get older."

I live in the country. We still have the remnants of public transport here. If I want to go somewhere where I can't be bothered with the hassle of parking or just their general hostility to cars as a whole I use my bus pass. It is, of course, ironic that the better bus service isn't the one with a bus stop just down the lane but the one where I have to drive a few miles to the bus stop.

Five-eyes nations want comms providers to bust crypto for them

Re: Breaking News: Water is wet

"Does anyone want to place bets on how long it is until someone writes an app that not only encrypts a message, but then uses old-school style cyphers to hide the messages inside innocuous looking plain-text internet posts?"

A double book cypher. Use two books. Look up the page and word number of the first instance a word, e.g. "the", in one book. Substitute the word, e.g. "attack" in the same position in the second.

If only we knew the two books amanfrommars uses...

Re: Breaking News: Water is wet

"forcing them to use language that avoids - so far as is possible - any comparison or connection with a 'backdoor'."

To which the obvious counter is "Oh, you mean a backdoor.". Train the public to recognise a backdoor when they see one.

Re: Germany

"They accepted that protecting personal communications through encryption is generally good,"

This is the point that's totally beyond most politicians. They can't grasp the idea that electronic communications without encryption is equivalent to conducting all your business, no matter how confidential, by post-card.

Re: "deal with the relentless threats of terrorism"

"When are our legislators going to declare war on rust?"

You mean we should all use Go?

A minister for GDS? Don't talk digital pony

Vic,

I initially wrote "team" and then decided that suggested an unlikely degree of cohesion. "Crew" seemed more appropriate. After all, wrecked ships start with a crew.

Four Brits cuffed in multimillion-quid Windows tech support call scam probe

A friend who is a lawyer by trade asked my technical opinion on something and I gave them an answer.

"About this speeding ticket..."

In a Crown Court case the judge kept reprimanding a prosecution "expert witness" for stating opinions which were outside her perceived remit. She was trying too hard to help the prosecution.

I've had the experience of the prosecution QC (who'd called me) trying to push me further than I was prepared to go. Eventually the defence lodged an objection.

Adam is right. Although an expert is called by one side or the other their real role should be to help the court. In my day I and my immediate colleagues were Civil Servants although one or two labs, notably the Met, were run by the police although the staff were civilian. I'm very much against the privatisation that's happened. Indeed, I thought at the time that the lab should have had a supervisory board from the judiciary to emphasise the fact that we were servants of the court.

"Take Burglary, for example."

And (c) establish the ownership of the object taken.

"Microsoft are now doing criminal investigations? If evidence isn't generated and validated by the plod, I'm not sure that will stand up in a court. (?)"

So i you were to witness a crime and aren't a policeman you don't think your evidence would stand up in court? Anybody can be give evidence in court to what they witness.

Someone with appropriate expertise can give expert evidence which includes what opinions they draw. They don't have to be police officers; in the UK forensic scientists aren't, nor are pathologists. I think when it comes to investigating Microsoft scams Microsoft would have provided expert advice to the police and their personnel (not the company itself) would be readily accepted as experts by the court.

"may I suggest anyone found guilty of running these scams is placed in a genuine computer support desk?"

Given the number of examples on YouTube of the scammers being scammed it's doubtful whether any of them would be good enough to set to work on a help desk...or maybe Capita.

Virus (cough, cough, Petya) goes postal at FedEx, shares halted

Re: An Observation

"exactly how does this malware spread?"

This should go some way to answering your question: https://www.theregister.co.uk/2017/06/28/petya_notpetya_ransomware/?page=1

Re: If Only "Professional" IT Staff Updated Their Computer OS Software

"Microsoft has provided patches for Windows XP on up through Windows 10 that block ALL of the ongoing ransomware assaults."

Are you sure? From a previous Reg article:

The malware performs a scan of the network for vulnerable SMB file-sharing services so that it can spread via EternalBlue and EternalRomance. It also scans the computer's RAM to harvest login credentials – preferable any admin or domain admin creds present – so that these too can be used to spread the malware via remote command-line tools PsExec and WMIC. These latter pair appear to be the primary method of propagation.

"You have NO excuse."

If I had a £ for every post which effectively says "Works for me so if it doesn't work for you it's your fault" I'd be rich. Maybe they're more informative about the breadth of experience of the posters than of anything else.

Admins do not all have the final word in policies. Very likely there'll be some who have been forbidden from patching because "we can't afford the downtime". In my time I've had a couple of similar blocks imposed on Unix migrations (and a very bad migration platform choice imposed on me). The businesses may - arguably - have got what they deserve, the admins not necessarily so.

Re: Today of all days

"single floor building, no open windows or elevator shafts to play with either"

You need a better working environment.

Re: Well, MAYBE this will get their attention

"the fixes are a better tax rightoff" or some such malarkey."

It's not only the fixes that cost or even the immediate losses of business during the downtime. It's the loss of confidence by customers. It's also the increased insurance premiums. In fact, if this starts causing serious losses to insurance customers businesses all over, irrespective of whether they've been hit, will start to see their insurers stipulating the precautions they're going to have to take before they get cover.

Search results suddenly missing from Google? Well, BLAME CANADA!

So in another jurisdiction one of the alleged knock-off products claims its products are legit, gets a judgement to that effect & demands that Google display its results world-wide. What does Canada do then?

Everything you need to know about the Petya, er, NotPetya nasty trashing PCs worldwide

Re: Lots of fishiness here.

" My own list of suspects would start with recently terminated sys admins."

Or any other techy from there.

I wonder whether the private keys were being emailed in plain text to that email box. Of course with it closed down maybe victims are getting their email bounced back to them.

Re: A good argument for keeping *one* *nix machine

"and having *it* act as file server."

But not via SMB.

Re: Decrypting?

"Some programs are capable of re-constructing this data, though they're invariably either very, very expensive or very, very un-user friendly (requiring a good knowledge of how a disk drive physically works at a cylinder-and-sector level)."

<cough/> https://en.wikipedia.org/wiki/PhotoRec

Free and IIRC, fairly straightforward. But it does depend on the original data being undamaged on the disk.

Re: Decrypting?

"but that won't help with encrypted data files."

It depends on whether the original data blocks were overwritten.

Re: Our cats used to deliver half a dead mouse

"And occasionally a stunned chipmunk."

Years ago when we had a cat and a dog one of them brought in a live baby rabbit. Whilst we were trying to round that one up the other arrived with another. I wor nobbut a nipper but I still remember that.

"Then he left his note book in the toilet"

Provision of proper toilet paper is an essential for security.

Re: Bring Back

"Not in any doubt as to a lower TCO for general use."

That TCO might need some revision this year.

"I'll lay odds in the affected companies the MAC/Unix Systems are still going

Because no one uses them as user desktops"

You think those with Macs aren't using them as user desktops?

Re: Backups

"Who is the Data Protection Advocate at your company?"

That begs a question.

Re: The real blame goes to..

"MS have patched the vulnerabilities in question."

Only very belatedly. They were embarrassed into having to patch XP after its EoL. If the problem was known during XP's lifetime, shouldn't it have been patched then? If it was known during 7's development should it ever have been in 7?

There are reasons other than indolence why stuff doesn't get patched or at least patched promptly and doesn't get replaced (see TFA and also the frequent posts about the effects of enforced updating of 10).

NSA have no excuses whatsoever for sitting on this stuff and letting it become a global problem. Countries which have experienced serious infrastructural problems should have been calling US ambassadors into their foreign affairs ministries for a good talking to.

Re: Of Course

"It could be the Ukrainians themselves who set this loose to try and blame their enemies."

More to the point, has MeDOc let anyone go recently and failed to delete their accounts and change any passwords they may have known? Because this is getting t sound like a bigger and better version of https://www.theregister.co.uk/2017/06/26/engineer_imprisoned_for_hacking_exemployer/ (for some values of better).

Mozilla dev and Curl inventor Daniel Stenberg denied travel to USA

Re: Missed Opportunity

"it is a combination of friendly regulation and ready access to investors and capital markets willing and able to throw vast sums of money at tech."

1. The premise of TFA is the unfriendly regulation of the country as a whole.

2. The money will be thrown at the tech wherever it might be if they can't do that locally. And I believe Switzerland and several Caribbean islands might have money available.

Facebook hit two billion users today and SugarCRM reminded us you are Zuck's product

Re: I call it misleading.

A proportion are too young or sick sensible to use the Internet or Facebook.

FTFY