Posts by Doctor Syntax

Microsoft silently fixes security holes in Windows 10 – dumps Win 7, 8 out in the cold

Re: If they cared about security at all

"And if they cared about security AND gaming at the same time?"

Life's a bitch.

Re: Windows 7, 8, 10? I'll take 9, please.

"Upgrades are not always improvements."

Quite so. That's a good reason to stick with LTS systems as far as possible. It reduces the number of occasions you have to spend time chasing after someone's failure to maintain backwards compatibility. Bleeding edge distros are fine if you want to play with them. If you want to get stuff done use an LTS for as long as possible.

Read what I wrote again.

We did. You said "trust me". In this post you in effect said "trust someone else saying the same thing": See page 7 in https://jon.oberheide.org/files/source10-linuxkernel-jonoberheide.pdf for one of many mentions of this phenomenon

Still no examples.

"Because it's free?"

As in speech. Those who are running RHEL as a server OS certainly aren't using it because it's free as in beer.

"Speaking personally and using Debian, by the time I read about it on el reg it has already been updated."

And that's also my experience.

"This gets really, really bad when you consider that a lot of distros keep the kernel version stable and just backport security fixes."

If I use version N of the kernel because it supports my hardware and has the features I need why would I want more than security update providing those come at regular intervals? I'm old enough to remember that upgrades all to often means breakage and have no intention of having to keep fixing things because someone somewhere couldn't be arsed to pay attention to backward compatibility. That's why I like Long Term Support versions.

So here's Debian 7, not at LTS (staying pre-systemd) and the current version is Debian 9 (equivalent to 10 in Microsoft numbering ;). What's the kernel number and what's the date the last version arrived? 3.2 and just over 2 weeks ago on 20th of September.

Re: Perhaps money will talk louder:

"Microsoft is one of the US government's pet corporations."

Other governments are available.

Re: Perhaps money will talk louder:

"They have over 2 decades worth of experiences of dodging that one. That's why they have these exabyte-sized conditions you have to agree to."

Whether these EULAs are worth the paper they're not written on depends on your jurisdiction and status (consumer vs professional).

It's 4PM on Friday, almost time to log off and, oh look, Disqus says it's been hacked

Re: they disclosed but ?

"have not informed users and have provided no information beyond acknowledgment"

From TFA: after spending the day notifying users of the hack

Re: No loss

Generally speaking, when I see the little Disqus logo on a site's comment section, I think I will have fewer issues than if I try to use the site's own comment system to enable Javascript.

FTFY

And no, I won't.

Leicestershire teen admits attempting to hack director of the CIA

Re: causing risk of serious damage to human welfare/national security

Rest assured, the government is undoubtedly mad as a box of frogs so maybe the spell worked.

Online criminal records checks to take a punt on troubled Verify system

"One problem is that the identity providers, mainly Experian at this point, fail to recognise anyone without a digital footprint "

Experian was involved in this role in the original CRB checking system about 15 years ago.

Russia, America dig into tug-of-war over Bitcoin laundering suspect

Re: I bet he’s FSB

"Why else would the Russians be so desperate to get him back?"

For the $4b?

Is that a bulge in your pocket or... do you have an iPhone 8+? Apple's batteries look swell

People keep saying Apple copies others. Is this what they mean?

Beach, please... Billionaire VC finally opens way to waves

Re: B E A C H P A R T Y ! ! ! !

Try to remember, this Khosla dude will be just as upset at a lone jogger on "his" beach at sunset as he would a major twelve-dozen keg barn burner with The Who's sound system cranking multi-genre, multi-decade rock&roll for three days

Not saying you're wrong but it sounds like a statement that could be tested.

Just impose the fines and back-date them to the moment the legislation was passed. With interest, of course.

Support team discovers 'official' vendor paper doesn't rob you blind

Re: As the old, old saying goes...

"then what do you use for a PHB that is rapidly killing the company ?"

Duct tape would be fine. It just takes more work than carpet.

Re: Common English words with very different meanings.....

"It is correctly pronounced "rowter"."

How do you pronounce "route". If you pronounce it "rowt" I can see how you got to your rowter pronunciation but we've had routes in the UK way before the router was invented to allocate them.

Re: Million to one chances occur nine times out of ten*

"OnCall really is just an interesting repository of anecdotes, not a manual of best practice"

It's a pretty good manual of worst practice.

Re: The story is ...

"The assistant knows there is a bar code - so persists by presenting it repeatedly. "

And is utterly convinced that a barcode has to be in motion in order to be read, just like a mag stripe.

surely it would of become very obvious once the robot went to retrieve the tape from the drive, and failed because 'I can't find the tape!'

The article describes exactly this except that the tapes were missed on the shelves and didn't get as far as the drives.

Even tapes that the team put on shelves by hand weren't being detected.

“The robot sometimes even tried to place other tapes in those 'empty' slots,”

How bad can the new spying legislation be? Exhibit 1: it's called the USA Liberty Act

Getting rid of the difficult bit in the title

Remember, folks, Yes Minister is your guide to administrations everywhere.

Avast urges devs to secure toolchains after hacked build box led to CCleaner disaster

Re: XcodeGhost again, cmon people!

"Requiring a 'pristine' build environment is software engineering 101."

Putting 'pristine' in quotes says it all, really. You may think your build environment is pristine but if it's been got at you end up in exactly the situation Piriform found themselves in.

Re: CC Cleaner is an enterprise tool?

"Handy little tool, not 'optimisation'."

Surely cleaning vendors' bloatware is optimisation.

Hipster disruptor? Never trust a well-groomed caveman with your clams

Re: Something I've always wondered ...

"The really great invention was actually the axle."

The really great invention was the roller (not Roller). Everything else was refinement.

Russian spies used Kaspersky AV to hack NSA staffer, swipe exploit code – new claim

I complained to "bitdefender" because with their new enforced fucking "cloud" system, not only can they "snag" files. (never used to happen with the standalone version, which they discontinued)

I believe Bitdefender are a UK company. Assuming you're also in the UK invoke your rights under the DPA or, better still, wait till next June & hit them with the new, GPDR-enabled Act. And in the meantime, don't use them. "Cloud" should have been a warning to stop right there.

Re: "no self respecting spook would be caught using Microsoft Windows to do their spying"

"For the thousandth time, counting CVEs does not indicate relative security levels."

Doug, there's no point in trying to explain things to A/Cs spouting the MS party line. They're only doing what they're told. You don't expect them to actually understand any of it do you?

Re: "no self respecting spook would be caught using Microsoft Windows to do their spying"

"the very probable fact that, spook or no, management will be using Windows and management wants their time sheets, planning, expense reports etc done on time. I haven't heard of a lot of Linux versions of the products that handle that, so you'll be most likely using Windows for all that stuff."

Management should be using what the organisation's security bods specify which, you'd hope, would be something more like Open BSD. LibreOffice will run quite nicely on BSDs so I can't see any problems with the sorts of management stuff you mention.

"The Washington Post says the contractor ... worked for the NSA's ace hacking team"

As I posted in another thread, it just shows that the attackers aren't good at defending. If you want good advice about defence don't take it from your attack team. What do the attack team advise? Back doors.

Hey, IoT vendors. When a paediatric nurse tells you to fix security, you definitely screwed up

"From the article it looks like she's been a security professional for the past three years"

Given that IoT vendors seem to place children in charge of security maybe a paediatric nurse has exactly the qualifications for dealing with them.

Re: But then comes the big problem: the bill.

"t'll probably cost less to deal with the fallout than to actually do things right."

Pay and cost, at least monetary cost, are two different things. It may cost the vendor money to do things right but if they don't you may pay - with your life.

Of course, there's always the other aspect of it: if the market is properly regulated you, as a vendor, don't get to sell your product if you're not doing things right so you don't get any money at all. And as it's the same for your competitors you're not at a disadvantage by doing things right. The only way to disadvantage yourself would be not to spend the money in the first place.

Spy vs spy vs hacker vs... who is THAT? Everyone's hacking each other

The moral of the story seems to be that attackers aren't very good at defending. So, if you want to defend your infrastructure, don't take your attack team's advice. What was it attackers advised? Oh, yes; backdoors.

Ex-Harrods IT man cleared of stealing company issued laptop

Re: This is one of those stories

"I got this feeling there is a wee bit more to this story than has been told."

It's a given of court cases that (a) there's more then you're being told and (b) you're being told more than there is, at least by one side.

"Which means Herrod's has a procedure when an employee separates, and they follow it."

Herrod? Think of the children.

"It would be possible for someone to have their personal credit card details accessible on a company PC for booking hotels etc on company business."

That's one category of information I don't have to keep on a PC. It lives in my wallet.

If, however, there's stuff that I think should be kept private it can go into something like Keepass. Even if the disk is encrypted on a company laptop having a separate encrypted file to which the company has no access would have solved the problem. It would also solve the problem of the company backing up the laptop onto their own servers.

Re: Eh?

"In normal conditions, he could have talked to a friendly Harrods IT guy"

He'd been fired. That opportunity might not have been open to him short of threatening to take it up with the ICO.

"He should really have asked Harrods to erase the personal data for him "

Or he could simply have taken the hard disk out, overwritten the partition with random data, replaced it, restored the OS (I assume there was a recovery partition) and then handed the machine back..

Splunk hits Oracle's Larry where it hurts: His failure to win America's Cup boat race

Oracle is becoming the largest "meeee toooo!" vendor in the world.

Becoming? You didn't think they invented the relational database did you?

US Senate stamps the gas pedal on law to flood America's streets with self-driving cars

Re: It's those evil lawyers

"But the fear of multi-million or even billion dollar jury verdicts will help keep them in line. Even with government regulation, such threats are the only reason they even obey the law any ways."

Proper says that the vehicle model has to meet safety standards to be offered for sale. Failure to take the money in the first place is an even more effective reason to obey they law than fearing it being taken away again.

Re: A dangerous hands-off approach to hands-free driving

"A hands-free is not as distracting, but still is to a point."

Not half as distracting as something one sees from time to time: turning to face a passenger whilst talking to them.

"This is why:"

Hmmm. And you think an autonomous car will do better? I think the real reason why is lobbying by companies that want to sell autonomous cars. There'll be an awful lot of profit sales to be made before there's a real handle on whether they really are safer and if the final decision is that they aren't then the companies still get to keep the money.

"One is the reduction in accidents as most accidents are really due to some form of operator error/stupidity."

As human drivers generally drive very safely (I don't know about US figures but as far as I can make out the fatalities in the UK must be of the order of one per 100 million* miles). This is a pretty tough target to set for an autonomous vehicle. In fact, the figure suggests that accidents are corner cases, the driver failing to cope with an out of the ordinary situation. Experience suggests that dealing with corner cases is something S/W isn't particularly good at. In addition inexperienced drivers are more likely to have accidents than experienced drivers. One should reasonably expect experienced and sober drivers to be somewhat better than the average. If I were to trust my life to an autonomous vehicle I'd want it to be at least as good as an experienced and sober driver; I have no confidence that this will be achieved for a long time if ever. Meanwhile I'm quite happy for an experiment like this to take place somewhere where I have no intention of ever being so the US fits that quite nicely.

*I base this on there being c 30 million vehicles in the UK and c 3,000 accidents and assuming 10,000 as the average mileage to get an order of magnitude figure.

Legacy clearout? Not all at once, surely. Keeping tech up to snuff in an SMB

Re: Madness indeed

I'm not clear as to exactly what Dave was recommending here. If he's suggesting - or it gets interpreted as suggesting - that the business just sign up for a bunch of gmail or outlook or (let's really go for it) TalkTalk or Yahoo addresses then it's not particularly a good idea. Because that looks so professional. At the very least go with a mail provider who can provide you with email addresses on your own domain.

Isn't it amazing that all these allegedly net-savvy SEO specialists don't have their own company domain but spam from gamail.

FreeBSD gains eMMC support so … errr … watch out, Android

I'd like to think that anyone who has the - shall we say good taste? - to use BSD in an IoT thing will also be inclined to do better than to let the user operate it with a default password.

Oath-my-God: THREE! BILLION! Yahoo! accounts! hacked! in! 2013! – not! 'just!' 1bn!

"The thing with the exclamation marks was never funny."

Funny, no; scornful, yes.

Re: Marissa Meyer laughed all the way to the bank

"Hewlett Packard Enterprises"

Fails on "in right mind".

Life began after meteorites splashed into warm ponds of water, say astronomers

" I'm satisfied that we're here based on an incredible string of random chances over an insanely long period of time."

No we're just a simulation - sorry, wrong thread.

Home Sec Amber Rudd: Yeah, I don't understand encryption. So what?

Re: But this isn't a new area for legislation

"I don't need to understand how encryption works to understand how it's helping – end-to-end encryption – the criminals."

What needs to be fed back against this is that it's simply a tool and like any other tool, has its good and bad uses. In this case its good use is the securing of everyday commercial transactions. In trying to destroy it you are helping criminals Home Secretary.

"Theresa May, who excelled at these two things as Home Secretary, to the point hat no-one noticed that she has literally no other recognizable skills whatsoever."

Wrong. Lots of us noticed.

Re: Fashionanle Ignorance

"Westminster House of Commons still has a formal separation between the benches of the opposing parties that inhibits sword fights."

The pegs in the cloakrooms also have loops for hanging up members' swords.