Posts by Doctor Syntax

74 countries hit by NSA-powered WannaCrypt ransomware backdoor: Emergency fixes emitted by Microsoft for WinXP+

"Either Microsoft were coerced into deliberately introducing this for the NSA's pleasure, or the NSA had it inserted somehow."

Or it was a genuine bug which the NSA found and didn't bother to warn anyone until it was too late.

Re: Risk Management

"Simple."

The word you're looking for is "simplistic".

As has already been pointed out all unpatched versions of Windows are vulnerable. Patching itself introduces risks - patches have been known to break things and now that MS are rolling multiple patches together those risks are increased. So patching also involves testing and testing takes time.

The specific risk for XP is that it doesn't get patches. But, again, the issues with XP aren't simple. In many cases it will have been retained because something mission-critical depends on it and replacing whatever that is may require major expenditure and further risks. If your MRI scanner, for instance, relies on a no-longer maintained piece of XP-only software do you simply put your hand in your pocket for a few million to replace it, commission a rewrite and take the risk that it may fail in some respect to emulate the existing product or do you keep using XP?

These sorts of issues are not easily solved. Of course they only exist in the real world so please feel free to keep helping with your advice.

Re: worthy of mention

"On stand-alone PC's, ensure you have an adequate AV solution"

The problem with this is that the signature for any new malware won't be available until the target has been released, infected systems and been reported. When something spreads as fast as this has done that will be much too late.

WannaCrypt ransomware snatches NSA exploit, fscks over Telefónica, other orgs in Spain

Re: Cost (not just of cleanup)?

"Which stovepipe's budget is going to be picking up the cost of cancelled appointments, wasted time, etc?"

How about the NSA? They sat on this for a long time and then failed to prevent it leaking out.

PC repair chap lets tech support scammer log on to his PC. His Linux PC

But surely the DoB should have been 1/4 not 1/1.

Re: I've done the Linux thing

"he woman at the other end had just tried to tell me Linux runs under Windows."

Well they do have a Ubuntu subsystem in W10 - although I doubt the average scammer would know that.

Re: Ideas for a new game

Final plans for the invasion of India with a special unit to be dedicated to liquidation of phone scammers.

Re: I'm missing out

"Take out service with TalkTalk."

There are limits. Now go and scrub your keyboard with soap and water.

Re: professional scammers

"He/she/it/they said "Hello Mr. Shaw" in perfect English to which I replied in Italian, for the lulz."

I'd have thought linguistic skills ought to be able to earn them a better legitimate income than scamming. Or maybe the scamming's just a sideline.

The only call I ever got from one of those is one I missed - it just came up on the phone's missed call list.

What I do get from time to time is SEO spam in my Hotmail spam bin - that and phishing scams pretending to be from Outlook etc are the only ones that the Outlook filters let through. Occasionally I've delved into the Hotmail junk folder and sent replies to the usual amazing business propositions written as an out of office response and giving them the SEO address. After all, they're all in the same line of business so surely they'd appreciate the introductions.

Other responses are to ask them for the URL of the site they're sure they can improve because otherwise I can't tell which of my many(!) sites it is. Oddly they never respond. Another, bearing in mind that they're probably very proud of their English* is to reply pointing out how badly written their email is and I doubt that if this is the best they can do they couldn't be trusted with a site.

More recently I've taken to pointing out that if they're able to get first page in Google their own site must be on the first page if I search for "first page in Google" in Google but they seem to have omitted its URL so I can see for myself and what's more it's odd that they're using a gmail address rather than their own domain. Usually, of course they can't reply because their long established company - whose name they also managed to omit - is just a single chancer without a domain let alone a web site.

But then I got a reply from a different name. I realised the spammers are just taking any responses and selling on the leads. The reply came from a real business based in India but with branches in the UK (Streetview finds it above a "language school" in a shop-front in Longsight) and Australia, presumably the owner's cousins, brothers-in-law or whatever. He included a number of reference sites to I wrote back pointing out the errors in the UK examples: bad copy ranging from poor English to complete nonsense, over-dependence on Javascript and news items that broke off in mid-sentence - even mid-word. I've not heard back but I wonder if his Mancunian cousin got a bollocking for slack work.

*I wonder, however, if they've bought the text of the email along with the spam list.

UK hospital meltdown after ransomware worm uses NSA vuln to raid IT

Re: Alternatives?

"1: You do not normally have to use Windows. There are more secure alternatives."

As others have said there's a lot of specialist kit for which only Windows drivers and/or applciations exists (which version of Windows is another worry). So it's not as simple as that. However there should be proper network segmentation to protect these.

OTOH plain vanilla desktop office/mail/web machines could well be shifted to other platforms. However this would buy time, not complete protection. A booby-trapped email will inevitably find a supply of boobies if it's widely spammed.

What's needed is a better architecture that doesn't allow some random application to save or update whatever file it wants.

Re: something or nothing....

"ever tried deleting/moving/modifying a file on a network share that you only have "read" permissions to?"

Those file you only have read permission to - how did they get there? Could it be that someone has to have write permission?

On a more practical, albeit longer term scale alternatives to simple shared folder need to be looked at. As one approach I'm currently setting up Nextcloud at home. I have several alternative ways to share files with a client. One is to use the webdav client to sync a specific desktop folder with the server. That means that even if I had a ransomware program running wild on the client PC it could only (a) affect files on the synced folder and (b) the contents of the folder on the server are versioned so that the last good version can be restored.

Microsoft's Windows 10 ARM-twist comes closer with first demonstration

"Windows has had ARM support for quite some time too... there's even a distribution for Pi's"

Presumably you mean the W10 Core? That's the one aimed at IoT. Another reason to reject it.

Linux has been on ARM devices for a while. And:

# apt-get install p7zip

[...]

Suggested packages:

p7zip-full

The following NEW packages will be installed:

p7zip

0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.

Need to get 268 kB of archives.

After this operation, 812 kB of additional disk space will be used.

Get:1 http://mirrordirector.raspbian.org/raspbian/ jessie/main p7zip armhf

etc. but that "arnhf" gives the game away - this isn't emulated, it's fully native.

O2 continues to splash out on 4G ahead of rumoured IPO

What a pity BT bought EE. They could have had O2 flogged back to them.

Cloudflare goes berserk on next-gen patent troll, vows to utterly destroy it using prior-art bounties

Re: Prenda law V2?

And let's hope Ken White writes up the story.

Mozilla to Thunderbird: You can stay here and we may give you cash, but as a couple, it's over

Re: It's the 21st Century: Outside of Work, Email is dead

"Noone has the slightest interest in archiving years of invitations to go to the pub or links to cat videos."

Personally I've no interest in any crap for which the main purpose is the dissemination of cat videos.

"It's not even a youth thing: I'm 58 years old and never email anyone, outside of work."

Maybe you're prematurely aged and live a very restricted life if you don't actually do anything online that requires email.

Re: Thunderbird users?

"I was using email long before the Internet was set up"

Now that's really going to blow the OP's mind. Email not only without the web but also without the internet. Bang on!

Re: Can someone give me an idea of what sort of money is involved?

"If there are Thunderbird developers still in existence (and I frankly doubt it), they have rejected each and every one of your ideas every hour of every day for years upon years."

Good try at trolling. As they incorporated Lightning (see my previous post) that's at least one of his suggestions that they haven't rejected. What's more their not rejecting it pre-dates his posting it.

On the whole I have some sympathy in their trying to ignore HTML and the like. It's an abomination in email.

Re: Perhaps a Good thing?

"All I would ask, is for some decent native CalDAV implementation. The Calendar plugins always seem a bit "tacked on" and not fully integrated, and sometimes will cock up."

From https://support.mozilla.org/en-US/kb/using-lightning-calendar-add-on

Starting with Thunderbird 38, Lightning is bundled with Thunderbird. This means you don't need to install it separately, but simply confirm to use it once you create a new profile or upgrade from a previous version of Thunderbird.

What's not, AFAIK, built in is Lightbird, an add-on to Lightning which provides a the calendar in its own window with a somewhat different and, to my mind, better interface. Native CalDav would also be useful.

Re: Apart from security fixes - why change Thunderbird ?

"Google Calendar also opens in a separate tab"

I think I can see the problem there.

Re: Apart from security fixes - why change Thunderbird ?

"Calendar improvements."

Make Lightbird a component instead of an add-on.

Re: Pointless interface changes ?

"Android doesn't even seem to know what I'm talking about."

It only seems not to know what you're talking about. But that's another issue.

Re: Pointless interface changes ?

The outcome I'd like to see is one that was discussed back when this was first raised: Thunderbird (and Lightning) joins the Document Foundation (i.e. LibreOffice) and preferably takes the other orphan child, Seamonkey, with it. LO would be able to add a mail client and PIM and, if Seamonkey is included, a browser. The interface could then go back to the old style which would better fit in with LO and maybe there'd be money to add in its own CalDav connector instead of relying on SOGO.

"fewer potential exploit avenues"

Just a few big exploit avenues: Google, Microsoft, Yahoo, your ISP etc.

"and/or points of failure."

The same.

One point about ISP-hosted email: people just assume it's there and always will be. I read of one person who changed ISP and then discovered, too late, that his emails were on someone else's computer because he hadn't downloaded them and because he wasn't a customer his email account was closed so all his old emails were lost.

Phil Collins and supergroup exposed as cloud investors

"digital transformation of health."

Overall I think biological would be better than digital. It involves a bit more than cobbling together an app, however,

Drugs, vodka, Volvo: The Scandinavian answer to Britain's future new border

"cameras being moved so they did not read plates, as well as other attempts to damage them including setting them on fire."

There's also scope for a sort of crowd sourced DDOS attack. Make up flip books with number-plate fonts, each character being individually flippable and just show a rapid succession of randomly flipped "number plates" to the cameras. With a bit of extra planning the same number could be shown to widely separated cameras at more or less the same time.

Well this is awkward. As Microsoft was bragging about Office at Build, Office 365 went down

Re: Numpties.

You shcould trust them because if the penalty clauses in the contract madeke it really bad for them if you suffer any kind of outage and so they'dll make every conceivable effort to deliver.

FTFY

Re: Cloud just means...

"SLA's around it all"

Do those SLAs actually prevent things from going down?

Do they actually provide compensation for the real costs to the client when they do go down?

Do those trying to fix things when they go down have your, the client's interests as their prime motivation or are they just working to the SLA?

FBI boss James Comey was probing Trump's team for Russia links. You're fired, says Donald

"He learned of his fate today while giving a speech to FBI staffers at a field office in Los Angeles, California."

One day you're out of the office, next day you're out of office.

"You do have to wonder if Comey will now be much more likely to spill the beans the next time he's up in front of the committee."

A good question for any committee member cross-examining him: "Mr Comey, would it materially change your views on security of communications to learn that the President ordered your phone to be backdoored and that you were fired because of what was overheard?"

Although it's a speculative question and he'd reckon the premise was almost certainly untrue he couldn't be sure it wasn't so it would immediately get him thinking back recent conversations to see what might be held against him. It would soften up his defences against the next question which would be the real one.

And I'd like to see what being out of office has done to his thoughts about communication security.

Re: TRUMP KNOWS what HE IS DOING

Bob, you've been out-Bobbed.

Re: They should make a deal

"Android autocorrect just suggested poltergeists?"

Android's AI is improving all the time.

"he learned he'd been fired on TV"

I've never been a fan of hanging TVs with rolling news headlines on any available piece of wall. I suppose he's not now. Should have known better than to give a speech standing in front of one

Re: Please stay more on topic

"agenda-driven writers"

The first requirement to write something is to have something to write. Did you write your comment by stringing random words together or did you have an agenda?

TalkTalk full-year profits rise but shares slump after raid on dividends

"In fact, I don't even see a great deal of point in moving around providers, as they all use the same Openreach network anyway, and television programming is basically Sky or Freeview."

There are other variables. How secure is their customer information is a good starting point. Who provides customer support and from which continent is another.

And how about traffic shaping? One little gem from TT when they took over my previous provider was that they traffic-shaped nntp during the day. In fact they pretty well shaped it out of existence despite the fact that one of the services they'd taken over was Usenet provision.

Crooks can nick Brits' identities just by picking up the phone and lying

Re: 'Security' questions?

My bank tends to ask questions like "You recently charged £49.75 to your account, can you remember what it was for?" - well, probably not but I'd guess a tank of petrol maybe?

And so might anyone else.

High street branches - remember them?

Re: Cifas is pushing education as a means to help call centre staff

"Why not just pay them enough to give a monkeys"

Something about peanuts?

$6,000 for tours of apocalyptic post-Brexit London? WTF, NYT?

Re: Brexit Tour

"until then you can still glimpse the future at any larger Northern UK conurbation."

You might glimpse the future of London that way. In any manufacturing centre that's providing a UK base for some foreign investor there's a decade long slide to something worse coming along.

Majority of contractors distrust HMRC's IR35 calculator, survey finds

"I worked with a guy at my last place who had been contracting there for nine years without a break. They were his only employer in that time"

No. His own company was his employer.

How difficult is it to grasp the basics?

"85 per cent said they did not trust the Employment Status Service (ESS) Tool."

15% trusted HMRC? Who are these people?

Agile consultant behind UK's disastrous Common Platform Programme steps down

Re: So, £270M for a diary!?

"why in 2017 are people still able to run a viable business developing diaries?"

It sounds more like an unviable business failing to develop diaries.

But in answer to your question, from extensive experience around the courts in the past, looking at it as a diary is probably the wrong approach. Think in terms more of a production planning system where some stages are unpredictable in duration and where the resources needed are being shared with other production processes, some of them quite some distance away.

Re: Agile doesn't work

"The whole point of Agile is to deliver small amounts of work on a very regular basis"

My experience is that there's a fairly substantial minimum of work that must be delivered to be of any use at all. If your first delivery is, say, a simple order entry screen and a database behind it there's no use anyone entering any data because there's no way of using it because the warehouse needs to be able to get its instructions from the system.

And if the next delivery is to print a despatch note it's still no use. Maybe the third delivery will be a picking list print so it's usable.

Then when the invoicing is added someone realises that the data collected is inadequate. Then go back to the beginning, revise the database and order entry.

A few iterations of this nonsense and you get confronted with an angry DBA who wants to know why you have to keep buggering about with database reorgs and can't you get a simple thing like designing a database right the first time.

"The projects I have been a part of that did use Agile were all about delivering working software first and foremost."

At which the users gaze in desperation because there's no documentation on how to use it.

And the developers successor s throw it away and write something that they hope does the same thing because there's no documentation for them either.

Re: Agile doesn't work

"trickle from the meltwater that is management"

That trickle from management - I don't think it's meltwater.

Opposable thumbs make tablets more useful says Microsoft Research

Re: It's been done a lot before the dark cloud

I don't know about the others but I had a Nokia 9110. As far as I was concerned I wouldn't have found it easy to operate the keyboard with a thumb nor did it have a stylus.

"Don't Apple have the patent on this?"

I was worried MS were going to patent opposable thumbs. Now you've got me worried that Apple might have patented it already. We're all going to have to pay royalties on our thumbs.

Icon: we're doomed, I tell you, dooomed.

systemd-free Devuan Linux hits RC2

Some of the best examples of "good, modern design" occurred in the UK after I left in the mid-60s. Towering concrete edifices to house the workers

OK, here's another variation on the same theme: “Everything should be made as simple as possible, but no simpler.”

The 60s town blocks failed on the "no simpler" criterion, especially those that shared Ronan Point's construction.

It's been two and a half years of decline – tablets aren't coming back

"I have both unnecessary and totally necessary tablets. Guess which brand/OS?"

Guess? No, can't be bothered.

Re: Sales and Marketing reality distortion field

they will charge me 5£ extra a month for two years for a 320£ phone.

They might think "hey, we are retaining him", but they are just throwing good money away.

How much do you think they're paying for the phone from the manufacturer?

How much does that phone enable them to charge you for all the data the smartness consumes?