Posts by Doctor Syntax 42414 publicly visible posts • joined 16 Jun 2014
"It boils down to whether the company finds it cheaper to comply with the legislated anonymisation requirements or just sue the researcher. I know where my money would bet."
So do I, on the basis that pissing off an expert who can give evidence against you that could result in an eye-watering fine really isn't a good idea. If your legal department is any good they'll tell you that.
"A lot of companies will find ways to ship the data out, to the illegal stuff in places like the US were it isn't illegal and ship the results or the decisions taken back to the UK/EU."
And after a few big finds get handed out they'll put more effort into finding ways to ensure that they don't. Not unless the US adopts similar legislation.
"Or are you expected just to encrypt ALL your logs even if doing so is a pointless and time-consuming task?"
Retail the logs long enough to provide the service and then delete them. Unless HMG rope you into providing them with free surveillance service you don't need to retain them.
It's clear from comments here that the notion is deeply ingrained that everyone with a server has an expectation of mining every last nanobit* out of any data that passes it by. The whole basis of GDPR is that not only are you not actually entitled to do that any more, you're not allowed to. It's going to take some time to sink in.
*Probably the best approximation to what it's really worth is all those "we think you'll like these" offerings are anything to go by.
"Typical, of course, of this Government to actually ignore the existing body of law and simply make stuff up as they go along."
Parliament is sovereign. If they pass a Bill to designate IP addresses as being entitled to the same protection as PII they can do so.
I'd expect that attempting to use an IP address on its own to identify a user in court would still be fraught with the same problems as a present.
"a legitimate right exists to retain the source used to connection from, and share and process it as necessary."
What legislation do you rely on for this statement?
You need to retain that address for as long as the connection remains current. Afterwards you might want to retain it, share it and process it but you have no right to do so.
Nevertheless HMG might impose a duty on you to do so by their surveillance legislation. The document remains notably silent on this matter.
"So, Amazon can refuse to deliver a parcel to you if you refuse to share your address, because without knowing your address there's no way for them to deliver to your house"
Actually they could deliver a parcel to an Amazon locker without knowing your home address so they couldn't actually refuse to do business on that account.
"Are they cancelling out their own snoopers charter?"
Well, the document says Our vision is to make the UK the safest place to live and do business online. With the increasing volumes of personal data there is an increasing need to protect it. so they'll have to, won't they? Won't they?
Now this might come as a surprise but people in offices - all offices, not just in government - regularly talk to each other. They even talk to each other about business. Hardly any of this is written down except when it involves formally taking decisions. The rest of it just dissipates into thin air. So why should there be any expectation that such talk, extended to cover people who are geographically separated, be any different?
Yes, I know there are those who want to be able to comb through records looking for whatever form of wrong-doing they suspect. They're unlikely to find it because if there's any expectation of a particular communication channel being recorded anyone seeking to set out on some nefarious has the option of just plain face-to-face conversation. And the official decision taking will be formally recorded just as it always has been.
"The government needs to lay down a public utility standard - that says fibre to every premises that has an electricity supply within 5 years."
Good idea but your post seems to have been truncated. I don't see your plan for achieving it, where you're going to recruit the army of workers to do this, where you're going to source the materials in that time frame, where you're going to raise the money and how much the customers are going to be willing to pay you for the interest you're going to pay on the money you raise.
"the devices need their own defences to be as good, with the smallest attack surface as possible."
That brings us back to the original article and the point that in this case they don't have the smallest attack surface possible.
I have to take SWMBO to an outpatient eye clinic from time to time. As it involves sitting around for a good while I sometimes take a small laptop to do some work - ooh, look, three open SSIDs! No I didn't try connecting.
"The contempt greybeards always shown towards GUI applications, and any tool designed to ease their development, is on of the reason Linux has a 3% market share on desktop systems."
The reason Linux has 3% market share on the desktop is because of years of Microsoft leaning on H/W manufacturers to ship Windows and only Windows pre-installed.
Years ago, late '80s or maybe 1990 we were running a Unix box with an NCD X-terminal. As a cheaper way of getting more X-terminals we installed a very early version of Windows on PCs as there was X-server S/W available for them (note that in X the applications are clients - the server provides the display service). That's right, the function of Windows was as a platform to display the real GUI which was that of the Unix box. Eventually Microsoft picked up a few GUI tricks that had been kicking around in the Unix world for years and stuck them together to make Win 95. Admittedly they hit a sweet spot with the combination but pretty well everything that went into that had been around in Unix for years, together with some New Wave stuff that HP had devised to improve the functionality of Win 3.x. Up to then, and for a good while afterwards, any serious graphical workstation was a Unix box.
And way before that, maybe 1980ish, we had analytical instruments using graphical displays way before Gates got QDOS at a knock-down price. I remember a Micro-Nova driving an X-Ray microprobe back at that sort of time.
TL;DR Windows was a late-comer in the GUI game and even then it took a few years to grab enough ideas to become usable.
"I am none too sure about the water either, there is some Hydrogen3 oxide around as well."
AFAICR we weren't terribly worried about tritium in the water that went into the benzene synthesis for the carbon dating system although it might well have been because it could be reasonably well separated in the kick-sorter. Radon in the water supply from the Mournes was a different matter...
@Nattrash
Dave Harvey also made the point that they use a specific protocol, DICOM. a moment's googling takes be to the wikipedia article which in turn tells me that DICOM uses specific ports. If the system has to be exposed to the wider internet (as opposed to a network whose access is limited to legitimate users) then only those ports should be open.
"it'd be written on a post-it note on the side of the machine."
A password written on a post-it note adjacent to the legitimate operators is vastly less of a risk than a passwordless remote admin tool.
"the defamation lawsuit will have to be decided on whether GR's T&Cs do infringe."
Having thought about this a little more it now seems to me a little more nuanced than that. The court doesn't need to decide whether it infringes. It needs to decide what would probably* happen if infringement proceedings were brought in a copyright case.
ISTM that the plaintiff has to prove that:
1. The article was wrong. If the article was right it becomes a very difficult task to try to argue defamation.
2. It has to prove defamation. There may be a whole lot of issues in both directions here - should Perens, as an expert, be held to higher standards than the man in the Clapham omnibus? as an expert does he have a duty to warn others? Is he protected by freedom of speech? does this SLAPP thing protect him?
The defence only has to defeat one of these issues.
* Balance of probabilities applies.
"I am a freelancer that believes we must all pay taxes and national insurance in equal share. It costs me more but I have a clear conscience.
If freelancers are so independent why do so many complain when business rules start to apply?"
So was I before I retired (pace blitheringeejit). If you were replying to me (your not quoting anything makes it difficult to work out who you were replying to - threading hereabouts isn't that clear) all I can say was that I was replying to the previous A/C who seems to think that applying business rahter than employment rules to businesses is a scam.
Indeed, re-reading that OP the poster seemed to think that IR35 was a scam perpetrated by freelancers. Very odd.
"But no doubt it was designed and built by people who do everything they can to avoid tax and national insurance through IR35 and other scams."
Do I detect someone who doesn't have the confidence in their ability to succeed as a freelance themselves but still wants to criticise those who do whilst drawing a nice reliable salary?
Well, don't worry if that's you, the freelancers will look after you.
You see, your employers have a problem. They have busy spells with lots of requirements and periods when they don't and they can't afford to staff for peak demand with permies and then pay them for nothing when work is slack. They have to match such fluctuations with those due to permies leaving, going off sick, going on holiday and taking parental leave. They may also require specialist skills at short notice that their permies don't have.
Fortunately they have the fall-back of freelancers who are prepared to operate as a business to take the risks of short term engagements and get taxed as a business and so smooth everything out. The freelancers keep your employers in the game so that they can afford to keep employing those permies who just want a risk free life and yet don't see why anyone taking the risks should be treated differently. The alternative, of course, is that your employers could just get shut of you and outsource their entire IT to the lowest bidder.
In the context of the current topic HMRC's problem might well be that their attitude has lost them the freelancers they were relying on to build the system. It's another case of having their cake (not carrying the costs and risks of having enough IT employees and relying on freelancers instead) whilst trying to eat it (attempting to tax the freelancers as if they were the employees they don't want to pay).
He may well have "witten and shared malware code for research purposes" but it is perfectly fair to argue that he has to accept some responsibility if some of that code is subsequently used for malicious purposes.
Maybe someone with experience of lowish level Windows programming could comment on the possible alternative uses of the code in the blog linked in the article. However, my immediate thought is where does this stop? If a code fragment from some random Github repository gets used in malware is the author guilty of writing the malware?
"I take it the creators of the leaked NSA exploits will be given similar treatment when their code is used by criminals."
Now there's a thought. His defence could well be that what he did in posting an example openly is comparable with the NSA's actions although without the malicious intent. And who better to be able to present that, in detail, as a defence? Do the NSA really want their actions to be questions like this in court? It strikes me that with the NSA leaning on the FBI to keep it out of court he has a far better bargaining position than most.
"this guy with serious eyesight problems"
Maybe they're right; it does make you go blind.
Meanwhile there are alternatives:
c) he's not very bright.
d) smartphone users become oblivious of their surroundings to the extent that they become a danger to themselves ( https://www.engadget.com/2008/03/06/padded-lampposts-for-distracted-texters-being-tested-in-london/ ) let alone fail to realise that there's someone sitting in the seat behind them..
"They tried to pin a terrorist charge on the Robin Hood airport guy."
Frankly, if someone tweets a bomb threat about an airport it has to be taken seriously. Would you want to be the one responsible for dismissing a genuine threat as a joke?
If it was meant as a joke then while charging him with terrorism might have been over the top it at least merited a charge of wasting police time.
"I had to suffer with a 300 baud modem."
Back in the earlyish days of the OU (I think it might have been in the days of S101) the chemistry module had a computational component. As Tutor/Counsellor for more or less everything west of the Bann I had to trog out Omagh with a teletype and an acoustic 300 baud modem which was about the same size as the teletype.
