Posts by Doctor Syntax

Hell desk to user: 'I know you're wrong. I wrote the software. And the protocol it runs on'

The other side of this is spending an afternoon working through the vendor's source code (they'd supplied most of it) to discover why their invoicing program was causing the RDBMS engine to eat memory until it had crashed two weeks running.

Re: Possible or easy?

"There could well be a full-featured 3D CAD - potentially fully documented - in systemd, and you might just not know."

Hey, how did you find it? It was supposed to be secret.

Re: Possible or easy?

"But it could easily be a failure of the accompanying documentation."

Documentation? Who reads that?

Revealed: The naughty tricks used by web ads to bypass blockers

Re: Gotta be honest here...

"Im open to suggestions on how to earn circa £150-200 a month without anyone having to pay a bean."

TL;DR beyond this point.

Presumably every page on your site has useful content other than, maybe, navigational pages. So there's nothing difficult about working out what those reading the page are interested in: they're interested in whatever that page content is. So what you need is a way to get businesses who are in a relevant line of business pay a small amount per month for a static ad to take an interested viewer to their own web site. You could try approaching such businesses directly. It could save them money - at the cost to you of some effort - because it cuts out all the middlemen making and distributing the often irrelevant, punter pissing off, bandwidth hugging crap.

"I'm not sure how the business is going to continue."

That's easy to understand. The advertising industry keeps selling advertising to the advertisers. The fact that everybody hates it making it counter-productive is kept well hidden. The advertising industry is very effective at selling. But what it sells is its own product, advertising. Nothing else.

"Do all the fancy stuff to select which image at the server end"

It doesn't even need to be fancy. You know what page the user's browsing. You know what's on the page because it's your page. So you know what he's interested in. After that it becomes easy to add the relevant ad to the page. So easy, in fact, that the advertiser and publisher need very little in the way of middlemen to take a profit from. Now why do you think the advertising industry doesn't try to sell that solution instead?

Re: Hey Instart

"If someone has gone to the trouble of blocking ads and they find a way to get round it, then they are likely to be pissing people off and losing all goodwill, so there is not really any benefit to doing it surely?"

You need to distinguish between the advertisers, those with products or services they want to sell and the advertising industry that delivers advertising to potential customers.

The latter want to push the adverts at you regardless of whether or not it injures the reputation of their clients because they're not selling their clients' products, they're selling their own which is advertising. For them it's profitable to get round ad-blockers. For their mugs clients it's money spent on alienating existing and potential customers but don't expect the advertising industry to tell them that.

John Wanamaker, one of the pioneers of marketing is reputed to have said “Half the money I spend on advertising is wasted; the trouble is I don't know which half”. Presumably he'd have welcomed ad-blockers because they'd have instantly cut out a lot of his wasted - and very likely counter-productive - spending.

Can GCHQ order techies to work as govt snoops? Experts fear: 'Yes'

OK, to lighten up this debate - assuming a warrant comes with a gag order how do TPTB prosecute someone who refuses to obey the warrant?

Re: What if...

I am not a lawyer, but if I were defending an employee who had been fired...then said employee would be extremely unlucky.

Re: Off the leash

"or rather, the ones that are vague alluded to as being telco-ish which IMHO a lot of horse manure without a formal license, but we'll leave that aside for the moment"

Why would we leave it aside? If the definition doesn't specify a telecoms operator as conforming to your personal definition, i.e. being a licensed operator, then your argument collapses. The Act says what it says, not what you think it should say.

"What do you reckon?"

I reckon over-broadly worded legislation straying well beyond centuries-old legal limits parading ministerial authority as due process of law and under-scrutinised by Parliament is a dangerous thing.

I also reckon that possibly the notion that a warrant could be served on an individual and binding on a telecoms provider may have been intended to allow someone to collar a bloke driving an Openreach van and tell him, as a representative of a telecoms provider to put a tap on a given line without going through too much paperwork. I further reckon that even if that's the case it's open to misuse far beyond that.

Re: What a load of complete cobblers!

"The UK courts do not give out warrants compelling people to provide services for anyone"

Well, they certainly don't in these cases. It's the Sec of State (a certain Amber Rudd of proven keen intellect) or someone wielding her rubber stamp.

That's one of the concerns.

Warning: this post may contain traces of sarcasm.

"And you know that how?"

Have you heard of a Mr Snowden?

Re: Does that mean

"and what about coffee shops / pubs that provide Wi-Fi for customers? are they operators under this?"

If the summary given in the article is correct then it would appear that they are. Whether that's by intent or by carelessness is a matter for conjecture. It's an aspect that should have received scrutiny in Parliament If my ex-MP's attitude was anything to go by I doubt there was much enthusiasm for such scrutiny, at least on the govt. side.

In a way I'm a little sorry he isn't still my MP, if he were I could keep asking him to clarify such issues that he voted for so unthinkingly.

"it's just possible that they come across some expert who is actually willing to help put some scumbag in jail."

Indeed. I have been that very expert. But (a) it was part of my job and (b) it was part of a long-established legal process. It would have been somewhat different if it involved mass surveillance of a sort which has already been struck down in court in a previous guise, which I might fear to be illegal under over-arching European legislation (which, thankfully, still exists to protect us against government overreach) and which, in my view, goes against the long established principle of the presumption of innocence.

OTOH if I found myself in an employment situation where I discovered such scumbag activity I would probably find myself becoming a whistle-blower although oddly enough intelligence agencies don't seem favourably disposed to these.

Re: "threats about what would happen if they revealed its existence"

"Are we in democracy or not ?"

Any answers?

Re: Who cares?

"They have quite enough experts of their own, they're not going to suddenly drag Admin Joe out from his day job to help them bring down some chinese cyber team."

No, but they might call on Admin Joe at home and tell him that when he goes into work he's going to have to set up something to copy all Fred's internal emails to HMRC/DVLA/dog warden. It would be a lot easier than going to GCHQ and asking them to spend however long it takes to gain surreptitious access to the system.

It's not as if we've never seen overreach in the past.

Re: What if...

"I therefore conclude that the law is an ass."

You probably conclude wrong.

- Warrant served against telco.

- Telco directs employee to implement it.

- Employee refuses.

What happens next? Employee has refused a legitimate order (legitimised by the warrant) so can be fired without a basis for comeback although an Employment Tribunal hearing might be awkward with a gagging order in place.

Re: Who cares?

"The chances of Mr Average IT person who hasn't signed the official secrets act ever being called up by GCHQ is so vanishingly small that its virtually non existent."

I'm not sure about that. From TFA:

Section 261 of the Act defines that a "telecommunications operator" is anyone who provides or controls a communications network of any kind. Paragraph 10 of Section 261 talks about how you are also considered to be a telecommunications operator even if you only merely "control" the telecommunications system in question; actual ownership does not appear to be required. That would appear to obligate some third-party maintenance vendors to assist with a Bulk Equipment Interference warrant issued against equipment owned by their customers.

"A communications network of any kind" would include a company's internal network* so a warrant could be served on a company's own BOFH to compromise his employer and be gagged from saying anything about that. It might not be intended but once the facility is there abuse tends to follow; we've certainly seen reports of this in the past.

*It could even include a domestic WiFi link to the router!

TalkTalk fined £100k for exposing personal sensitive info

Re: No surprise

"Within the week, they'll have marketing saps* camped outside many major Shopping Centres"

And if they appear at mine I'll explain loudly and at length why I changed a previous ISP after they took it over and why they're a laughing stock in the entire IT industry for their ineptitude.

News from next month, "TalkTalk anounces unavoidable price increase of £1 per month per customer due operational cost increases"

Given that their ?only selling point is price there's a limit to the fines they can pass on.

Re: Role based access control

"They were fined £100,000 of a possible £500,000. 1/5th the maximum fine. The 4% fine would not be applied under the GDPR. "

Let's look at it another way. From their 2016 annual report let's take the headline income before various deductions as the turnover. That's £1,838m. 4% is £73.52m. Now apply a 1/5 maximum and that comes out to £14.7m. So taking the same % of the new maximum fine should be enough to get the board's attention.

"No organisation will be hit with anywhere near the maximum fines. We will see fines around the same levels we are seeing at the moment."

Citation needed

Manchester firm shut down for pretending to be Google

Re: Fake invoice scam (been around forever)

"Some gullible accounts payable droid dutifully pays the invoice"

An accounts droid who pays out without a PO is more than gullible but downright incompetent. Hence the first response to a phone demand should be for the PO number.

Re: The lads from Lagos..

"They will just start again under a new name"

TFA states plainly that they are disbarred from acting as directors and breaking that will be a criminal offence Not a company criminal offence but a personal one.

Why this sanction isn't more often used I don't know.

Me (reading from counter-script script): "Fuck off and get a proper job." *slam*

There you are, then. No public spirit. No effort to waste time they could spend looking for someone more vulnerable.

Re: SEO/Domain Registration scams.

"I had a similar one the other day, turned out to be from a search engine optimisation company."

They're easily identified by the fact that they never have their own website that can be easily found by searching for "first page on google" - purely so you can check their abilities of course.

If I've nothing to do I sometimes reply politely pointing out that they seem to have omitted that and, by further, oversight, have used gmail rather than their own domain. I then run through the rest of their mail pointing out the bad grammar and asking why anyone would want to put their own reputation in the hands of someone so sloppy when making a pitch. I assume they're pleased with their English prowess although it's possible they bought the email text along with their cheap spam list.

Re: SEO/Domain Registration scams.

"It's time that WhoIs info is only available by warrant and not to random members of the public."

????

Whois is one of the first lines of defence of the public against these scammers.

General rule of thumb, don't just give money to people who ask for it over the phone.

"I'll need a purchase order number."

"No, sorry, it's company policy. I just work here."

"Sorry, I can't give out that information. Data protection."

You just need a counter-script script.

Berners-Lee and the open-data bunch: £60k for your best collab dataset register ideas

"having so many stakeholders can end up causing management headaches and confusion for users."

And no amount of money is going to make that problem going away.

Even talking about stakeholders is part of the problem unless you acknowledge that each and every data subject is a stakeholder.

So you're thinking about becoming an illegal hacker – what's your business plan?

"Obviously, using pseudonyms is a must. Changing them frequently is also an excellent idea, even though it may entail additional work on your part."

Using a pseudonym associated with a security researcher could be a good wheeze (see framing someone else).

Salesforce sacks two top security engineers for their DEF CON talk

"What can one conclude about a company that behaves like that about employees who care?"

The conclusion is the message. Of course it's a message the execs who sign the POs won't get.

Corporate criminal tax offences likely to further increase HMRC's use of dawn raids, says expert

"Obviously HMRC have read BOFH and a dawn raid ensures there's no unexpected cattle prod/Hector interface issues."

A competent BOFH will have removed the tile just inside the server-room door. Once Hector has made it past the portcullis, booby-trapped guillotine blade etc, it'll be straight down into the oubilette.

Stops a company from saying "Well, they're not an employee of ours, so it's not our responsibility."

Yup. Maybe I should have queried "facilitating". In the instances I gave the stationer, printer and cartridge vendor and Royal Mail could all be argued as facilitating. At the very least there's an opening for a reductio ad absurdum argument in defence.

Re: Time to rein in the use of dawn raids

"Why are they being used by the tax agency?"

Overtime and/or unsociable hours payments?

"From 30 September, it will be a criminal offence in the UK if a business fails to prevent its employees or any person associated with it from facilitating tax evasion."

What does associated mean? Someone buys a ream of printer paper at the local stationers and uses a few sheets to print fake invoices. Is the stationer at fault because it didn't ensure (how?) that its employee didn't take steps (what steps?) to make sure the customer wasn't going to use any of the paper to evade tax? And what about the printer manufacturer? The printer cartridge supplier? The Royal Mail for delivering the printer cartridges?

Marcus Hutchins free for now as infosec world rallies around suspected banking malware dev

Re: Blind support

"blame the ambiguities of the English language for that one"

The original would have been stated in medieval French so anything else is a translation or restatement.

Re: Blind support

"Yes, innocent until proven guilty, but it appears there was enough here to arrest him and make charges."

The one bit of solid evidence that's emerged seems to be that he wrote an explanatory post about some code which was then sent to a Github repository and subsequently incorporated in the trojan. If that's what the FBI mean by writing malware then I'm sure a lot of people who've pubished code on Github or elsewhere, answered questions on Stackexchange and the like should avoid visiting the US.

We don't have much info on this chat exchange to put it in context or even determine whether it was Hutchins or some other person using the same handle.

And the from some of the quotes in the article it rather sounds as if some of those who knew him fear it's a case of TPTB starting to shoot the messenger.

In the meantime I can't help wondering why, if this is a true bill, why he would have gone anywhere near the US.

If this ever gets to court it'll be interesting to hear a comparison between his contribution to Kronos and the NSA's contribution to Wannacry. I'm sure the defence would want to raise it.

Windows Subsystem for Linux is coming to Windows Server

Re: Oh joy, more embracing...

"where will it all lead?"

Maybe the Linux runtime will include stuff that requires systemd. Systemd included in Windows? Maybe Poettering will end up going to work for Microsoft (was that a voice at the back saying he already does?).

Oh joy!

70% of Windows 10 users are totally happy with our big telemetry slurp, beams Microsoft

Re: How-to

"check occasionally that it hasn't been re-enabled by updates"

That's the rub.

Eternal paranoia is the price of freedom. Vigilance is not enough.

Re: Windows privacy portal

"All it achieved was Microsoft spam to her email address"

Set up an address beforehand specifically for this. Then discontinue it or at least ignore it forever afterwards. Added bonus, make it a HotLiveOutmail address and let Microsoft store their own spam indefinitely.

Re: spends most of its time updating

"If you only turn it on for an hour a month then it downloads and starts installing all of the updates, you turn it off in disgust as it's used half of that updating"

The great mystery to many of us is why it needs to do updates this way. Earlie todayr I got an alert that my system had one update. The system's discovering that had no noticeable effect on performance. I don't set the system to autoupdate so a few moments ago I ran the update. One package was updated: 258kB downloaded at 636 kB/s and installed with no noticeable effect on performance. The whole update took seconds of elapsed time.

Clearly there'd be many more packages to update if I left it to be a monthly task. Even so I know from large updates, say the mass that occur when, as you describe, an infrequently used box is switched on, that it doesn't take anything as long as the equivalent Windows update, it doesn't impede performance to any noticeable extent, it stops and restarts any services which have had an update without reboots, it doesn't require long delays to shut down after an update nor on the consequent restart and, in fact, the only sort of update that requires a reboot at all is when the kernel itself has been updated.

FreeBSD is pretty similar (it's a while since I tried PC-BSD, based on FreeBSD and found it to be inexplicably similar to Windows in this respect).

So why is it that Windows updates are such a major production?

Re: No need to change the default settings! Erase all of WIN 10

"Where would the comments section on a Windows news story be without someone taking the time to tell everyone that they use Linux?"

Don't you find it just a touch ironic that Microsoft not only collect money for the licence want ongoing payments in data collection and displaying advertising whilst Linux distros don't demand either and yet it's the latter you implicitly criticise?

Re: MSFT and Facebook

"It would be preferable if you could name ALL the guilty parties"

Unfortunately the margin isn't big enough.

Re: No need to change the default settings! Erase all of WIN 10

"Should have gone to System76"

For those of us in the UK this seems rather a long way to go.

Re: No need to change the default settings! Erase all of WIN 10

"Too bad that so many seem to be so blinkered that they can only see one monopoly."

Are you implying multiple monopolies?

ROFLMAO

If we're in a simulation, someone hit it with a hammer, please: Milky Way spews up to 100 MEELLLION black holes

Re: So it was just a case that no one had bothered to do the calculation?

"IOW why did it take so long to find one?"

Once the instrument had been built it didn't take long. So the real question is why it took so long to build. If you want an answer to that then Google is your friend. Just go and read what it involves.

Foot-long £1 sausage roll arrives

"Veganism is cow genocide."

I've come to the conclusion that vegans really don't like animals.

Assange offers job to sacked Google diversity manifestbro

Re: A job in the Ecuadorian embassy?

Maybe he's looking for a decoy. Someone leaves embassy disguised as Assange whilst Assagne leaves by back door disguised as....well, disguised.

Re: Well..

"Discernment and critical thinking appears to have been pressed out of people's brains by MSM/TV (a bit like apple juice is squeezed out of apples to make cider I reckon)."

No, your apple juice simile has a positive outcome.

It's cider -->