Posts by Doctor Syntax

Linux kernel hardeners Grsecurity sue open source's Bruce Perens

"That applies to issues of fact, but the meaning of that clause of the GPLv2 is an issue of law."

I don't know if US law has the same complication but I can remember issues of mixed fact and law turning up in an IR35 case long ago. As far as I can remember, the line ran like this:

- The judge* decided on the law in interpreting a contract

- The interpretation became a fact in the case

- It then became impossible to challenge the judge's interpretation on appeal because it was now a fact and the appeal couldn't redetermine facts.

* At that sort of tribunal the actual title might not have been "Judge" but the function was essentially that.

Re: Perens has two shots at winning.

"Expert witnesses don't have opinions in court, they give authoritative statements of fact under oath."

I used to give evidence as an expert witness, albeit in a different field. As an expert I had access to a body of factual information that a lay witness might not (e.g. tables of blood group frequencies) but essentially what I offered was an opinion. The court would accept that as evidence where it wouldn't accept a non-expert's opinion. Experts can offer contradictory opinions in which case, as with any other witness, the jury has to make up its own mind.

Nevertheless a court might well hold Perens more responsible for his opinions that the man down the pub.

"This is a defamation lawsuit, not a copyright infringement lawsuit. ...So, you will not learn whether Grsecurity had a right to do what they are doing from this suit. That is a copyright matter and just can't be litigated in a defamation lawsuit."

AFAICS the whole thing turns on Perens making a comment on whether the GR T&Cs infringe the GPL2 T&Cs. Although you're right in that copyright infringement can't be litigated in the defamation lawsuit the defamation lawsuit will have to be decided on whether GR's T&Cs do infringe. If that decision goes against GR then it makes a copyright suit a bit easier and maybe more likely.

"Tie tends to go the runner(1st amendment)."

Good point.

"Perens may have sought legal advice before making the post(s), but legal advice is not the same as a judgement handed down by a judge sat in his/her court."

That cuts both ways. GR may also have sought legal advice on their T&Cs. It'll now come down to an arm-wrestling match between two lots of legal advice. I wouldn't bet on the judgement but then I'm not a gambler.

Re: #DEFINE VIAGRA

I knew diodesign was asking for trouble with that answer.

"I think Perens is on slippy territority here, and now he's going to have to justify his assertion in court. IANAL so I don't know what the burden of argument needs to be either way, but I won't be betting on him winning."

If the burden of argument in the US is the same as English law than it would be balance of probabilities. I wouldn't like to bet on either side although if it were to go up the courts system through appeals whoever has the deeper pockets stands the better chance. There'll be support for Perens through the FOSS movement. Is anyone bankrolling GR?

Re: Seems fine to me

"If the agreement is only limited to preventing release of future versions, isn't refusing future service within Grsecurity's rights since any business can refuse future service to anyone for any reason?"

I guess this is what they're depending on and probably have a legal opinion to back it up. But this action means that theory gets examined in court to determine whether this is a restriction of rights under GPL2 and what happens in court isn't always what you expect. The risk they run is that the court agrees with Perens and that they then get hit with a suit by a kernel dev.

WannaCry-slayer Marcus Hutchins 'built Kronos banking trojan' – FBI

"is it illegal to sell exploit software?."

Conspiracy charges would cover it if all else failed.

Re: Apparently he does other thing for a living as well.

"the indictment, which I've read at length."

If you think that the few pages of the indictment constitute "at length" you should avoid going near bookshops. The shock might be too much.

Re: Apparently he does other thing for a living as well.

"What I'm insinuating is a development from my presumption of the solidity of the indictment, which I've read at length."

Did your reading include any evidence? I didn't see any. We don't know why he's been fingered as the author of Kronos and until we do we can't work out whether it's a sensible chain of reasoning or has any supporting evidence. Until we get those details I'll carry on wondering why someone with that high a profile would go anywhere near the US if he actually the author of a banking trojan.

Internet's backroom boffins' big brainwave: Put people first in future

Re: sometimes you need a very simple clear rule like this to stop the BS explosion

"Unless the IETF has the backing of law, say by imposing fines or barring access, they have no power to stop a unilateral action like that."

They have the backing of something more powerful than that: reality. Don't forget that those commercial interests didn't put the net together for the IETF's use; they're riding on top of the IETF's work. The whole shooting match only works because it adheres to a set of protocols engineered by the Internet Engineering Task Force.

If they don't want to play by those rules they'll need to go off and invent their own network. There is, of course, a school of thought that this would be entirely beneficial to the internet.

"Whats a TLA?"

First registered here in 2009 & have to ask?

"in recent years, corporate influence on internet organizations has grown"

I doubt corporations are the worst problem. The TLAs will be well in the lead.

WannaCrypt victims paid out over $140k in Bitcoin to get files unscrambled

"There never was any intention to unfuck these infections for the victims."

Those running serious ransomware businesses need to ensure that files get decrypted. Failing to do so wrecks the trust the victims have to have if they're to pay up. Goose, golden egg etc.

Not providing keys would be an indicator of purely malicious intent or incompetence.

"the malware discarded the key rather than sending it to the C&C server"

Wasn't that the later one distributed by the MEDoc server?

Do we know whether anyone who did pay actually got their files decrypted?

Re: The most worrying comment is ...

"To change or reform it is heresy to most voters, and politicians know it."

Which is why it's a given of British politics for each party to accuse the other party of doing so.

Re: The most worrying comment is ...

I'm not at all surprised that NHS Digital can't be sure about every any NHS body.

FTFY

Re: Eh?

"It's been covered extensively."

What has? The North Koreans' arses?

Programmer's < fumble jeopardizes thousands of medical reports

Re: Unnecessary extra scans?

" I wonder if ampersands also cause problems."

And names such as O'Malley.

Re: Markup language

"Maybe somebody tried a shortcut trick and it backfired."

Not necessarily tried a short cut. I've seen repeated failures to escape apostrophes (ironically, mostly in Irish names) keep reappearing. I put it down to each fresh batch of programmers on their 6 month visas having to be educated about generating well-formed XML because they thought you could just copy the raw text to the output.

The Telegraph has killed Prince Philip

Re: House of Lords

"order her Generals to take the cabinet to the tower."

Yes, please.

"I think a modern democracy deserves an elected head of state, what could possibly go wrong with that ?"

The standard answer is that you always get a politician. And then we discovered what can go wrong when ypu get one who isn't.

As to the HoL my preferred solution would be to have at least a good proportion ex-officio from such bodies as the Royal Society and the chartered professional bodies. Of course they'd be experts and get disregarded. What the HoC really doesn't want is an elected HoL, they like their unrivalled status as the elected chamber.

Re: Proof of the Illuminati

"He died from being given a Speedball by the royal doctor"

With the timing being news management so it would catch next morning's Times instead of being announced first on the wireless where it would be heard by men in pubs wearing caps - or something like that.

Re: Proof of the Illuminati

"They already know what's going to happen, they just release information as and when appropriate to their plan."

Remember George V.

"We will be reviewing our publishing processes as a matter of urgency."

A newspaper reviewing its publishing processes because it got something wrong? That should be a headline in itself.

Microsoft breaks Office 365 sign-in pages ahead of surprise update

Hot/Live/OutMail has had this for some time now. It's combined with an animation of dots crawling across the bottom of the name box just before the password dialog is shown. I wondered if this was some kind of mechanism to defeat bots attempting logins.

Canadian ISPs do not Canuck around: Bloke accused of piracy grilled in his home for hours

Re: The true nature of big corp

"And the only way to do that is to directly punish the decision makers, not the corporation."

You punish the lawyer by getting him disbarred.

Re: The true nature of big corp

When I enquired if I could have a lawyer present the HR bloke said "No sorry you can only have staff or union."

It would have been interesting to see what happened if you just turned up with your brother. They probably wouldn't have had the legal nous to determine whether they had the right or not if your brother simply said "See you in court".

Coming soon to a Parliament near you – UK's Data Protection Bill

Re: EU again

"takebackcontrol?"

Let me try and simplify this for you.

Taking back control was sold to the voters (or at least to those who bought into the idea) as allowing the UK people to take back control from some nefarious EU and its courts. It should have failed under the Trades Description Act.

What HMG, and particularly our Home Sec in residence and Home Sec in command, mean is that they, the govt., take back the control that the EU had granted to the EU people.

For instance every attempt by successive governments of whatever colour to undertake mass surveillance has foundered when it gets to court and is judged by those EU standards. When they take back control they can do what they want because they'll have removed themselves from the control of the court that exists to protect you.

Make no mistake, you don't get control; you get controlled.

I've been thinking over the implications of various surveillance laws, including the possible demand for passwords to encrypted devices, seizure of servers etc.

In the real world a company computer might hold information subject to various regulatory regimes including the DPA. Any agency gaining control of such data, either by interception or by physical seizure, usurps the role of whoever would have been responsible in the owner's organisation. This ought to transfer such responsibility to that agency.

Perhaps this Bill would be an opportunity to put such transfer into statute law rather than leaving the issue to be decided in court in the event of a breach.

Re: Laymans terms..

Seconded. An excellent idea.

Apple, Google pull options trading apps after Australian regulator shows scams

"90% of nothing by the sound of it."

But only up to 90%.

90% of what?

If you love your email standards, SMTP your feet: 35 years later

Re: Already exists

"It's called your email address."

And you set up one specifically for your bank (and others for each other correspondent you wish to verify). Added bonus: if it leaks you know who to blame.

Grab a fork! Unravelling the Internet of Things' standards spaghetti

Re: Well ...

"My greenhouse's "smart thermostat" has been running for over thirty years."

It can't be that smart if it's still working. If it was smart it would've retired years ago.

Does anyone else find it alarming that Danny could only find two opportunities to mention the word "security" in the entire article - and one of those was part of a company name?

The BrickerBot's author's work isn't over yet: https://www.bleepingcomputer.com/news/security/brickerbot-dev-claims-cyber-attack-that-affected-over-60-000-indian-modems/

'Real' people want govts to spy on them, argues UK Home Secretary

"I think a larger majority of the population would like their MP's communication open to inspection, not specifically excluded!"

Yes, they probably would. Right up to the point where you explain that that would include some problem that they have that they take to that MP. Then their view might change. They might actually start thinking that it's a problem with any communication they might want to keep private.

Re: "As for Rudd, she must have a gun to her head for spurting out all that crap."

"It is difficult to get a man to understand something, when his salary depends upon his not understanding it." as Upton Sinclair put it.

In Rudd's case I think it's almost the converse. It would be difficult for her to understand even if her salary did depend on it.

Re: The idiocy of this runs even deeper.

"Doesn't mean a ban on all encrypted communications"

TPTB then have the problem of sorting out the banned from the unbanned. They also have to set up a mechanism to allow VPNs on a case-by case basis and I'd like to see them try to blame that red tape on the EU.

Re: The idiocy of this runs even deeper.

"exchanging one-time pads via USB sticks carried by racing pigeons"

How do they exchange the racing pigeons?

Re: The idiocy of this runs even deeper.

"I fear the problem is that everyone else is just as uneducated in relation to encryption, so whatever the politicians say, will be believed...Too many people don't care about privacy, yet."

The first explains the second. But what happens if, instead of asking about Windows 10 telemetry, you ask about the banning of encryption making their online banking more easily hacked? If you put it in those terms I think you'd find people did care.

Facebook pulls plug on language-inventing chatbots? THE TRUTH

@A/C

I want never gets.

Re: 'Language' in chimps and bots...

"All Nim (and Washoe and all the rest) seem to do is produce the words with no meaning attached to word order or repetition."

I think it's fairly clear from the example you quoted that Nim wanted to be given an orange to eat. A moment's thought should show that that involves a concept, eating, that's way beyond anything a machine could begin to comprehend but which is fundamental to the existence of any animal.

Just a minute...

Given the amount of repetition in that sample it's hard to believe there was much, if any, information in there, let alone intelligence. Unless, of course, the information was encoded in the number of repeats.

Another day, another British Airways systems screwup causes chaos

"Although informed sources came up with plausible theories about what happened, the actual cause has not been acknowledged by British Airways."

ISTR reading that BA recently said they wouldn't make the full explanation for that public. I think a visit to the relevant HoC Select Committee must be in the offing.

No vulns. No hardwired passwords. Patchable. Congress dreams of IoT: Impossible Online Tech

Re: @Gene Cash

"Then that short-list would actually be an EMPTY list as a field-deployed, embedded system like that CAN'T be patched. Not only would it be deployed too remotely for anyone to see to it after it's installed, but a safety-related system like that REQUIRES that it be untouchable so that it can't be "hacked" to kill people."

The fault mentioned related to certificates. The only need to handle certificates would be to verify communications. The need to verify communications would only occur if the device could communicate. If it can communicate it isn't too remote to be patched, it isn't untouchable and if hacked can kill people.

Brit voucher biz's signup page blabbed families' details via URL tweak

Kids Pass said that the pair had been blocked “in the early hours of Sunday morning by our 'out of hours' social media monitoring team” and unblocked “within a matter of hours when this error was spotted.”

I think we could hazard a guess that the "'out of hours' social media monitoring team” was outsourced and probably off-shored and that if it had an escalation procedure at all that would have included not ringing anyone important until next morning UK time.

Sorry, psycho bosses, it's not OK to keylog your employees

The EPO's position seems to be that of terrorists everywhere when brought to justice: "I don't recognize this court".