Posts by Doctor Syntax 42421 publicly visible posts • joined 16 Jun 2014
Interesting calculation. But you've omitted the cost of testing the ability of the existing applications to run on W10 and remediation or replacement of those that won't. An OS exists to run applications. These are the very arguments used against FOSS in such circumstances.
There's no silver bullet.
They knew the code had been stolen. But they chose not to activate the "kill switch".
Not activating it immediately it was stolen was reasonable. If they had the malware operators would have noticed it because they'd have had to debug it to get it to work. However they should have been watching for a release and thrown the switch as soon as they discovered it in the wild.
The NSA have a lot to answer for here and I hope govts. around the world let the US know that.
"But it's TRAINING."
And counter-training unfortunately. You train people to use email safely. Outside of your training session marketers everywhere are counter-training them to accept HTML mail as normal. Banks and others are counter-training them to click on URLs in their HTML mail. Social networks are counter-training them to throw complex files around. Gmail and the like are training them to view their mail through a browser, described here the other day as not a single point of failure but a whole three-dimensional space of failure.
"11. Update the antivirus version on regular basis and keep the definitions updated on a daily basis."
Today's definitions won't protect against yesterday's infection. And if that infection is also an aggressive worm as this was that's not going to be much use.
"12. Keep the computers and servers up to date with Windows updates and security patches."
In 15a you go on to explain why this isn't always possible.
"MSNet ports out there waving in the breeze of the general Internet"
Assumes a fact not in evidence. If you have a system with substantial internal SMB linkages than all it takes is one person to open an email booby trapped with a worm. The externally exposed port is your email port and that isn't going to work without being open externally.
you tell me what the "most basic principles of security" are that Microsoft have missed in current Windows and we'll see if your GNU/Linux distribution of choice has or has not also missed them.
OK. MS have always been a bit obscure about what any given fix does. Given that, in the real world, fixing one problem sometimes causes another. Recently they've taken to rolling multiple patches into one so it will take longer for sysadmins* to test and roll out.
My chosen distro is Debian LTS, ie systemd-free. Over to you.
*A good sysadmin is paranoid about everything.
"does this mean we can now collectively sue the Trump administration"
Downvoted for gratuitous Trump insertion. Clearly this goes back some way beyond the current administration. There may well be good reasons for suing the NSA, assuming they're not legally protected. There are also good reasons for being critical of Trump but conflating the two issues when they don't belong together weakens your argument. Learn to stay focussed.
"Simple."
The word you're looking for is "simplistic".
As has already been pointed out all unpatched versions of Windows are vulnerable. Patching itself introduces risks - patches have been known to break things and now that MS are rolling multiple patches together those risks are increased. So patching also involves testing and testing takes time.
The specific risk for XP is that it doesn't get patches. But, again, the issues with XP aren't simple. In many cases it will have been retained because something mission-critical depends on it and replacing whatever that is may require major expenditure and further risks. If your MRI scanner, for instance, relies on a no-longer maintained piece of XP-only software do you simply put your hand in your pocket for a few million to replace it, commission a rewrite and take the risk that it may fail in some respect to emulate the existing product or do you keep using XP?
These sorts of issues are not easily solved. Of course they only exist in the real world so please feel free to keep helping with your advice.
"On stand-alone PC's, ensure you have an adequate AV solution"
The problem with this is that the signature for any new malware won't be available until the target has been released, infected systems and been reported. When something spreads as fast as this has done that will be much too late.
The only call I ever got from one of those is one I missed - it just came up on the phone's missed call list.
What I do get from time to time is SEO spam in my Hotmail spam bin - that and phishing scams pretending to be from Outlook etc are the only ones that the Outlook filters let through. Occasionally I've delved into the Hotmail junk folder and sent replies to the usual amazing business propositions written as an out of office response and giving them the SEO address. After all, they're all in the same line of business so surely they'd appreciate the introductions.
Other responses are to ask them for the URL of the site they're sure they can improve because otherwise I can't tell which of my many(!) sites it is. Oddly they never respond. Another, bearing in mind that they're probably very proud of their English* is to reply pointing out how badly written their email is and I doubt that if this is the best they can do they couldn't be trusted with a site.
More recently I've taken to pointing out that if they're able to get first page in Google their own site must be on the first page if I search for "first page in Google" in Google but they seem to have omitted its URL so I can see for myself and what's more it's odd that they're using a gmail address rather than their own domain. Usually, of course they can't reply because their long established company - whose name they also managed to omit - is just a single chancer without a domain let alone a web site.
But then I got a reply from a different name. I realised the spammers are just taking any responses and selling on the leads. The reply came from a real business based in India but with branches in the UK (Streetview finds it above a "language school" in a shop-front in Longsight) and Australia, presumably the owner's cousins, brothers-in-law or whatever. He included a number of reference sites to I wrote back pointing out the errors in the UK examples: bad copy ranging from poor English to complete nonsense, over-dependence on Javascript and news items that broke off in mid-sentence - even mid-word. I've not heard back but I wonder if his Mancunian cousin got a bollocking for slack work.
*I wonder, however, if they've bought the text of the email along with the spam list.
"1: You do not normally have to use Windows. There are more secure alternatives."
As others have said there's a lot of specialist kit for which only Windows drivers and/or applciations exists (which version of Windows is another worry). So it's not as simple as that. However there should be proper network segmentation to protect these.
OTOH plain vanilla desktop office/mail/web machines could well be shifted to other platforms. However this would buy time, not complete protection. A booby-trapped email will inevitably find a supply of boobies if it's widely spammed.
What's needed is a better architecture that doesn't allow some random application to save or update whatever file it wants.
"ever tried deleting/moving/modifying a file on a network share that you only have "read" permissions to?"
Those file you only have read permission to - how did they get there? Could it be that someone has to have write permission?
On a more practical, albeit longer term scale alternatives to simple shared folder need to be looked at. As one approach I'm currently setting up Nextcloud at home. I have several alternative ways to share files with a client. One is to use the webdav client to sync a specific desktop folder with the server. That means that even if I had a ransomware program running wild on the client PC it could only (a) affect files on the synced folder and (b) the contents of the folder on the server are versioned so that the last good version can be restored.
Linux has been on ARM devices for a while. And:
# apt-get install p7zip
[...]
Suggested packages:
p7zip-full
The following NEW packages will be installed:
p7zip
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 268 kB of archives.
After this operation, 812 kB of additional disk space will be used.
Get:1 http://mirrordirector.raspbian.org/raspbian/ jessie/main p7zip armhf
etc. but that "arnhf" gives the game away - this isn't emulated, it's fully native.
"Noone has the slightest interest in archiving years of invitations to go to the pub or links to cat videos."
Personally I've no interest in any crap for which the main purpose is the dissemination of cat videos.
"It's not even a youth thing: I'm 58 years old and never email anyone, outside of work."
Maybe you're prematurely aged and live a very restricted life if you don't actually do anything online that requires email.
"If there are Thunderbird developers still in existence (and I frankly doubt it), they have rejected each and every one of your ideas every hour of every day for years upon years."
Good try at trolling. As they incorporated Lightning (see my previous post) that's at least one of his suggestions that they haven't rejected. What's more their not rejecting it pre-dates his posting it.
On the whole I have some sympathy in their trying to ignore HTML and the like. It's an abomination in email.
"All I would ask, is for some decent native CalDAV implementation. The Calendar plugins always seem a bit "tacked on" and not fully integrated, and sometimes will cock up."
From https://support.mozilla.org/en-US/kb/using-lightning-calendar-add-on
Starting with Thunderbird 38, Lightning is bundled with Thunderbird. This means you don't need to install it separately, but simply confirm to use it once you create a new profile or upgrade from a previous version of Thunderbird.
What's not, AFAIK, built in is Lightbird, an add-on to Lightning which provides a the calendar in its own window with a somewhat different and, to my mind, better interface. Native CalDav would also be useful.
The outcome I'd like to see is one that was discussed back when this was first raised: Thunderbird (and Lightning) joins the Document Foundation (i.e. LibreOffice) and preferably takes the other orphan child, Seamonkey, with it. LO would be able to add a mail client and PIM and, if Seamonkey is included, a browser. The interface could then go back to the old style which would better fit in with LO and maybe there'd be money to add in its own CalDav connector instead of relying on SOGO.
"fewer potential exploit avenues"
Just a few big exploit avenues: Google, Microsoft, Yahoo, your ISP etc.
"and/or points of failure."
The same.
One point about ISP-hosted email: people just assume it's there and always will be. I read of one person who changed ISP and then discovered, too late, that his emails were on someone else's computer because he hadn't downloaded them and because he wasn't a customer his email account was closed so all his old emails were lost.
"cameras being moved so they did not read plates, as well as other attempts to damage them including setting them on fire."
There's also scope for a sort of crowd sourced DDOS attack. Make up flip books with number-plate fonts, each character being individually flippable and just show a rapid succession of randomly flipped "number plates" to the cameras. With a bit of extra planning the same number could be shown to widely separated cameras at more or less the same time.
"SLA's around it all"
Do those SLAs actually prevent things from going down?
Do they actually provide compensation for the real costs to the client when they do go down?
Do those trying to fix things when they go down have your, the client's interests as their prime motivation or are they just working to the SLA?
"You do have to wonder if Comey will now be much more likely to spill the beans the next time he's up in front of the committee."
A good question for any committee member cross-examining him: "Mr Comey, would it materially change your views on security of communications to learn that the President ordered your phone to be backdoored and that you were fired because of what was overheard?"
Although it's a speculative question and he'd reckon the premise was almost certainly untrue he couldn't be sure it wasn't so it would immediately get him thinking back recent conversations to see what might be held against him. It would soften up his defences against the next question which would be the real one.
And I'd like to see what being out of office has done to his thoughts about communication security.
"In fact, I don't even see a great deal of point in moving around providers, as they all use the same Openreach network anyway, and television programming is basically Sky or Freeview."
There are other variables. How secure is their customer information is a good starting point. Who provides customer support and from which continent is another.
And how about traffic shaping? One little gem from TT when they took over my previous provider was that they traffic-shaped nntp during the day. In fact they pretty well shaped it out of existence despite the fact that one of the services they'd taken over was Usenet provision.
"why in 2017 are people still able to run a viable business developing diaries?"
It sounds more like an unviable business failing to develop diaries.
But in answer to your question, from extensive experience around the courts in the past, looking at it as a diary is probably the wrong approach. Think in terms more of a production planning system where some stages are unpredictable in duration and where the resources needed are being shared with other production processes, some of them quite some distance away.
