Posts by Doctor Syntax

A webcam is not so much a leering eye as the barrel of a gun

"if I'm feeling in a particular tin foil hat mode I'll just unplug it."

Why not make a little tinfoil hat for it?

Knock knock. Who's there? A Lenovo server salesperson, because revenue dip's no joke

"while Lenovo got lots of lovely product and capabilities from IBM it didn't get a direct sales force."

Surprising. IBM seems intent on shedding just about anybody who does anything (i.e. anybody but senior management). I'd have expected they'd have let them have an entire sales force.

US visitors must hand over Twitter, Facebook handles by law – newbie Rep starts ball rolling

Re: What is social media?

"Does El Reg count?"

No, we're all anti-social here.

"I've never made a law before, so it's completely shit, but let's hope my laws don't get passed until I know what I'm doing."

Nevertheless he's ensured his bill not only has a cute acronym but that it's recursive. Surely that's 90% of the way there.

Global IPv4 address drought: Seriously, we're done now. We're done

Re: Some of you guys worry me greatly.

you're meant to be "tech" people (whatever the hell that means this day of the week) or sysadmins etc

It might have escaped your notice but there are now several people who aren't network admins, sysadmins, DBAs or whatever who actually have internet connections to their homes.

In fact there are a lot of them.If IPv6 is ever going to be rolled out it's got to work, work well and work securely for all these people as soon as they lift their router/firewall/whatever-naming-hair-you-want-to-split out of its cardboard box. When I read comments about how any competent sysadmin should be able to set up IPv6 routing I know this issue isn't being addressed and a successful roll-out is just receding into the distance.

Re: Address allocated but not live

"This is a really naive attitude and it is exactly this attitude (and ignorance) that makes the IPv6 transition so difficult."

What makes the transition so difficult is an almost will-full refusal to look at the the problems it causes on the ground.

"This is not a problem with IPv6, but instead with your network topology. Put them on a VLAN that doesn't route to the Internet, or use a firewall to prevent traffic to/from them."

Right. Tell me how Joe Soap, who can't put his webcam on the net without getting it bounced into a botnet within minutes is going to accomplish all that. Because that's the core problem.

Re: Address allocated but not live

"No, I'm pretty sure that most people do want their stuff on the internet."

More likely people want the internet on their stuff but not necessarily the other way around. They want to connect their laptop, desktop, tablet, phone etc to the net. What they don't want is Joe Random on the net connecting to the above. It's a one way thing.

A smaller set of stuff doesn't get connected either way - my printer and NAS don't need to see the net, nor do they need to be visible from outside.

Then there's another class of stuff that some folk do want on the net: their Nest, their webcam etc. And just look at the problems that's causing for everyone else; most of us would be happier if none of that had got on the net. It's been a big illustration of the problems that happen when Joe Random can connect to their stuff.

The first case has been handled well by IPv4 & domestic routers for a long time and a part of that is that NAT ensures that the individual device can't be directly addressed from the wider net. At the same time the services behind the router/firewall/whatever can talk to each other; I can print from my laptop or exchange files with my NAS. Somebody in another comment mentioned NAT breaking end-to-end routing. That's just what these use cases need.

It's these first use cases that need to be addressed simply by IPv6. Being told that address randomisation answers users' concerns by preventing being tracked is a failure to understand the issue. My printer isn't going to be tracked anyway but what I don't want is someone coming across my printer on its current randomised address and either dropping a load of stuff to be printed just because they can or taking advantage of a zero-day to enrol it into a botnet.

Nul points for Ukraine's Eurovision ticket site fail

Eurovison fans? Does not compute.

Haven't deleted your Yahoo account yet? Reminder: Hackers forged login cookies

Is it a coincidence that this just surfaced after they're supposed to have reached a new agreed price with Verizon?

Talk of tech innovation is bullsh*t. Shut up and get the work done – says Linus Torvalds

@DropBear

In such situations there's an obvious advantage in always being right.

Re: Linux is not dominant on servers:

" On large business servers segment, Linux does not even exist. That segment belongs to IBM Mainframes"

{Cough} http://www-03.ibm.com/systems/uk/z/os/linux/

"Is it just me or does Linus tend to have a lot of process problems"

It's not just you as others seem to come to the same conclusion. It's a consequence of your looking at the exceptions, not the rule. Consider the situation:

- He has a huge number of contributors

- He's probably never met most of them

- He never recruited any of them

- He doesn't employ any of them nor work for a company that employs them

- He doesn't provide any annual assessments of them

- He doesn't recommend pay levels

- He can't fire them

If you were in that position and responsible for a project of such magnitude what management tools would you have to hand and what process problems might you experience?

As Microsoft touts Windows Insider for biz, let's take a look at W10's broken 2FA logins

<em.Since when has Microsoft worried about randomly borking machines of "a small number of users" with Windows update</em>

In PR speak "a small number of users" means "any number up to and including the entire user base. Possibly several times over."

@anthonyhegedus

I think there's something in common in all these. People need an OS to just work and just keep working. They want it to be secure - and that includes not being snooped on by the vendor

The claimed rationale behind W10 actually fits the first of these: rolling updates to accommodate new H/W, fix bugs and occasionally meet new requirements and standards in IT.

What's not good is the implementation The initial release should have been fit for purpose and updates should have maintained this status. There is plenty of evidence that that isn't so.

The idea of giving feedback from users about performance as an aid to this is reasonable. Again the implementation isn't; if I have a KDE application crash, for instance, I can choose to have it send a crash report, if I'm using Debian I can choose to let my installation participate in popcon. And then there's the appalling privacy policy of W10.

It seems as if MS marketing needs to get right back to basics: find out what the market wants and needs from an OS and then tell the business to produce that. The alternative function of telling the market that what it wants and needs is the particular crock the business has actually produced is going to work less and less well.

Nevertheless the astroturfers will probably be along here any time now to tell us how wonderful it is and downvote anyone who says otherwise.

"those nutties still on XP"

Let's way you have a big piece of kit, something expensive and medical, something expensive and industrial - whatever. That kit is an integral part of whatever your employer does. It would cost hundreds of thousands or upwards of whatever currency units you work in to replace and there's no money in CAPEX for several years. It's controlled by a PC using proprietary S/W and protocols connecting PC and machine together. That proprietary S/W only runs on XP, or is only certified to run on XP and regulatory considerations mean you have to follow the certification.

Are you a nutty if you (a) continue to run on XP, (b) scrap a hugely expensive piece of kit and discontinue the service it provided or (c) consider users in this situation who continue running XP to be nutties?

I know how I'd answer that question.

Identity disorder: Does UK govt need Verify more than we do?

Re: Journalistic standards are slipping

Too easily confused with the other "mad Frankie" - aka Frankie Boyle.

You're new here, aren't you.

Re: Beware of simple thinking

d) Not focussing on design at all - but maybe we're thinking about different meanings of "design".

Journalistic standards are slipping

"Francis Maude"

Whatever happened to "mad Frankie"?

Dirty data, flogged cores: YES, Microsoft SQL Server R Services has its positives

Here's the real rub: running R Services in SQL Server 2016 is running analysis on your transactional databases. That's your live database, your R code is running inside your production database, eating the CPU cycles and disk access, slowing down your expensive SQL server.

You could use a second server to run R, but then you've got the potential network bottleneck of moving the data back and forth between the machines.

That's only one of the problems. The data inside a transactional database is not designed for analysis; it's likely to be dirty, inconsistent and full of errors.

Let me second Joe's comment about dirty data.

Apart from that, you can always restore your transactional DB backup to your analytical server. That way you get real data and test the restore procedures at the same time. There may, of course, be other issues with this - such as data protection - but the objection as quoted really doesn't stand up.

Former NSA techies raise $8m for their data governance startup

Trust is a tricky thing. I'm sure there are many trustworthy NSA and ex-NSA folk. Unfortunately the reputation of their employer is apt to stick to them. Would you really trust an ex-NSA employee who isn't currently being hunted by the USG as a whistle-blower?

Cloud industry body sets up new data protection code

And about time too

However:

1. Is this PDF a draft or a final document? Even at a glance the number of bad page breaks suggests that nobody has proof-read it. On a more detailed reading there are places where the wording could be significantly improved. A particularly egregious example is A CISP may choose to declare only specific of its cloud infrastructure services as adhering to the Code Requirements.

2. The code provides regulation of the location of data processing to be within the EEA. It doesn't address data sovereignty fully. If the CISP is owned by a non-EEA entity it might find itself subject to the sorts of demands as we see in the Microsoft and Google email access cases in the US. There needs to be a requirement for something like the Microsoft/DT trustee arrangement or the DC being operated by a wholly EEA company under franchise from the foreign business.

3. There's provision for self-certification. This needs to be restricted. For instance I use a small data registrar & hosting business for my personal email; it might be unreasonable to expect such a business to be economically audited by a 3rd party. The Microsofts & AWSs should be, especially when data mining is also part of their business.

4. The code states that security of the guest OS is solely the customer's responsibility. The customer should be responsible for not letting in malware or whatever but if the OS is initially installed by the CISP from their own build or profile they should have a responsibility for ensuring that that install is clean.

Would it also be too much to ask that data controllers, the CISPs' customers, have a similar code of conduct including an undertaking to only use CISPs who abide by this code of conduct?

GitLab invokes the startup defence to explain data loss woes

The main requirement for a sysadmin or DBA is paranoia - vigilance is not enough. Technical knowledge comes a close second. It seems as if nobody there was sufficiently paranoid although they might be now.

Re: Lucky!!

"What do you do?"

Back it up - and make sure it does back up - before you delete it.

"Startups simply don't want to engage on the important things because they think they know it all."

This fits nicely alongside a comment in the article:

"The defence also permits startups to take their eye off the ball a bit as they pour scarce resources into urgent priorities."

It's yet another lesson we can learn from "Yes Minister": important and urgent aren't the same thing. Stuff that's important has to be done. There's a lot of stuff that might be urgent but it should only take priority if it's also important If your job is looking after other people's data then making sure you have effective backups is very important indeed; it's a ball that you can't take your eye off.

OK, it's time to talk mass spying again: America's Section 702 powers are up for renewal

Maybe the Committee should indicate to DNI that they will defund him unless they get meaninful answers to their questions.

Forget quantum and AI security hype, just write bug-free code, dammit

Re: We already have the techniques!

I was taught something called, "software engineering." That's when you take a spec

Shouldn't the engineering include getting the spec right?

Re: 1980s computer science

"First course was with punched cards."

Maybe that's the secret. Only having 3 compile/run slots a day helped concentrate the mind.

Re: 1980s computer science

"IT world has often a problem when something becomes fashionable"

Which is just about all the time.

But why does designing things, implementing them and then not screwing them up with revisions* never become fashionable?

*I've just come here from the Mozilla thread.

Re: 1980s computer science

"I saw many poorly defined interfaces that did not logically separate various aspects of the requirements."

I have to say, though that the worst instance I saw of that was back in the '80s. It gave all of a customer's users access to all parts of the application irrespective of their responsibilities and all too often the functionality needed for one user screen was associated with another. Most of the 9 months I spent with that firm before bailing were taken up with starting to sort that out.

UK credit broker fined £120k for spamming folk with five million texts

Maybe the affiliates should also have been whacked.

Pwnd Android conference phone exposes risk of spies in the boardroom

a mature security posture

The mind boggles.

'We need a new Geneva Convention to protect all citizens from snoops'

Re: WTF?

"How the feck could he spout that with a straight face"

He's a lawyer. It's a thing they do, especially when pushing a case. He's pushing a case against the USG re email from servers in Dublin

"They only started caring when they were given no other choice but to do so."

AFAICS Microsoft policy will swing in whatever direction seems best to Microsoft at the time. Currently it's good to see that Brad Smith is standing up for non-users of W10.

Hold the phone! Crap customer service cost telcos £2.9 BEEEELLION in 2016

I wonder where banks fit into the complained about league.

Inside Confide, the chat app 'secretly used by Trump aides': OpenPGP, OpenSSL, and more

Re: With crypto the devils always in the details.

"But the big one. It's not FIPS compliant."

Bearing in mind that FIPS has previously approved a broken by design NSA-promoted algorithm I'm not sure whether this is automatically a bad thing de facto, just de jure.

(Why did I initially type FIBS? Is my sub-conscious trying to tell me something?)

Bruce Schneier: The US government is coming for YOUR code, techies

Re: But wait

"the law will not apply to either US criminals (except as punishment if caught)"

That's the case across all laws and criminals. Not having a relevant law simply means no punishment and no criminals, it just means no bar on people carrying out actions which would be a crime were there a law to define one.

Re: The choice

"Suppose some software or IoT device was identified as being a major problem, and had to be stopped, disabled, etc. How effective would a product recall be?"

Did you read the article about the botnet on a University campus? If so you'll recall that they scanned for these devices (and fixed them by updating the passwords). So it can be done. Probably the most efficient way would be to impose the requirement on ISPs to scan their own estate, at least for devices visible through firewalls; they're not going to do it voluntarily but then they wouldn't be given the option.

Re: Well, maybe we should not put software in everything

"Real time software is engineering that just happens to have a logic component implemented in software. ...Contrary to popular belief it is really easy to make reliable real-time code and its also easy to prevent it from being corrupted."

Why not implement it in hardware with an ASIC? Presumably in order to be able to make maintenance changes later. And that way lies a risk. The initial design might be well written reliable code but all too often maintenance is seen as a not very interesting job that gets given to juniors and gradually your original well written reliable code becomes badly structured not very reliable code.

Re: Well, maybe we should not put software in everything

'And sure, it's possible that the "diode" will be badly designed '

That would take some effort. All that would be needed would be an API with a read function and no write.

Explain! yourself! US! senators! yell! at! Yahoo!

"Can take turns taking penalty kicks at them? Or did you mean gaol?"

Whatever.

It's a long time since I used to get summonses to courts of oyer, terminer and general gaol delivery.

Do the Senate have powers of subpoena? A night spent in goal by senior management to think over their answers might spur recollection.

The Register's guide to protecting your data when visiting the US

Re: Not right, but not that strange either

"Profiling is a huge part of border detection. USA, among others, have mastered this to an art form."

Citation required.

Re: Don't accept it, act on it

"If your employer has a legally mandated requirement to confidentiality or customer privacy they will get hit by the violation you have just created"

Is it so hard to work out that if the employer is sending an employee to a rogue state such as the US with company provided electronics then they'll provide suitably clean kit?

Re: I strongly believe it's time to strengthen the Schengen border...

"Christ LDS. You do a lot of postings!"

So does Anonymous Coward. Are you sure you're not actually several working as a team?

Re: @AC: "Special Relationship"- Cringe-inducing delusions of grandeur

"The PM didn't exactly campaign for Brexit"

Nor did she campaign for it to any noticeable extent. She was a gone-native Home Sec who was induced to see saw the EU as an impediment to what her department she wanted to do. As everyone expected Remain to win sticking her head over the parapet wouldn't have been consistent with wanting to keep her job post-referendum. It paid off for her, for us not so much.

Infosec pros aren't too bothered by Trump – it's his cabinet sidekicks you need to worry about

Re: Right here is how Trump wins or looses the next election.

"USians will forgive a President damm near anything if they see actual wage growth in their salaries and pay cheques."

Would that depend on whether the wage growth exceeds inflation of cost of living or is the electorate not able to work that out?

IT bosses: Get budgets for better security by rating threats on a scale of zero to Yahoo!

"He recounted the time he asked a vendor if a particular threat was covered as per the regulations, so he could pass on the reassurance to auditors."

Shouldn't that have been an ex-vendor?

Re: Compliance and secure safe network frameworks

"Compliance is the verification and documentation that you have done things right."

All too often only the documentation matters. For people who design bureaucratic systems paperwork is the only reality.

University DDoS'd by its own seafood-curious malware-infected vending machines

Re: I'm guessing the slightly tough part.

"Do you a) change them all to new standard password (get one device, get them all) or b) Create and give them all unique passwords and keep them in an encrypted field in a database."

Because you want to act quickly, go for a) on the first pass. This gives you breathing space to implement b) when you've worked out a suitable strategy.

As this installation seems to have been intended to apply down to the level of every light-bulb in the place for easy of maintenance (yup, sure made life easy!) there might need to be a lot of people who needed access to the list so implementing b) might not be straightforward. It might even include a review of whether all the devices needed to be "smart".