Posts by Doctor Syntax

Wait! Where did you get that USB? Super-stealthy trojan only drives stick

@Symon

At the level the guys in the article are dealing with you paranoia is SOP.

"Even those you get at discount IT shops might be suspect."

My point was that, given the complexity of today's supply chains, how do you know that any item is trustworthy?

"People should understand the risks associated with USB storage devices obtained from sources that may not be trustworthy"

What's a trustworthy source and how do you recognise one that's not?

Israeli biz fingered as the FBI's iPhone cracker

Re: Of course the FBI's effort was a smoke screen or for precedent-setting purposes...

As I wrote in another thread, never start a fight you don't know you can win. They thought they were OK & then found out they were starting that fight.

Oh, sugar! Sysadmin accidently deletes production database while fixing a fault

Re: No sh*t, Sherlock award of the week

Well at least they're letting marketing do the PR, presumably the techs are getting on with the fix. Much better than the other way around.

Oracle fires big red Solaris support sueball at HPE

I wonder what would happen if a customer dug out an old-school tender document which specified as a requirement "must have multiple sources of support".

Your money or your life! Another hospital goes down to ransomware

Re: OSes in the business-critical enviro?

"Starting them and running applications is easier than finding line-spacing defaults on the MS Word ribbon."

As bad as that?

Re: Sigh. Windows vs Linux again.

"If I decided to switch my 200 user company over to Linux....where do I get professional hands on service and support for users and infrastructure?"

How should we know, we don't even know where you live? But you could start by looking. You could well find that there are half a dozen local Unix freelancers who are looking for the opportunity to add another line of business. Maybe some of them are even reading these comments.

Re: And the moral is.......?

"iding file extentions....yes, fine i get it, but doris the 50 year old secretary doesnt and bnever will."

That's another thing your IT dept needs to do: training. Include a little testing - like a phishing email that will check whether she's still falling for it.

If she proves untrainable then maybe it's time to think of moving her somewhere where she can't damage things. The security of your business is worth more than your secretary's feelings, especially if it's a hospital where life & limb could be at stake.

Re: Sigh. Windows vs Linux again.

"I've bought a new HP colour laser printer (Ethernet connected) and I'm trying to get it to work with Mint."

It's just the old device/ driver/OS issue. It can affect any OS. I've never had problems with Linux and HP. OTOH when I tried the preview of W10 it wouldn't recognise the HP printer I've been using for years. It's more the attitudes of the device manufacturers than anything else.

Re: And the moral is.......?

"what's your source for pinning the blame on Windows?"

I'm not sure what the OP had in mind but there are a few possibilities. One is the way Windows is normally set up to be "helpful" by hiding file name extensions so as not to confuse the users. As in confusing them into thinking that something labelled, for instance, invoice.jpg.exe might be harmful.

Then there's the fact that Windows often seems to be run with the user as a local administrator so that anything they've been tricked into running has more privileges than it ought to have.

Taken together those make Windows users more vulnerable than they should be. Add to this that, being the most widespread platform it's a major target but make no mistake, if Linux was common enough to be worthwhile it too would be targeted. In fact, malicious Javascript could attack any browser of client that doesn't run with scripts blocked. The dependence of the modern web on JS makes such blocking inconvenient but that's a different complaint.

But Windows itself really isn't the problem.

One problem is the nature of email: it's too easily forged. The From: line can say anything and there's no way of even attempting to check without the time and skill to delve into the headers, two resources which a busy office worker probably doesn't have. A big improvement would be an email system which requires signing so that the signature could be checked against the public key of the alleged sender and bounced if it failed.

Another is that every operating system allows any program to write to any file based on user privileges only. If, for instance, only your office suite was allowed to write to word processor files and spreadsheets a random encryption program couldn't touch them (I exclude powerpoint files - encryption might be an improvement).

A third is that file systems generally don't have separate permissions for deletion or versioning so it's possible for malware to delete the old file if it applies a new suffix to the encrypted file or to overwrite the old one if it doesn't.

We need to design systems on the basis that they will be under attach - at present everything assumes well-intentioned and well-trained users in a benign environment. We're not there any more.

Azure's wobbly day as three services glitch around the world

"This box runs the business that pays my wages."

"This box runs somebody else's business."

Spot the difference.

Error checks? Eh? What could go wrong, really? (DoSing a US govt site)

Re: But the program is error free!

"His problem was that he did not comprehend - even after we discussed it - that an assembly pass that did not generate any errors did not mean that the code would actually function."

In neither version of your story do you address one essential point. Did his code work?

UK.gov kicks long awaited digi strategy into long grass, blames EU referendum

Re: It could be used to rebuild GOV.UK

"Again?

I thought this iteration was supposed to demonstrate how government IT services should be done?"

It's agile. They'll keep doing it until they get it right, whenever that might be.

"The GDS was awarded £450m last year for this Parliament, but no details have yet been released as to how that money will be spent."

I doubt GDS will regard lack of details as an obstacle to spending money.

Microsoft files patent for 'PhonePad', hints at future Windows plans

"sufficient obfuscation to avoid getting your idea pinched"

Or sufficient obfuscation to hide the fact that it's not a particularly original idea.

The requirement to prove originality in a software patent ought to be to show that the problem has been known for some time without a successful solution. Is this different to what Ubuntu have also been demonstrating for some time?

I have a nasty feeling that MS might be claiming royalties from the work others have put into their own implementations of the same requirement.

Okay IT pros, change happens. But here's your Reg guide to staying in control

I had one gig where the manager had a set of requirement's similar to Dave's to set up a new product. They included a requirement to specify up-front the SQL needed to make the changes to the database. The application, however, had been implemented with a user-friendly front-end form to make the changes to the various tables. This would include working out the surrogate keys on the live system which would be different to those on the development database. It simply wasn't designed to work through the import of raw SQL.

Re: Or join the 21st century.....

"avoids silly Stand Ups, and only have good Stand Ups "

The "no true Scotsman" approach.

Re: Or join the 21st century.....

"what the hell is happening in the business"

This may be a very brief requirement but it's a actually quite a good one and one which suits an iterative process. To any given level of detail it has a deliverable and if more detail is required another iteration will produce another level. When the client says they've got enough or spent enough it can stop. A different requirement might not be so suited to that approach.

What's really problematical about it is that the board didn't know what the hell was happening in the business in the first place.

How one developer just broke Node, Babel and thousands of projects in 11 lines of JavaScript

Re: Left padding

"I think you mean 30 years ago."

Only 30? Kids today.... Wanders off mumbling to self.

iOS flaw exploited to decrypt iMessages, access iThing photos

Re: So, Apple has backdoors to their OS

The likelihood is that it's one they don't know about so they're withholding nothing. If you RTFA you might spot that it pretty well implies that.

Re: Nation-state?

Simple to describe, simple to implement utter nightmare to run to completion.

FTFY

Re: The tinfoil hats are strong with these ones.

You forgot 4. They want a precedent that can be gradually widened to get a backdoor inserted into any S/W they choose. That's the really dangerous one.

FBI backs down against Apple: Feds may be able to crack killer's iPhone without iGiant's help

"This is pretty much exactly what I said a month ago and was downvoted into oblivion with some AC saying I needed to post something sensible."

There's also been a good of crap about "do you know how many attempts you need to to brute-force an AES key" when, in fact it was all about brute-forcing a four digit pin.

But if this is the explanation I think the" external forensics company" has a TLA.

" wonder if the FBI had suspicions the judge assigned to the case may come down on the side of Apple and decided that wasn't a precedent they wanted setting."

This is my suspicion. There's an old saying 'don't start a fight you can't win'. They thought that they could do this by taking it to a magistrate, assuring her it was all straightforward and getting a warrant without letting Apple be heard. What with Apple contesting it, with heavy-weight amicus briefs and a few influential voices saying that other parts of the govt favour encryption they're now thinking this is a fight they can't win. Maybe the recent zero-day is what they're using to back down gracefully. Maybe Zdziarski's right (I'd have thought this would have been something NSA would have looked at way back).

I'm sure what they really want is a precedent to get backdoors put into whatever they want and if this looks as if there's any possibility that this could go against them they'll wait for another chance somewhere else.

Re: Phone in hand.

There's also a big difference, in principle, between cracking one phone in hand and cracking a few dozen other also in hand together with an unlimited number not yet in hand. In practical terms there isn't. But principles matter.

Re: Not a win for Apple

"Not really a win for Apple if it turns out the phone can be easily cracked without help from Apple."

It could well be this zero-day: http://www.theregister.co.uk/2016/03/21/zero_day_apple_grapple_dredges_imessage_photos_videos_in_ios_9/ in which case it'll be fixed for regular users.

Re: Govt Property.

"What kind of IT Manager issues a Govt owned device where he doesn't know the pw?"

From what I've read, one who bought a device management package and didn't use it.

Re: precedent

"The prevalence of homophones" is good reason to take care in selecting the right one.

PC World's cloudy backup failed when exposed to ransomware

Re: unpaid_invoice.doc.js

"Ask the BOFH, she's at fault"

The BOFH is good for a laugh. But in real life someone who makes a purchase of a complex product should be able to expect advice, given after consultation, as to what meets her needs, not whatever's in stock or offers the biggest bonus.

Re: Infected industry

@Gray

You have a point but please realise that some of us who are saying that users shouldn't be blamed for not knowing what they need to know in order to know what they need to know* are also pros (or retired pros). Personally I'm shocked at the number of people here who expect that a SOHO user or whatever should be an experienced sysadmin.

The public should be better served. They should be better served by the platforms they're sold, they should be better served by the vendors and they should be better served by Government who have better things they ought to be doing than mass-surveillance.

*Yes, Sir Humphrey got there first.

Re: Infected industry

"But it could be avoided if a little effort was made to understand the 'beast' and how to tame it."

The fact remains that she went to people who were supposed to help her.

Another poster mentioned front-line support & heart surgeons. Let's pursue that line of thinking and imagine that medicine isn't regulated. You feel ill. You roll up to someone at a good address with an impressive brass plate beside the door. You are you to know whether you're visiting a heart surgeon or an apothecary with a good address and a brass plate? You tell them your symptoms and accept their diagnosis and assurances in good faith; you've "made a little effort" but you don't have the required knowledge to tell whether it was the right effort and you didn't realise that you needed to do 1st MB to be able to tell the difference.

Re: Starved of information: 3 things never learned from Randomware tech articles...

"users may think they're saving without an .ext but really, the file has an extension and Windows is just hiding "

This little gift of Windows is part of the problem. cat_piccy.jpg is really cat_piccy.jpg.exe and Windows lied to you.

Re: Great sympathy with the User but ....

"They are a retail outlet that has grown quite large and diversified into Computer Retail (mainly Domestic & Small Business end of the market.)."

Not quite correct. They started out as a specialist computer retailer - in Croydon IIRC. They grew into a chain and were then taken over by a bigger chain.

Re: No! No! No!

"The restore strategy dictates the backup strategy, not the other way around."

They are not two separate things. There isn't a backup strategy and a restore strategy. There's a keeping-things-going strategy whose components are backup and restore.

Re: No! No! No!

"tell me, in detail"

Do that and user's eyes glaze over. What they want to hear is reassurance. That's what she was given when she bought it.

Re: "a virus flooded my laptop instantly corrupting all my files "

"There's no way it could have instantly encrypted all of her documents immediately after opening the dodgy email...."

This is true. What probably happened was all sorts of oddities which panicked her. When that happened to my cousin-in-law she did the right thing - maybe by chance - and switched off. In this case it's difficult to say what happened but I do wonder if she tried to do the recovery with the virus still active and got her recovered files encrypted - or tried to do a backup and backed up the encrypted files, or both.

Re: Backup Vs Archive

"At some point the owner has to take responsibility for their own data"

Which, to the best of her knowledge she'd done - by going to what presented itself as a professional service.

"and that includes testing of the backup / archive functionality."!

I repeat the question I posed earlier. I assume you're a sysadmin. How many of your users come to you to check that you're testing backups?

You're talking about what sysadmins do, not users. She's a user. Is that so difficult to understand?

Re: Or she hadn't completed a backup in the previous 30 days

"If a professional server backup fails to complete, alarms sound"

Not with my old clients as per previous post. Oh, you said "professional".

Re: There are two options here...

"the major weak point was her just not being savvy enough."

And that's what these scum prey on.

Re: "years of work and important documents"

"You don't need to be an IT pro to check backups"

Think about this for a moment. I assume you're a sysadmin. How often do your users come round to you to check your backups? She's the user, PCW are her sysadmins. Why should she even know about checking?

Personal story here. I had a gig to replace two non-Y2K-capable boxes. They'd been set up so that one of them did an NFS copy to the other, the warm standby, overnight (they were situated at opposite end of a large industrial site - a disaster large enough to affect both boxes would have given them more problems than the loss of both boxes). In the course of looking at the existing setup I discovered that the overnight window wasn't long enough to allow a complete backup. I've no idea how long they'd been without an effective warm standby.

Reposting 8-second sports clips infringes copyright

Re: ??

"The trick is to get bought by Facebook /Yahoo etc. before hitting step 3."

Surely that is step 3?

"Cricket board should FO and sell to terrestrial broadcasters"

Couldn't agree more. I'd looked forward to spending a good deal of my retirement watching the Beeb test match covering apart from fulminating when they seem to think that tennis fans can watch two channels at once. But not at the expense of paying Uncle Rupert.

“fanatix seeks to disrupt the US$40 billion global sports media rights market”

I suspect that comments like this might have sunk him. Something presented as a fan site might have got through. Going head to head with your supporters isn't a good idea & ECB might have realised that but that sort of talk would be too much of a challenge.

French publishers join Swedish 'Block Party' to pester ad refuseniks

The ad industry really should shut up about ad blockers. If they make enough noise they have another hit from the law of intended consequences. The punters - those who pay for the ads - will catch on to the huge negative impact advertising can have and walk away. However the industry is full of people who are so full of themselves they're not going to work that out before the punters; their self-image wouldn't stand the damage.

Re: Let's see how it plays out, shall we?

' Let's face it, a lot of people have no idea that their web browser is not "the internet"'

A fair number have no idea that their browse is not "my computer".

Look who just joined Salesforce... it's former European commish Neelie Kroes

Maybe she'll be able to help them set up their arm's length EU operation. The one they'll need when the Privacy Figleaf gets torn down.

Micro Focus spends $540m to add Serena its software brand museum

"once great, now slightly dusty software brands....high EBITDA margins, with consistently strong cash generation"

A good business model once you get over the notion that you've got to grow and grow and grow.... And more rational because at some point the market's saturated and there's no more growth to be had.

True believers mind-meld FreeBSD with Ubuntu to burn systemd

Re: Haters gonna hate

"that's a coup against all distros by RH"

And where does one now have to go to get a supported systemd-free Linux distro? RH6 maybe?

Re: Haters gonna hate

"What on earth is so wrong with specifying mount points in fstab that meant that systemd has to do something different?"

NIH