Posts by Doctor Syntax

I beg you, please don't back up that secret directory full of photos!

Re: Unprofessional

"There is no obligation in the UK for any ordinary citizen to ... report a crime"

No, you can volunteer to become an accessory after the fact.

Re: Unprofessional

There's a difference between stumbling across stuff inadvertently and going looking for whatever you can find.

That may be the answer to the Gary Glitter conundrum. If the techs simply stumbled across the material they did the right thing. But I'm sure a lot of potential commercial business left PC World after that, just in case they went looking.

Re: Unprofessional

" I'll reference the Gary Glitter case as an example where had it not been for PC World sniffing about he wouldn't have been caught when he was which probably led to saving children from abuse."

OTOH if your PC was full of your business's financial data would you, post GG, have taken it to PC World for service?

How a Brexit could stop UK biz and Europe swapping personal data

"Which is a nice diversion from the reality that geographic location seems to be irrelevant where US law is concerned."

A couple of points here. Firstly, US law is undetermined on this and will remain so until the Microsoft NY case gets decided by the US Supreme Court.

Secondly, Microsoft seems to heave learned from its experience and its new German data centre is being constructed with a more effective legal firebreak than a simple EU subsidiary. Depending on the way they see the first case and challenges to Privacy Figleaf developing other US businesses may adopt the same approach. My guess is that the smart money won't wait to find out. My other guess is that there isn't sufficient smart money so that Privacy Figleaf will provide an excuse to do nothing followed by panic.

Feds tell court: Apple 'deliberately raised technological barriers' to thwart iPhone warrant

Re: Tim Cook belongs in jail until Apple unlocks the phone

"Apple and Tim Cook are doing nothing but supporting crime by refusing to unlock the phone of a mass murder."

No, what they're doing is protecting the right of any innocent person against unjustified invasion by the authorities. This is such a good idea that it's been part of the law of England and her colonies for 8 centuries. And everyone is entitled to be considered innocent until proven guilty. That, too, has been enshrined in our shared Common Law for a long time. This means that prosecution has to work harder to establish a case. I spent 14 years doing such work in the midst on an ongoing terrorist campaign a good deal more vigorous than the US is currently experiencing so I think I've seen a good deal more of it than the average A/C in these parts. And would I wish to see those protections weakened? No. Because those are the protections which benefit me, A/Cs and anyone else who values living in a free society.

Re: If code is free speech then Apple can't tell developer what to write...

"Basically you're saying free speech can be contracted and compelled by money and layoffs menaces"

Free speech can be contracted. How do you think films & plays get produced?

Re: The mat and potatoes

" if a court orders them to do it (after the argument has gone to the highest possible)"

Indeed. But this is a long way from the highest court possible, in fact AFAIU it's still at the lowest court possible. And before the highest court possible rules it will hear argument and evidence from both sides. From what I've read not only was this writ issued by the lowest court possible but it was issued without hearing any argument from Apple. So the there's quite a way to go before it's worth even trying to double-guess what the eventual decision will be let again arguing what Apple might then do and what a court should then do about what Apple should do.

Re: Wait....

"I am tempted to call you a shmuck you shmuck but that would be name calling. So I will resist the urge."

And an insult to real shmucks.

Re: Single case Today --- ?? tomorrow...

"Just wait for one of your dears to be killed, and to know the name of the killer is only in a phone nobody can access..."

And if nobody can access it how would one know?

Even if you're going to create straw men as the basis for emotional arguments you still need to retain some traces of logic in there.

You say I mustn’t write down my password? Let me make a note of that

TL;DR

An empty desk is the sign of an empty head.

Security is the ratio of the difficulty created for the bad guys versus the difficulty created for whoever has to do the work.

Re: No marks to the following:

"At that time the Teletype couldn't be programmed to not echo selectively."

IME they were set up to type only what came down the line so what you saw on the paper was what was echoed back to you. So it was up to the login program to send clear text, asterisks or whatever.

Re: Clear Desk Policy

"So, like this?"

It reminds me of a quote from Len Deighton which goes something like "Bret's desk was like his women with shiny legs and see-through drawers".

Re: Clear desk policy

"This was the opportunity for said PHB to loudly deliver a security lecture to the whole office*, before grudgingly giving me my laptop back."

This was the point at which you should have said "So that explains it. It was running the remote server for the client demo...."

Re: When I was your age...

No, real dinosaurs carved out the message on monoliths in runes with the phone handset beside them. The computer worked out what was being written from the sound of the tapping.

Continuous Lifecycle London: Less than eight weeks to go

Still plugging away? Those tickets must be really hard to shift?

Still, I suppose these ads aren't popping up, playing videos or downloading malware so I suppose we should be grateful for small mercies.

David Cameron hints at Budget law change to end mobile not-spots

Re: cue the Anti Mast campaigns

"If there is no signal then they can't use those precious mobes."

And if there's a weak signal the phone, situated next to the kiddie's brain, will turn up the wick on transmit. Did I read something about an inverse square law?

State should run power firm spam database, says... competition watchdog

Re: “It’s not spam, it’s targeted marketing”

What do you mean, they're both obnoxious practices? They're not two different things.

Data protection: Don't be an emotional knee jerk. When it comes to the law, RTFM

Re: I'll tell you what's worse...

There really ought to be a clause in the DPA which makes it an offence to invoke the DPA where it's inapplicable

Privacy Shield?

You mean the Privacy Figleaf.

Please tell me, Mr Jennings, how do you think things are improved to any meaningful degree if I have to seek legal redress in the US for breaches there?

At the very minimum redress should be sought against the EU organisation that exports the data. And even that's not adequate. The US govt agencies clearly consider their interest in the data falls into categories outside the agreement (I think the official category would have to do with national security, their real category is "we want it") so this is as meaningless as the alleged Safe Harbour arrangement.

"Or has a customer refused to buy your solution because you’re reselling public cloud, which means they will lose ownership of data?"

I'm sorry, Mr Jennings, but there's no way to soften this blow.

Not everyone obeys the law.

With increasing remoteness between users and data there's a greater opportunity for one of those who doesn't.

IT system lets biz opt out loads of EU patents from Unified Patent Court at once

Re: English

'Companies will be able to opt out an "unlimited" number of their EU patents from the jurisdiction of the new Unified Patent Court.

Note the words "from the jurisdiction". That doesn't mean the patent doesn't exist (but see below) or that they don't patent things. It means that jurisdiction will fall back to some other court.

From the article:

"IT developers are working on releasing a dedicated API ... that can link in to third party software and enable multiple patent opt outs to be filed."

Wouldn't it be a good idea if there was an undiscovered bug in this that managed to completely lose anything that looked like a software patent?

Approved: Master plan to end US gov control of internet's highest level

Opportunity missed

The governments should have insisted on ICANN reform before handing over authority. Now's the only time it can be done short of either chaos or all the root servers agreeing; i.e. chaos. Unless, of course, the US govt refuses the plan as it gets handed to them.

Woz waxwork weady to woll

So the "tech innovator" section's getting a tech innovator. About time.

Microsoft has crafted a switch OS on Debian Linux. Repeat, a switch OS on Debian Linux

Re: so long Debian, it has been nice knowing you

On second thoughts, maybe you were thinking about systemd.

Re: so long Debian, it has been nice knowing you

What? Debian code is all available under a licence that permits Microsoft to use it just as readily as you do. All they (Microsoft) have to ensure is that they distribute the source as demanded. Debian are selling nothing, just being a normal open source organisation.

Is there anything left to ask Bill Gates? (Other than gissus a million?)

Re: When will he stop his genocidal and other dark practices...?

" I think you'll find that's Apple around these parts"

Not at present.

Re: So he has an ASR33??

"Programming on an ASR33 will humble you very quickly. Everyone should do it once!"

Especially on the end of an acoustically coupled modem.

IBM pimps Watson out to Hilton robot for concierge duty

Maybe it would be best put to work watching the PoS terminals for signs of infection.

SQL Server for Linux: A sign of Microsoft's weakness. Sort of

Re: But, I'm guessing, not to raspbian

Informix is already available on ARM. IBM sees it as an embedded database.

Re: Yeah ...

"That's not a knock on Redmond, that's a serious question."

The two are not mutually exclusive.

Knackered Euro server turns Panasonic smart TVs into dumb TVs

I decided I'd had it with Panasonic when the drive died in the DVD box. Use a commodity component you could replace from eBay? Nope. Nowadays the drive in the Myth box does the job nicely and if it dies it'll only be a few quid.

Brits still not happy about commercial companies using their healthcare data

"I would rather say 2 things"

3. Don't shout. We have enough trouble with Bombastic Bob.

Re: No, just no.

"Councils make money flogging their (compulsory) electoral register"

Do you mean you didn't opt out?

Re: This finding has implications for thinking about whether an opt-out should be available

Forget about opt-outs. They should be thinking in terms of opt-ins.

US taxmen pull plug on anti-identity-theft system used by identity thieves

Re: Can we finnally stop re-inventing the wheel?

"Why can't the .gov wrap it's collective head around the common, off the shelf solutions to these problems?"

Whilst a 6-digit pin might not be ideal - depending on how many guesses you get - it looks as if the real problem here is having something to anchor the trust system to. If the identifier gets handed out to an impersonator it doesn't matter much whether its OAAuth, Yubikey or a single digit pin.

Solus: A welcome ground-up break from the Linux herd

Re: I'd be interested...

Have you tried Ariadne - http://www.knopper.net/knoppix-adriane/index-en.html ?

Re: Flat vs 3D vs skeumorphic

"Skeumorphic is distracting and bling... 3D only need left and top light grey line with right and bottom dark grey line to give the cue that it's something you drag or click. We don't need almost photos of real objects."

3D might only need that. Working out what to drag or click needs a bit more. It needs something to give a bit of a clue. The vast majority of users now might never have seen a real floppy disk so to them they're no longer skeumorphic but the use of icons based on them will be sufficiently ubiquitous that they're instantly recognisable as the place to click to save work. An unfamiliar application will present a steep learning curve but the presence of familiar icons and menus with familiar functions will ease that.

Whether those icons are still skeumorphic or not they're far from being a distraction, they're valuable signposts.

Re: "One thing that's less clear, is who Solus is really for."

"the old Unix everything-commingled-in-five-places dir structure"

The really old Unix structure was pretty rational although it was designed, in part, to deal with the likelihood that it would have really small disks so everything needed to boot or run single user was in a special set of directories on account of /bin might be on a separate disk and you had to get to the point where the system could mount disks. OTOH root's home directory really shouldn't have been / so adding /root was a distinct improvement.

/usr was for user's home directories. Why on Earth did somebody put bin and lib directories there? The home directories eventually moved to /u and then to /home leaving /usr sadly misnamed. /usr/spool eventually became implemented by a mess of symlinks so you'd cd into it, cd .. and come up somewhere completely different. No wonder that got replaced by /var.

Another thing that got changed was separation of roles. Consider the system binaries and libraries; they used to be owned by a user ID bin. bin could install software without needing the root password. lpadmin could manage printers without needing the root password. Then to appease the great God Convenience everything was handled by root followed eventually by the notion that this wasn't a good idea and so we had sudo to repartition the agglomerated root functions and get in the way of every admin task unless you negate it and sudo /bin/sh. And then, to re-appease the great God Convenience we have the arrangement whereby sudoers can sudo by using their own password instead of having to know a second password. In effect Unix-like systems are typically being run by local administrators just like so many Windows boxes.

So, yes, a lot of Unix has become a tangle but don't go calling it "old". To us oldies it's all newfangled tinkering.

Re: Solus stands on a few less shoulders than others

Arguably less is correct. It stands on the shoulders of the very many who put together the individual libraries and programs but not on the mighty shoulders of one of the great Debian/Red Hat/SuSE triumvirate. OK, it's getting late...

Another interface that seems to be based on "a clear desk is a sign of a clear mind" or, as I think of it "an empty desk is the sign of an empty head".

Where do you put all the documents you're working on? And, no, the "recent files" option on a file menu isn't nearly enough if you need to consult a lot of reference material. These empty desktop styles just cut out a whole mode of operation and in order to provide....well, nothing really.

What are you doing to spot a breach?

"A hospital may send data to a third party company that produces its invoices for it. How can you distinguish between a legitimate business process like that, and an illegitimate one that is sending sensitive data to bad people?"

How do you know that the legitimate third party isn't compromised? Or that it doesn't employ someone untrustworthy?

Californian tycoons stole my sharing economy, says Lily Cole

"For starters, I can't get what impossible.com does from their front pages."

I think you've hit on the problem.

FBI says NY judge went too far in ruling the FBI went too far in forcing Apple to unlock iPhone

"It also argues – as it has done in the San Bernardino case – that the request is device-specific and so does not constitute blanket approval for the FBI to break into any iPhone."

So, two quite unique but surprisingly similar cases.

I'm sure the New York office had misread the instructions. Their case was intended as the second slice of salami when they'd got the result they wanted in San Bernadino. They've given away the game plan.

What a pair of ace-holes: Crooks bug gambler's car with GPS tracker, follow him and rob him

Quis custodiet and all that.

GCHQ: Crypto's great, we're your mate, don't be like that and hate

"The level of security I want to protect the privacy of my communications with my family is high, but I don’t need or want the same level of security applied to protect a nuclear submarine’s communications, and I wouldn’t be prepared to make the necessary trade-offs."

Take this statement in conjunction with the Nat West article. It would be wrong to see such things as affecting just individuals - as in his family's communications. If you take all the Nat West users together, or all of the other individuals who might be affected by some other issue, each time you can add up what's a risk and discover that it's a sizeable chunk of the economy. Does that move it a bit closer to a nuclear submarine in terms of significance?

"That is where we will need goodwill on both sides.”

Fair enough. But that gives him a problem. He and the other agencies have lost that goodwill because they have lost the trust of the public including the tech companies. He and the others need to regain that trust. It's really the most important problem they have and I don't think they have a clue where to start. I can help them with a rather old piece of advice.

When you're in a hole, stop digging.

They need to step back, grasp what the rest of us are saying and then admit that they way they've been going about things is wrong; that for the greater good they need to accept limits. Standing up and giving lectures about how they're right is, in fact, quite wrong. They work for the public. The ethics and morals they adopt should be those the public require of them. It's not their role to try to scare the public into the attitudes they want. And, as someone said in a previous comment thread (and inexplicably got downvoted for it) questions of principle shouldn't be settled by appeals to utility.

Microsoft joins Eclipse Foundation. Odd thing for a competitor to do

Re: Oh. Woo. Yay.

"Not that it'll stop the nutjobs claiming otherwise with nary a shred of proof of 'evil' intentions."

It's not so much a matter proof as a matter of leopards and spots.

NatWest tightens online banking security after hacks' 'hack' exposé

Re: Are Barclays...

"the only bank that use a card reader in the customer's hands to allow any interaction with the account?"

No, but the only time I needed to use mine it didn't work. I think it's because these things are time based and the bank is running several years slow.

Re: No NatWest Branches But Don't Use The Post Office @Richard Jones

" *Always* write your sort code and account number on the back of the cheque"

You mean so they can match it up with the one on the front?

Re: communicating with them using ALL of their registered methods

"Who reads emails that purportedly come from the bank?"

There's another side to that - by sending out spam the banks are training their customers to respond to phishing emails.

Much as I'd like to suggest firing the guilty in the marketing departments (that's probably entire departments) there are ways in which things could be improved.

My own solution to the bank email problem is to have my own domain and use that to give the banks etc their own email aliases to address any emails to me. Unless some bank employee has my email address on his BYOD - which he shouldn't - and loses it then I can reasonably rely on any email that claims to come from my bank actually having done so*.

I appreciate that not everyone wants to run their own domain. A simpler solution would be that email hosters provide each customer with a subdomain within which the customer can set up their own aliases so instead of NatWest sending emails to [e-mail] they send to [e-mail] or even better [e-mail].**

The other technical improvement would be to make PGP a core part of an extended SMTP so that if I get an email which purports to come from my bank it would be signed and my email provider's server would verify the signature with the bank's public key before accepting it.*** For good measure I might have a copy of the bank's expected key on my email client, just in case the email were to come from [e-mail].

Today's email standards and practices are rapidly becoming inadequate and need to be improved.

*In fact, this may not be correct. I have had words with more than one financial institution about their having employed digital marketing companies spammers to send out valuable marketing communications spam. If that were to happen under my current system I'd then have to change the alias and complain bitterly about the hassle. The alias might well be changed by changing bank. Maybe fire the marketing departments just to be on the safe side.

**This does, of course, rely on email providers not having their database popped by teenage skiddies using exploits older than themselves. Come to that, so does my existing arrangement but I think that, unlike other internet companies I've left behind, they're prepared to keep their security up-to-date.

***The keys would either be served from the bank's email server or the bank's DNS records would include an alternative address. And, yes, I do know that PGP can be enabled on my email client today; do you know it's not a rhism of use without most other correspondents also using it? It needs to become universal to be of use and the only way for that to happen is for it to become adopted into the standard so that non-use can be deprecated.