Posts by Doctor Syntax

Home Office lost its workers' completed security vetting forms

Re: I hate to say...

It certainly illustrates their lack of capability to handle stuff securely but another good solid nail in the coffin? I doubt it. They'll just carry on regardless.

HSBC online banking outage: Moneymen are 'still under attack'

Between DDoS and ransomware you'd think there was something useful that the world's SIGINT agencies could do by tracking down culprits & ensuring they're dealt ith. But no, just concentrate on grabbing more data than you can use.

Patent Troll Unit set up by Virginia government to slay lawsuits

So ATM this gives a competitive advantage to businesses operating in Virginia and so encourages them to move there. Could this start other states doing the same thing so as not to disadvantage themselves? A race to the top makes a nice change from the usual race to the bottom as everyone tries to shave pennies from costs.

'Printer Ready'. Er… you actually want to print? What, right now?

Re: US Letter

"complex problems upset their call statistics."

Any problem upsets their call statistics, it doesn't have to be complex.

You've seen things people wouldn't believe – so tell us your programming horrors

About a year into being freelance I had a gig with $VENDOR. One job was hand-holding $EX-EMPLOYER's upgrade of hardware which was running $VENDOR's database but included an update to the database. Ex-colleagues reported everything worked OK except for one SQL statement which wasn't working properly. I checked it out & found that the statement was working exactly as coded although my replacement at $EX-EMPLOYER was convinced it wasn't, partly on the grounds that it hadn't given any problems up to now. What's more I recognised it something I'd coded it a long time ago when I was working for $EVEN-MORE-EX-EMPLOYER and body-shopped in to eventual $EX-EMPLOYER. It involved converting a tricky bit of code from pre-SQL days and used some tricky 3-valued SQL logic - which I'd got wrong. But it looked convincing enough to persuade my replacement that it was right.

So had the previous versions of $VENDOR's database engine handled 3-valued logic wrong so as to do as I meant, had it been working incorrectly for ~10 years & nobody'd noticed or had that bit of code simply never been used in real life? I never found out.

Re: The Evil of Cut n paste

I remember a similar situation. Some code was exactly copied. IIRC there were two blocks of code that had had that treatment. They were reduced to functions. Having pruned the program down to manageable size like that I noticed a few near repeats which were reduced to a single function with a parameter to handle the differences. I think the result was about a quarter of the original length.

Reg readers speak out on Thin Client technology

Re: Wow. Editing full screen video on a thin client is difficult and slow

"Getting senior management to accept that is of course another matter."

Put it in a big box, a few LEDs (preferably trendy blue or white) with fancy logos. If manglement bod considers themselves to be techy add a noisy fan for the "working really hard" illusion.

Senate marks Data Privacy Day with passage of critical bill for Safe Harbor

the same privacy rights that US citizens enjoy

For some limited value of "enjoy".

How long before the ECJ strikes this one down?

UK.gov plans to unveil a new Digital Bill

Re: "UK Digital Strategy”

"One can only hope it will start with wrestling the national telecommunications infrastructure from the hands of BT."

Why would they do that? It was privatised because generations of govts failed to find the cash to invest in it. To wrestle it back, as you put it, they'd have to find the cash to buy it back. Then they'd have to find more cash to invest in it. Are you saying investment should cease or do you want to pay more taxes? Or do you know of a magic money tree that'll finance all this?

TalkTalk CuffCuffs 'ScamScam CrimCrims'

Re: Is it criminal or not?

Policy and contracts probably forbid this and "policy breach" and "contract terms" sound better than "stealing".

Cops hate encryption but the NSA loves it when you use PGP

Re: The more, the merrier?

"If you're using enigmail then yes it's easy. However that presupposes you know Unix and how to set it all up"

It also presupposes that your correspondents also use PGP. Of course most if not all of your correspondents probably don't use it because most if not all the people they know don't use it either.

I've said it before: it needs to be baked into the mail protocols and software as a default, not as an add-on. Until then, as the man said, it just raises a flag.

Apparently we have to give customers the warm fuzzies ... How the heck do we do that?

Re: UX not CX

" Nowadays firms just launch ten different interfaces that perform the same function without considering more aesthetic design requirements..."

What???? No, all too often they provide a single interface which isn't the same as it was last month and is based entirely on aesthetics and fails on functional requirements.

Whew! How to tell if a DevOps biz is peddling a load of manure

"Mean Time To Remediate (MTTR)"

How about aiming for something different: NNTR (No Need To Remediate) AKA Get It Right First Time?

Medical data experiment goes horribly wrong: 950,000 records lost

Re: Platitudes that are pointless and annoying....

Why do the media let them get away with this. The obvious rejoinders are:

Prove it

Who do you think is stupid enough to believe that?

How much data would you have lost if you weren't taking it seriously?

Has anybody in the media tried any of these?

Safe Harbor 2.0: US-Europe talks on privacy go down to the wire

Re: posturing aside

"After all, if Cletus J Shitkicker the 3rd can't have those rights why would they give them to any dodgy foreigners?"

If Cletus J Shitkicker the 3rd were to move to the EU (assuming he could actually find it) he'd have those rights. It's not in the US govt's gift to decide what rights people in the EU have. The problem that needs to be solved is how to ensure that those rights are respected.

Conversely it's no concern of the EU how US citizens might react to discovering their govt makes them second class.

"Worst case, they'll probably just tack on an extra "you give us permission..." clause into the hundreds of pages of legalese terms and conditions all these services have hidden away and continue on as usual."

Courts tend to dislike unfair contract terms. In fact, they can dislike them so much as to invalidate the whole contract, not just the unfair term.

Re: @skelband

"In my opinion, nothing short of pitchforks and torches will stop this."

Pitchforks and torches have their place when legal process fails. Legal process is slow but seems to be working. It's started with Safe Harbour. It might take another trip round the block before they decide the game's up with that one. But don't think other countries won't be challenged; HMG's latest efforts are a response to previous challenges; again they haven't got the message yet but they'll be back in court until they do.

"The reality is that there will be no deal."

I believe there's an election coming up in the US. US corporations wanting to do business in the EU will buy themselves a more compliant government.

Re: simple question.. @ YAAC

"try it, ban us and see how long before the populace storms the winter palace"

Apart from the fact that many of the big players have data centres in the EU already do you really think they're as daft as you seem to be? It's business. They'll do what's needed to keep the money coming in.

Re: simple question.. @ YAAC

@ Grikath

As things stand I'd expect to be waiving pretty well any human rights to enter the US.

For the rest, businesses may try some of the things you suggest. I doubt they'll get away with it. In particular there'll be problems for any business that tries to use US-based services for HR; you can't get people to waive legal protections as a basis for employment. And I doubt there'd be too much success for sites trying to sell stuff if they ask you to grant them a waiver before they can provide you with information. It will take a little time and some big fines but the idea of obeying the law will start to get traction.

Re: simple question..

" if the commission said, nobody in europe could use Microsoft/Amazon/Google/Facebook/Netflix etc"

You appear not have been taking notice but a number of these large businesses have data centres in the EU already.

There is a need for them to ensure that they conduct their operations in conformance with the law here. With a bit of effort - the amount will depend on the outcome of the current Microsoft case - they shouldn't have a problem. The real problem comes from those companies who offer online services to EU businesses to process personal data in the US and to their EU clients. They are going to have to smarten up or pay fines, the larger the better until the message gets out there - if you do business in the EU, you obey EU law.

"Which sounds very much like a legalistic way of saying because everybody's ignoring the law, the law is irrelevant."

And the only thing that will earn them is another kicking in court.

I think the best advice that could be given to any US company that wants to do EU business that goes near personal data is to structure your operations in such a way as to ensure you're not the test case by keeping that data in the EU with proper legal firewalls between it and any part of you that the your government can seize onto.

What Max Schrems has shown us is that it doesn't matter what weasel words are agreed at political level the court will look at the reality.

Scandal-smashed OPM will no longer do govt's background checks – for obvious reasons

Re: New OPM

"the Boomers"

Ageism. The only remaining Politically Correct ism.

"the same building and with the same organisation and the same people"

Maybe not the worst solution if they've learned by their mistake. Would you prefer an outfit that's yet to learn?

Dixons Carphone to shut down 134 shops

"Our experience has taught us that the net effect on ... colleague levels is likely to be neutral or better,"

Define "better".

NASA, Dept of Defense, Commerce etc probed over use of backdoored Juniper kit

Re: eat your own dogfood

"Clearly you don't understand"

I think it's a sign that legislators are starting to understand. It might take some time before they get their heads round it but it's progress.

Show us the code! You should be able to peek inside the gadgets you buy – FTC commish

Re: Shared VS Open Source

"I've heard that called shared source by some."

I've been sysadmin/DBA for a business running such a product. I was able to debug it for the vendors...

Re: Open Source FTW

"The average consumer doesn't understand how his car works either. Yet today he is able to buy a reasonable safe one."

To a large extent that's because of regulation. A big step forward would be a requirement for security testing for devices to get UL, CE etc. certification. Having devices calling home is another problem and it's unlikely that "home" will get tested. If, however, all models of popular freezer were to defrost or lights fail to turn on because a server had gone down or the maker had gone bust the public might come to realise that this too is something to avoid.

Linux Foundation quietly scraps individual memberships

Re: Disappointing

"Somewhat worrying if the corporations are going to dictate direction as it will likely be to the benefit of their own pockets rather than the end users."

If? That's been happening for some time, systemd being one of the symptoms.

And here's a gem (a) denying that any change has happened or if it has it's to provide better value to individual supporters and (b) attempting to change the subject:

http://www.linuxfoundation.org/news-media/blogs/browse/2016/01/linux-foundation-update

Twitter boss ‘personally’ grateful as five Twitter execs walk

Re: Flawed Business Model

"it was the fastest and easiest way to get a hold of customer services."

But maybe not as firmly as you might have hoped?

BT dismisses MPs' calls to snap off Openreach as 'wrong-headed'

"like happened with the BT / O2 split"

And like O2 it's likely that someone would come along to buy out the new company. Be careful what you wish for.

"they make sure everyone has access to a postal service"

Making sure everyone has access to a postal service amounts to having enough people on the books to ensure there's someone able to drive/walk round there. It requires some capital to provide the buildings and vehicles. Ensuring everyone has a high speed internet connection involves a huge capital expenditure.

Re: New Zealand has done it.

"Virgin claimed to pass 12.6M homes a year ago"

Those homes are those that were cheapest to pass. The cable franchises go back to the '90s when BT weren't even to get involved. Now BT are being berated for not being able to instantly and cheaply cable up those that VM & their predecessors didn't get round to in all that time..

Re: Publicly owned business

"Utilities should be publicly owned"

They were. Government was perennially reluctant to put in the required investment so they were years or decades behind where they should have been. Eventually they were privatised so the government could get its (under)investment back and the utilities could borrow at commercial rates although some (hello Railtrack) never quite got weaned.

Next we have to remember cable. HMG let various telecoms companies have cable franchises. This, as a matter of policy, excluded BT because the competitors had to have a chance/had vacant directorships (delete as appropriate). Now, years and years later, BT is expected to step in and cable up all the parts of the country that the original franchises found too difficult/expensive (delete as appropriate and did somebody mention cherry picking?) in short order. And people are amazed that the task that the original franchises borked takes a lot of time and money.

Universal Credit: The IT project that will outlive us all

Re: ...the department does "not have a detailed point-in-time breakdown."

I'm surprised the OBR didn't send them away and tell them to come back with one by next week. That would have puzzled them as obviously they don't have a concept of such a brief period of time. The OBR needs teeth. It needs to be able to put a department on 3 months warning that such projects will have their budget withheld and released a month at a time subject to satisfactory progress reports until such time as they're satisfied that proper project management is in place.

Sainsbury's Bank web pages stuck on crappy 20th century crypto

I wish journos looking for a comment would start off along the lines of "We'll take it as read that you'll say customers' security is important to you. Given $cockup can you prove that?" and then follow up the next anodyne waffle with "That's a no, then.". And report that as "$wankers were unable to give us any meaningful reassurances.".

In the meantime it's long overdue that banking licences were dependant on maintaining security to top standards. The regulators should run tests for against each new vulnerability disclosure that might affect the web site. Any bank found with its site not up to date with its patches would be given no more than 3 days* to fix it or the web site would have to be taken off line until remedied. This would mean that maintaining security would become an essential part of doing business, as it should be, instead of an expensive option, which it all too often seems to be.

And while the regulators are about it, financial institutions should not be allowed to let 3rd party marketing companies to send out emails purporting to be from the institution but actually from some other domain, with out of domain links, reply-to etc, again to be policed by the regulator on pain of fines that would wipe out the marketing department's salary budget for a couple of years.

*Possibly over generous, especially if a patch has been made available prior to disclosure.

How to help a user who can't find the Start button or the keyboard?

Re: The strangest call I ever had

"He never rang me back and to this day I am mystified as to what he was calling about."

Co-ax connectors?

Re: The joys of answering the phone

'They then call back and reply, 'No one's answering there. And BTW, the toilet's now flooding out of the washroom!"'

Is the server room underneath the washroom?

No.

SEP.

"who was extremely embarrassed by the sheer incompetence of her staff"

She should have been embarrassed by the lack of an effective escalation procedure in her operation. At the very minimum, even if the front line staff aren't capable of realising they're out of their depth, a problem that keeps coming back should be automatically escalated so that (a) the immediate problem gets fixed, (b) the front line staff are trained to handle it in future and (c) if there's a systemic problem that gets fixed. You were luck, there was someone higher to deal with it. I suspect that in most cases there isn't anyone behind the front line and that's why they can't escalate.

Re: Once

"I got asked by a client if their site could have a lighter shade of black please...."

Maybe you've never worked in textiles and encountered the numerous shades of black yarn.

Re: Lack of knowledge may be reasonable

"There will be funnies everywhere from the Police, to teachers (about parents I expect),"

a long time ago I was a member of the Institute of Biology which was supposed to be the biologists professional body but turned out to be largely populated by teachers, or at least it was largely biology teachers who contributed to the journal. Their funnies were mostly about exam answers.

Re: Clearly an early-day AI prank

"the number of people that call support who would fail a Turing test"

What gets me is the number of email-based support desk agents who would fail a Turing test.

Re: Do organisations not use 360 feedback for support services?

"I wonder how you dealt with illiterates in high places."

I doubt something like this could have been put in place except at the behest of top management so I'd guess they were already literate.

Re: Observed many times ...

"The moment someone on the helpdesk answers the phone, many people's brain will basically go limp and they go into a kind of malleable blank state."

That's because the helpdesk caught them unaware. They weren't expecting an answer.

Re: Start Button

"For bonus points, download their javascript, analyse it, and tell them what buggy crap it is, pointing out where they should be using try/catch."

I've started a similar thing with spam offers to improve my website. I correct the English in their email and ask them why I'd trust somebody who writes such crap to work on my (non-existent) website.

Google UK coughs up £130m back taxes. Is it enough?

"Tax laws should be written on one piece of paper with no get out clauses. Make it so IP can't be charged between the same company or limit it to a small % of revenue."

As soon as you start adding a few "make it so that..." clauses you end up needing a bigger piece of paper.

In international terms tax laws are in a competitive environment. Various governments have found the consequences of this on excise duties - the margin over French duties hit a level at which the booze cruise was invented. The end result is that it becomes a race to the bottom.

Five technologies you shouldn't bother looking out for in 2016

Re: Five technologies you shouldn't bother looking out for in 2016

"the one that the salesman talks them into getting"

the one that gives the salesman the biggest bonus

FTFY

Re: Five technologies you shouldn't bother looking out for in 2016

"So the Linux zealots on here reckon that the best Linux LotD solution is something that's pretty much as close as they can possibly get to a cosmetic and ease-of-use rip-off of Windows..?"

Let's look at that one on two levels.

Firstly, the actual suggestion was that in order to ease the transition from the familiar to the unfamiliar use a familiar interface. Applying an unfamiliar interface upsets users. Microsoft have discovered that - it would have been better for their users if they'd worked it out from first principles.

Secondly, if you go back & look what was about at the time Windows 95 came out you'd realise that it didn't spring ready-made from the forehead of Bill Gates. There were a lot of GUIs about back then. There was a good deal of cross-fertilisation.

The main application menu system until ribbons came along was based on CUA (Common User Access), mostly, IIRC, from IBM, a set of design principles intended to make things easier for users by providing consistency between applications.

A screen bottom bar with pop-up menus was already in use in interfaces such as CDE.

Some of the interface aspects came from HP's New Wave, an overlay on Win 3.

Yes, W95 put all these together very well and hit a sweet spot (apart from the error of putting the close button next to the maximise where it was too easy to hit it by mistake) but on the whole it was a synthesis of stuff a lot of other people had developed. So it's not surprising that for the desktop a lot of other designers have followed similar approaches, improving on it here & there with the like of multiple workspaces. But don't think you're looking at slavish imitation of a single original idea because you're not; you're looking at a convergence on what works best.

Re: Most recently a couple in their 60' s who installed Linux Mint without assistance

"Many over-60s went through the hell of fighting with DOS config files and Windows 3/3.1."

Come to that, just who were those who were the first to take up those 8-bit jobbies and put them to real use back in the '70s and how old are we now? Big clue - it wasn't our kids with the Beebs and Spectra; they came along later.