Posts by Doctor Syntax

Caption this: WIN a 6TB Western Digital Black hard drive with El Reg

The Computer Museum should have realised its new acquisition was the pre-production version of the Dalek.

Advice to hitch-hikers

1. Be careful who you thumb a lift from.

Ron's demonstration of advanced lift-thumbing technique had an unwelcome outcome.

TalkTalk CEO admits security fail, says hacker emailed ransom demand

@Chris King

Like you I've been through the Nildram>Pipex>Tiscali route but I jumped ship nearly 6 years ago. A good deal of what they had will be stale by now, certainly I've changed bank since then. I doubt either of us would fall for a call claiming to be from their customer disservices - they never did anything after the Tiscali takeover so why expect them to be getting round to it now?

In fact, after the Tiscali takeover their email support would have passed the Turing test - there was no way to tell whether it was human or a bot - but not in a good way.

Re: Ransom demand

"Can they really have only received one ransom demand?"

No, but only one's genuine. They're trying to work out which it is.

Laid-off IT workers: You want free on-demand service for what now?

I didn't miss that. But in the circumstances I'd have told them that MyCo wouldn't work for free but they appear to qualify for one of MyCo's special rates, the Over-A-Barrel rate. And the length of time taken would be the length of time to make it worth while.

From the Grauniad's article '"Mike McCoy, the company spokesperson, said: “We understand that a clause in our severance agreement was misconstrued versus its use in actual practice"'

"Misconstrued versus it use in actual practice?" What sort of garbage is that? The construction that everyone's been placing on it is based on what it said. Actual practice may usually be something different but the reality was that the possibility was hanging over all their ex-employees. It may have been some careless drafting by HR which said something other than was meant but you really shouldn't draw up legal documents that say what you don't mean.

Maybe whoever was responsible in HR has now been sent on his or her way with assurance that they will not be called in help at a later date, paid or unpaid.

Re: Humans fail too often

"In the future I expect to see more automated AI type systems that handle the coding side for you. Entrusting important long term solutions to fleshy meat bags is a lost battle."

Who writes the AI?

Re: How to save money in IT

"what happened at SunTrust looks like moving it from one pocket to another"

And possibly the other has a hole in it.

"Needless to say my answer, in short, was 'no'."

Bad answer. The correct answer is to name a price that will require authorisation well above the manager's limit so what he's done, and its consequences, will be visible further up the ladder. Only then, unless you're actually available for the gig, do you say 'no'.

Re: They don't call El Reg a redtop for nothing...

Go one step further & read Computerworld's linked article analysing it. They compare it with an earlier severance clause used by the bank and there are some differences. The earlier clause is much more restrictive on the circumstances in which it can be invoked. The intention may have been similar and the differences due to some casual editing by HR. However it's the agreement as it actually exists that matters and everyone in tech should have learned to pay attention to what a document doesn't say.

You've missed one out: the bank's customer data going walkabout.

If you had the choice of being a customer or an ex-customer which would you choose?

Snowden, Schrems, safe harbor ... it's time to rethink privacy policies, says FTC commish

"why worry"

Because if you don't see what's coming, you don't step out of the way & the train runs you down.

"She pointed out that the decision doesn't dig into the actual practices of Facebook"

That wasn't actually the ECJ's role. They were asked if national regulators could actually do this given that Safe Harbour was an EC matter. Part of the decision was that they could so it's now been tossed back to the regulator by the Irish High Court. In short it's being done by the people who were supposed to do it.

Apart from that she seems to have got the message. Whether she's in any position to act on it is a different matter. Maybe the poke at Europe was intended to distract from this.

"came as a shock to many policy makers and companies in the United States"

If it did they must have been living in a fools' paradise. What other decision could they have expected? Or didn't they know the case was happening?

American robocallers to be shamed in public lists

Don't do it. Don't waste time doing it. Just get on with prosecuting them.

Tardy TalkTalk advertised for a new infosec officer 1 week ago

"Call me old skool but the Head of Security should already be fired"

Call me even older school but the Board should accept the CEO's resignation. They may need to prompt her for it once they've accepted it.

In VW's case Winterkorn did the honourable thing in quitting although maybe the generous package tainted this. This seems to be an exception, someone at the head of a business which gets thing this wrong should quit, not make the rounds of the media giving interviews. It would ensure a culture in which things are done right, security gets precedence over marketing and customers can begin to trust the business.

Is this going to be one of those job interviews where they ask you "how would you deal with...?" and then use the replies to tell them what to do without actually giving anyone the job?

OTOH I think any candidates going to interview are going to ask some fairly pointed questions of their own, ending with "what budget do you have for all this?"

CISA latest: Law urging tech giants to share your info with the Feds shows no sign of stopping

Re: Two birds with one stone

"move HQ (extreme, unlikely)"

Unlikely to move it to the EU I agree, but to somewhere with a pleasant climate & very low taxes could be a reasonable probability.

Two birds with one stone

Maybe the tech companies should just move to the EU. It would get them out of this and out of the EU privacy concerns.

9 cuffed over £60 million banking scam targeting UK businesses

Re: I have always said

"An alternative would be to provide a phone number on their regular contact method (Bills etc), that you can ring and give a reference number to, which puts you through to the person who wanted to speak to you in the first place, possibly via account security checks."

The scammers have already thought of this. They invite the mark to call back to the number on the card & then pretend to hang up by putting a dial tone on the line. When the mark attempts to call the number they're still on the line to the scammers.

TalkTalk shares drop 10.7% despite research that breaches don't cause drops

'An article published in the Harvard Business Review earlier this year claimed that data breaches "don't hurt stock prices" due to shareholders lacking "good metrics, tools, and approaches to measure the impact of cyber attacks on businesses and translate that into a dollar value."'

On the other hand shareholders might just notice the company hitting the headlines and not in a good way. The good news is that with all those Harvard MBAs not having good metrics etc, those who decide to sell might still get a good price.

Support scammers target Mac fanbois

Re: Just Stop Using Sub-Domains

Nice rant but it omits one small detail. ara.apple.com isn't a subdomain. It's a host address. Try pinging it.

Re: Oh, Ohh OOhhhh, oooh pick me! Pick me!!

I've recently had some success in enticing SEO spammers into an exchange of emails but as I've no website to offer them I've not succeeded in wasting too much of their time so far. I'm tempted to work out some complex phraseology that means "don't click this" when analysed carefully but at first glance seems to say the opposite and then drop in a link from whatever phishing scam has turned up recently.

California enormo-quake prediction: Cracks form between US boffins

Is this thread the Californian equivalent of the Four Yorkshiremen sketch?

Bacon as deadly as cigarettes and asbestos

A Reg article sourced from the Mail?

BYOD battery bloodbath? Facebook 'fesses up to crook code

"a child in a car asking, 'Are we there yet? Are we there yet? Are we there yet?'"

This seems a fair description of the whole of their users' activity.

TalkTalk: Hackers may have nicked personal, banking info on 4 million Brits

Re: CEO Interview on 5 Live

"She said that customers could contact Talk Talk for advice on their security oh the Irony"

Maybe she meant that the customers could advise TalkTalk.

Re: Date of birth

@DarkOrb

"Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes."

So if you only took DoB for credit checking you've failed on that data protection principle.

"Credit check"

In that case they don't need to keep it. If that's the only reason and they keep it anyway they fail data protection principle 5: Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

That, of course, is in addition to failing 7: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

"One of the questions is why do they want a DOB?"

Because this piece of information which people are asked for in all sorts of circumstances is a shared secret between themselves and their customers to help identify said customers?

"Why, in my mind, does this translate into 'all of our customer's data has been compromised'?"

And why does all the stuff about constantly updating systems seem to be missing 'in the future'?

Sales down, profit up, 1,000 bods chopped: Your one-minute guide to Planet Microsoft

"$84.3 million for the financial year of 2014 and $18 million in 2015"

He's going to be broke if this trend continues in 2016.

Shopping mall CCTV gear commandeered to blast websites offline

ISTM that the only way round this is to add a requirement for type approval that a device have its default creds only effective for an initial login and at initial login the user must enter new values before it will become operational. A factory reset will restore the defaults and the user must then enter new values again. In order for this to become effective there must be no means of carrying out a remote factory reset.

TalkTalk website STILL down on day TWO

@ aidanstevens

You have our sympathy - maybe.

Things are improving

They know they've an outage. From what I recall of the standard of customer services when they took over my previous ISP news like that wouldn't have got through to operations so quickly.

Bracken assembles old GDS crew for Co-op

Re: Oh dear god

"3. What ever salaries they are demanding - quarter it."

Even better, double it and demand that that's what they pay you.

"won the Design of the Year Award"

Style over substance.

Windows 10 out, users happy, PCs upgraded, my work here is done – says Microsoft OS chief

Re: once Windows 10 has completely rolling out?

And it's not completely rolled out. It's on perpetual rolling release.

Re: Warning! Incoming - JimS

"Windows 10 however, upon being told to look for printers on the network, found all of them almost instantly and set itself up with absolutely no intervention from me."

Quite the contrary to my experience with the brief insider test. Firstly it confined itself to a subset of my LAN & would never have found the printer. Secondly, once some fixes had been rolled out to change subnet masks it still didn't help because it didn't have a driver for the printer, HP2030. I went to the HP site & downloaded the W8 version which worked OK. Maybe they ported more drivers later but this was getting close to release date.

FBI, US g-men tried to snatch DNA results from blood-testing biz. What a time to be alive

"This is going to cause major problems for a lot of European healthcare providers who might use US based or US owned labs for testing batches of samples."

Not necessarily. All they need to do send a sample with just an ID code and keep the patient's details to themselves. Otherwise the ECJ has already caused them major problems.

Re: This is the sole reason I haven't had my DNA tested

I'd turn that statement round. I have no reason to have my DNA tested.

"I could either co-operate, or they would use a tuft of my hair removed by force and slap an assault charge on in addition."

That doesn't sound like an effective way to get the evidence admitted in court.

"Nice idea but for the most part, impractical. Lawsuits cost money "

If this were evidence that the prosecution were attempting to put forward for a criminal offence you'd be in court anyway. They'd have to prove reasonableness in order to get the evidence in. I don't know about US criminal proceedings but I hope that's how it still works hereabouts.

CISA blowup: 'Web giants sharing private info isn't about security – it's state surveillance'

Re: @Steven Roper The US goverment is slitting its country's own throat

"And what, pray tell, is wrong with that?"

He didn't say there was anything wrong with it. He just stated the bleedin' obvious.

Paris bins banlieue bit barn because cloud is too loud

Re: Don't mess with French mayors on planning issues

Another example from this side of the Channel.

Castle Hill, near Huddersfield is a scheduled ancient monument. It's a hill fort (late Bronze Age IICR the excavation report) converted by the Normans into a motte & bailey castle. In the late C19th a pub was built in the bailey & a tower to celebrate Queen Victoria's jubilee was perched on top of the motte - not things you'd get away with now. From what I can remember of my only visit to the pub many years ago it was in quite an attractive Arts & Crafts style, as is the tower.

A few years ago the owners of the pub applied for planning permission for an extension and incredibly - remember that this was inside a scheduled monument - got it. The permission covered a limited amount of demolition. They demolished rather more and TPTB stepped in, stopped work and told them to reinstate using the original materials. They'd (cough) failed to retain the original materials on site (dressed stone in that style is quite valuable) so they couldn't do that. The consequence was that they had to demolish the rest of the building & make good.

Incredibly once in a while there are renewed attempts to get a new pub built on the site quite ignoring the fact that it's still an ancient monument.

WIN a 6TB Western Digital Black hard drive with El Reg

Oops. Who left that there?

Combining gymnastics with the obstacle race. Will it make it to the Olympics?

Get whimsical and win a Western Digital Black 6TB hard drive

Combining gymnastics with the obstacle race. Will it make it to the Olympics?

Oh, OK then: Ireland will probe Max Schrems' Facebook complaints

" the Irish DPC is over a supermarket in a small country town"

I think they may be looking for larger premises soon.

Re: Highly suspicious refusal

According to the ECJ's statement the DPC weren't aware that they had the right to investigate. Presumably there was no precedent in the matter to make it clear that that right existed. It's as well to remember that at the core of the matter is the behaviour of government bodies acting illegally. It isn't reasonable to expect the DPC to act if they had no right to do so when that's what we're all complaining about. So Schrems sued them in the Irish High Court who then booted it up to the ECJ. If the ECJ hadn't agreed with him he might have found himself paying the DPC's costs. Remember that he started it out in his own court system in Austria & they told him to raise it with Ireland.

Overall what's happened is that due process of law has been followed and it's due process, or the lack of it, which is the basis of the Safe Harbour's failure. It needed to go to the ECJ to get everything clarified. It may seem wrong that it required an individual to do this but that's the way case law works; it needs cases. Now there are rulings which can be used by other DP regulators.

Again it's worth remembering that if you want to complain about due process not being followed you can't really cavil about due process being followed when that complaint is handled.