Posts by Doctor Syntax

Gartner: RIP double-digit smartphone growth. 2016 has killed you

Just for comparison, can we see their predictions for the last few years & how they worked out?

Legion of demons found in ancient auto medical supply dispensing cabinets

Re: Wonderful options available...

"Nope. Hospitals are a regulated environment, which means anything that runs there MUST... be approved by the government... The more custom the software, the longer and more costly the vetting process."

Nope? You make an excellent case for the software vendors not relying on an OS whose EOL can be dictated by a 3rd party.

@Olaf

As Thames pointed out the systems are networked to a central control so it's not a matter of air-gapping individual machines.

But the real problem is that it's been all too easy to install a single network, hang everything off it and depend on perimeter security. When you have PoS terminals compromised by laptops plugged into the network by HVAC technicians it should be crystal clear that that doesn't work. For years we've been told to program defensively; network designers should have been told to work on similar principles and connect clusters of machines that need to work together but isolate them from everything else.

Re: Requirements specification

Make that 15 years from time of installation.

@thames

There's a difference between air-gapping individual units and segmenting your network so that someone who might open an email containing an alleged invoice or someone servicing the HVAC installation can't affect each other let alone critical systems such as these.

It requires thought and planning. It probably requires more expenditure on H/W as functionality which would otherwise be provided centrally need to be provided separately on each segment. But if you take security seriously it has to be done.

And yes, I have worked in a situation where admin offices and production had separate networks and even different parts of production were subject to extra security. Security was taken very seriously, it was the first word in the business's name and they meant it.

Military intelligence, AI style: MoD cosies up to Massive Analytic

its Innovation Warehouse in Farringdon

I can just imagine the scene. All the towering racking and the fork lifts scurrying here & there with their loads of innovations.

That one phone the FBI wanted unlocked? Here are 63 more, says ACLU

Re: I assume this law only applies to companies within the US

"So Apple and Google (and other similar tech companies) could move their unlocking technology to a subsidiary that exists outside of the US - France for example."

France might be a dubious example. They seem very keen on no encryption just now.

"taking note of what they considered defects or excesses in that framework"

We're in agreement that legal frameworks can have defects and excesses. The question here is whether the All Writs Act is one of those.

"Search warrants have been standard law enforcement tools for a long time, and they generally are issued one or a few at a time, in conjunction with specific investigations"

This is quite true and it's right that they should be case specific. In fact this is one of the problems with bulk interception - it doesn't have the specificity and safeguards of a search warrant; it treats everyone as a suspect and thus tramples on the presumption of innocence; that presumption is one of the safeguards of all those who are innocent.

But this wasn't about a search warrant. It was a warrant issued against a third party to compel them to do something, ostensibly just once but clearly, to anyone with a whit of judgement, as a precedent. And the end point of that precedent-setting trail would likely be a tool usable against any Apple device and corresponding tools against other devices which would treat everyone as a suspect etc.

Re: Perjury is a crime

It's witnesses who give evidence under oath. Lawyers just make unsworn statements to the court. So the question arises whether "just one" was evidence (how much evidence would be presented in a warrant application?), a statement to the court or PR external to the court. Only one of these risks perjury.

Microsoft's Brad Smith on encryption: Let the politicians decide

"even a presence (a single office, with a single employee) in the USA is enough to get press ganged into helping the US Government."

Really?

"Sorry, we don't have anyone with those skills here but if you really insist I could try. Have you got a spare in case I break it?"

"American tech companies to do global business. Companies like Google, Apple, Facebook, MS, Amazon....But Amazon and Apple rely on physical premises"

Who says they have to remain American?

Apple depend on physical premises in China where stuff is made but they don't even own those premises. They may have a large vanity building in the US but they'd probably find a purchaser for it if it became preferable to move offshore.

Amazon has distribution centres and data centres all over the world. Why should the US ones be more special than those elsewhere?

Global businesses can go where the legislative environment suits them but if they're big enough simply threatening to move is sufficient. HSBC has been mulling over moving out of London for years - it keeps the UK regulators from making any moves that would really upset it.

"only four-and-a-half per cent of the world's population lives in the United States. But technology is global."

Perhaps he didn't need to be explicit about the corollary. If a business wants to address the other ninety-five-and-a-half per cent it will need to base itself where local laws allow it to behave in a manner acceptable to those potential customers. That's something that legislators of each country will need to bear in mind.

Furious English villagers force council climbdown over Satan's stone booty

Re: The compensation culture at work!

"a two foot bolder in the dark is hardly the same as a pedestrian or a cyclist"

From the pictures on the Beeb it appears to be either chalk or to be painted white so it's a good deal more visible than the standard dark-clothed pedestrian or unlit cyclist.

When should you bin that old mainframe? Infrastructure 101

Re: I think the headline ...

"the ancient god-computers from the mid-80s"

Those would be the ones with the core applications that run the business that brings in the money that pays everyone's wages. The ones everyone born later than the mid-80s sneer at.

Senator Wyden recalls SOPA fight in bid to defeat encryption-weakening efforts

"I thought I heard a call from the US Government for better security."

Your hearing is faulty. It was from a US Senator, not from the US govt.

Bash on Windows. Repeat, Microsoft demos Bash on Windows

Re: Wheels within wheels within wheels ...

"This reminds me a lot of the CoLinux project (which seems to have died off, last update 2014)."

And that update says they'd moved their stuff to SourceForge which must have been about the worst time to do that. Cause and effect?

"Apple's great success at effectively outsourcing their lower level OS to BSD while sticking to the API's and GUI that end users actually care about"

I think I can see the problem MS might have applying that to Windows these days.

Adblock wins in court again – this time against German newspaper

Re: I keep asking and no one answers.

"I've said before but if you block ads then you are effectively killing almost all online journalism. Up to you if that's a world you want."

Let's ignore the "bad to piss off potential customer" aspect of advertising, even though the ads that do that are what brought adblocking into existence.

Today's problem is malvertising. Ad blocking is no longer just a matter of aesthetics, it's a matter of basic IT security. It just isn't acceptable to bleat about killing online journalism without a solution. Viewers who've been hit with ransomware from a news site are going to stay away for good so the end effect is much the same for the site but worse for the user.

We've heard some mention some months ago about an initiative but seen nothing. The industry simply winges about adblocking but makes little attempt to see itself as others see it or to recognise that it has brought its problems on itself and does nothing whatsoever about it.

Frankly, I think the online advertising industry is in a death spiral. It has only its arrogant, narcissistic self to blame and, frankly, the sooner it's gone the better. Then online journalism can get on with developing a business model that works.

Re: A hollow victory

I tried this uBlock Origin of which you speak. It stopped the weather forecasts on the Beeb site from working. That was the end of it. ABP with the box unticked continues to work fine.

"So if you leave the computer running and go to bed, you being served ads... using your electric and your bandwidth."

Turn it off when you're not using it. It's using electricity whether MS are sending it ads or not.

Re: $22bn

"Unless they think the kind of people who block ads are the same kind of people who also love them and click on them and buy from them..."

They think everyone really loves ads and can't understand how or why adblockers got into browsers. Maybe they think they're some sort of malware.

Hospital servers in crosshairs of new ransomware strain

Re: Why healthcare?

"Because there are a LOT of embedded systems in hospital equipment. A lot of it can't be reliably updated/patched, either. So, you have a large number of soft targets."

But you can start segmenting the networks so Janice-in-accounts is 2 or 3 hops away from anything embedded that's even mildly critical.

Re: Balance of Trade needed here?

"I propose that DARPA, GCHQ or some other appropriate government agency (or agencies) encourage Western hackers to write and deploy locker software that attacks ONLY computers that ARE Russian."

An alternative. Stop routing traffic to or from Russia one hour a day this month. Next month two hours a day. The month after one day a week...

Legal right to 10Mbps broadband is 'not enough', thunders KCOM chief

Re: Faux Yorkshire subtitle

"First time I've heard of Hull being pronounced with an H."

And with the definite object it appears to mean the river.

Re: Faux Yorkshire subtitle

"Is regionally incorrect."

Is there any region in which it is correct?

BMW complies with GPL by handing over i3 car code

"they haven't actually complied with the GPL because they have not provided their modified/derived source."

The letter says that they're sending the code "as far as it is required by the OSS licence conditions". They say that there is vehicle code that they haven't sent. There's no indication as to whether this is modified/derived source so there's no basis for assuming that it is.

There seems to be a widespread assumption that because a program runs on some particular platform it must be a derivative of it. It's perfectly possible to write a program which compiles unchanged and runs on multiple platforms so what's the basis for thinking that it's derivative of one of them?

"or are told not to escalate things which I'd have thought unlikely."

ISTM that typical call centres today completely lack escalation. Queries just get bounced round between front line agents to fail repeatedly because front line is all there is.

Love our open API? Talk to our lawyers, says If This Then That

I looks as if we're seeing cargo cult approaches to open source.

There have been a few successful approaches to this:

1. Work for what you see as the common good, expecting and receiving minimal rewards - works as a full-time developer if an essentially hippy lifestyle is OK for you.

2. Work for the common good but produce something which is of sufficient value to business users that they're prepared to fund you.

3. Offer some OS-related service such as support on top of your OS work.

4. Use OS to provide some non-OS related product or service and feed back your own contributions, essentially sharing development costs with others who might even be your competitors.

What appears to have happened is that people have seen OS work for others and joined in as creators or as consumers without understanding what makes these approaches work and indeed, without understanding that OS development really involves contributing to a commons.

Re: "Share on Facebook the most viral stories on Entertainment Weekly"

"You could do it via a MongoDB-backed Node.Js application that uses Cortana to generate text prefiltered by Watson."

Fail. You missed both DevOps and Hyperconvergence.

Re: Seriously?

"Just what in hell's name do they (or their deranged lawyers) expect to profitably gain by this?"

They expect lots of users to sign up without reading the ToS. And they're probably right.

'No regrets' says chap who felled JavaScript's Jenga tower – as devs ask: Have we forgotten how to code?

Well, hi there, Qix-. Are you going to comment on anything else?

Re: Maybe the lazy in us expects...

"the implicit contract"

Implicit? As in not worth the paper it's not written on?

Re: Are these dynamic dependencies really a good idea?

"the idea of versioning and micro-dependencies works fine in the javascript world"

Lots of thing work fine right up to the point where they hit the wall - as demonstrated here.

Which was around first, Nik the messaging app or nik wot Koçulu wrote?

Re: So, theft is better than failure?

"They are open source packages, once you release code open source you can't claim ownership over its use. That's the whole point of open source."

Maybe. It depends what, if any, licence is attached. A licence is permission to do something. Just because the source is published it doesn't mean a licence was granted.

Unless the ToCs of the site require the author to grant a licence or the author explicitly granted a licence then there isn't one which means there's actually no permission. Continued use then depends on the author's goodwill in not enforcing copyright and the author is entirely within his rights in withdrawing if he feels that's appropriate. So the relevant questions are was a licence granted by publication on the site and if so what were its terms?

Mal Men men hit LiveJournal with Angler exploit kit

Re: Ad Blockers?

"Fix this sort of thing..."

It's beyond fixing.

It's been obvious for some time now that this was likely to be final nail in the ad industry's coffin if the likes of Google didn't deal with it PDQ. All that's left now is for the ad blockers to fill in the hole.

The FBI lost this round against Apple – but it aims to win the war

Re: End of the War

"For more than two centuries there has been a balance in the US between the government and citizens as to how far the government may intrude into citizens' personal and private matters, and on what basis....The basic arrangement, in which a government official must petition a judge for a search warrant, citing facts to support a claim of probable cause to believe a crime has been committed or is about to be, and describing the search target with reasonable precision, has not changed and is not likely to."

The first statement applies pretty widely to any legal system that inherits from the English. It was the second that was in danger here as success for the FBI would undoubtedly have been the first step in attempting to gain a chain of precedents that would end by compelling vendors to supply skeleton keys on demand.

If such a change were made it would require a wide consideration of public policy which includes considerations such as does the US (or any other specific country debating this) want a tech industry.

Apple's fruitless rootless security broken by code that fits in a tweet

No magic bullet

Of course it isn't a magic bullet. Existing security in both the Windows and Unix-derived worlds is too close to being perimeter-only for safety. We need at least three things to make life difficult for malware and for ransomware in particular.

First, instead of accessing storage on their own user processes should go through a back-end with specific permissions. My particular experience of this is with Informix where normal usage is to assign one or more allocations of raw disk, chown informix:informix, chmod 660 but this idea isn't specific to a particular product.

Secondly, introduce a concept of application permissions that sits alongside user permissions. The backend might, for instance be run by user and group odf-storage and only accept read/write requests from odf-user which would own the likes of LibreOffice and OpenOffice applications and even then only honour requests that matched the user's permissions.

Thirdly, and this is where something like Apple's idea comes in, the kernel would lock root out from changing such storage on its own account; it would need to be authorised by a specific user, such as odf-admin for instance, to de-allocate odf storage.

There are a good many practical difficulties is this, primarily in maintaining the chain of authenticity through updates. But Unix security has been watered down over the years in the name of convenience and Windows, starting as a single user system, has found it difficult to build security in and their problems won't be addressed by simply wringing our hands when things get hard.

It would also help if email had signing built in as part of the core protocol, web-advertising would just die and web 2.0 designers didn't rely on hauling in bits of code from sites over which they have no control.

Zombie SCO rises from the grave again

A commentard here pointed out last time round that the terms of that judgement appeared to be clearing a way for an appeal so this should be no surprise.

Closing courts to fling £700m at digital stand-ins will fail, MPs snarl at UK.gov

Re: Ah!

"Just another round of flogging off the nation's assets to cover the incompetence of the Chancellor."

Yes, but which chancellor? The current one, the previous one or the one before that who thought that the best way to manage interest rates was to exclude a housing bubble from his inflation measurements?

Ransomware now using disk-level encryption

Re: Always a fool

"Because education isn't as effective as you think....And before you can suggest firing him, more often than not the idiot's up top."

Experience is a dear teacher but there are those who will learn from no other.

US govt says it has cracked killer's iPhone, legs it from Apple fight

Re: Missing the big picture

"The bottom line is the FBI are now in a position to assert that Apple's unwillingness to help law enforcement endangered America and Americans."

They can & maybe will assert it. You can assert anything you want. Proving it is tricky. To prove it they'd have to arrest some previously unknown co-conspirator and introduce evidence from the phone, together with an account of how that evidence was obtained.

But you're right, they can assert it. That's easy.

Re: Fingerprints

"I'm assuming the feds may have obtained the miscreants fingerprints at some point, perhaps during immigration?"

What's this with immigration? They had the bodies - fingerprints, toeprints, arseprints, anything they wanted. I think we can assume that that wasn't enough.

Re: So what happens...

"when the FBI say they found important evidence"

And prove it.

Re: Luggage telltale

"Except that after your side-cutters have been confiscated at security, you have no way to open your own luggage"

Don't they have shops that sell side cutters in the US?

Re: We live in interesting times...

"Did the FBI actually get what they wanted or is this a face saving smokescreen."

Let's see what happens to all those other phones that are supposed to be in the queue. That might drop us a hint.

Another factor about this one - even if there was information in here it wouldn't be likely to end up as evidence in court so they can keep quiet about what, if anything, they did. If there is a technique that works and that actually produces evidence in the other cases they'll have to tell something about it in court.

As I said, let's see.

Re: And now this is the worst

"What was being resisted was (a) a tool that could be routinely used (e.g. during police stop & search or temporary unauthorized access to a phone)...

That's not something that was ever being asked for, nor is it something that it would have been reasonable to believe was possible."

You don't think so? Not necessarily in the first place. But having got a precedent in the bast case they could come up with the next step would be to widen it a little. And then a little more. And so on.

The other issue could have been that there's a precedent which only applies if the suspect is dead. Well, that's a circumstance that could be arranged...

Re: A Kick in the Nuts

"And 256 bit encryption CANNOT be brute forced. "

How many times do we have to have somebody trying to show us how smart they are by grasping the wrong end of the stick.

The FBI weren't trying to break 256 bit encryption by brute force.

They were trying to break a pass code.

A four digit pass code AIUI.

Now go away and work out how many bits that is. Big clue: it's a lot less than 256 bits.