Posts by Doctor Syntax

FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers

Logic fail

"an IP address not associated with an Uber employee and otherwise unknown to Uber"

Until they identify who it was they can't possibly know whether or not it was a Uber employee.

I, ROBOT ~ YOU, MORON. How else will automated news work?

The robots are amongst us

Long ago my job used to involve taking laboratory results which needed to be interpreted in probabilistic terms and try to express these so than non-experts could appreciate the nuances involved. A colleague and I had a standing joke about writing a program which could be fed the data & generate reports in terms such as "not entirely inconsistent with" or "guilty as charged".

As part of my great escape plan I had a job interview with an agency that used psychological tests in using forms consisting of statements & check boxes for reactions. The interviewer took the results into a back room, fed them into an optical mark reader & returned with the resulting profile written in narrative form just as we'd joked about.

What I'd like to find now is a sort of reverse Turing test, one which will tell the difference between a call centre agent and a badly programmed bot.

"And Those Initial Capitals Are Annoying"

But not as ANNOYING AS THESE

BOFH: The ONE-NINE uptime solution

Re: Love it!

@chivo243

I wasn't aware of your reference. Having been in my time a forensic biologist your mention of strippers & vacuum cleaners brought to mind distant recollections of some gems of medico-legal literature.

Re: Love it!

I think this was a BOFH where you could seriously injure yourself reading it.

Re: Love it!

Good, but not as good as "Look, as I said to Schrodinger - what happens in the cat box stays in the cat box."

Reckon YOU can write better headlines than us? Great – apply within

Re: Easy!

%s/of/have/g

SCC bags universal credit hosting contract

What do you mean: disaster recovery? It is a disaster.

BP: Oil prices crashed, so must our ICT budget

Re: Greed

"Isn't 12 billion dollars profit enough to be going on with?"

I suppose it depends on how much of your pension is invested in them.

Lenovo: We SWEAR we're done with bloatware, adware and scumware

Weasel words

“The events of last week reinforce the principle that customer experience, security and privacy must be our top priorities,”

Reinforce? What they mean is "brought home to us that we should have always known that". If they'd said that then they might have started to look honest in their statements.

It's the same as "your call/privacy/<whatever they've just failed on> is important to us". No it isn't or they'd have worked harder at it.

The only way to make a promise to do better look credible is to for a company to admit that the reason they failed was that they paid little if any attention to whatever it was they failed on. As soon as the familiar PR line is trotted out as a preliminary to whatever's being said all credibility is lost.

It's the EU and me against the world – Euro digi-chief

"He also echoed Digi-Veep Andrus Ansip’s regular refrain that geo-blocking is bad... primarily because it stops people watching football."

What's wrong with that?

And the buggiest OS provider award goes to ... APPLE?

When it comes down to severe vulnerabilities Linux kernel & Windows are more or less level. It's Apple that has the problems. Also that pariah of applications, Flash, comes out lower than IE, Chrome and Firefox but a larger proportion of vulnerabilities are severe. Another oddity: Seamonkey which combines browser and Thunderbird functionality comes out lower than either Firefox or Thunderbird.

Re: This is not a football match.

" People at my workplace complain about how hard Linux is to use, even describe it as "weird", but that is because many of them started with Windows XP (or maybe Windows 98) and didn't see what Linux was like years ago when getting a graphical desktop meant a long session with XF86configurator and a need for deep knowledge of your hardware."

To a large extent "hard to use" can translate as "different" but the desktop you're providing can also make a difference. Presumably they'd have come up with exactly the same reaction to Win 8.

C’mon Lenovo. Superfish hooked, but Pokki Start Menu still roaming free

Re: I hope this keeps kicking off...

"Let's pray that this issue continues blowing up to the point that the corporates see bundling shiteware as a realistic threat to their market share."

And also strengthens their backbones when it comes it pressure to install spooks' backdoors.

Lenovo CTO: Hey, look around – we're not the only ones with a crapware infection

Security audit

How does a security audit now tell anyone what they'll be pre-loading this time next year?

"Step one is to fess up to customers exactly what you earn per-machine for the crap you are pre-installing."

And say exactly what it does. And I mean exactly. Not "it enables you to make better choices" or such weasel words but "it intercepts your communications to spy on what you're doing in order to serve up ads whether you want them or not".

MP resigns as security committee chair amid 'cash-for-access' claims

It's good that Malcom Rifkind remains on the sub-committee overseeing secret surveillance. After all, he now knows what it's like to be on the receiving end.

Samb-AAAHH! Scary remote execution vuln spotted in Windows-Linux interop code

"I guess it's an artefact of grafting support for the MS protocols onto GNU/Linux rather than having a true remote login."

A remote login would also require a root process in order to be able to fork a process under the eventual user ID. e.g.

ps -ef|grep getty

root 3849 1 0 08:55 tty1 00:00:00 /sbin/getty 38400 tty1

etc. It's a consequence of the Unix security model.

Apple forks out nearly $2bn for two ripe, green data centres

Re: Servicing that demand?

"I wonder where they're going to find the generating capacity for this centre."

Peat burning power stations? If you wait a few thousand years all those bogs that Bord na Mona have been cutting will have regenerated.

ACLU: Here's a secret – cops are using the FBI's fake cell-tower tech to track crims' phones

"the technology was covered under a non-disclosure agreement"

I'd have thought a court summons would have trumped an NDA.

German music moguls slammed for 'wurst ever DMCA takedown spam'

"several technical servers problems"

Translation: "We release stuff without testing"

Tweak comms laws or Facebook 'n' Twitter folk will be treated like CRIMINALS

Re: Trouble is ...

I think the serial failure of common sense started with Chambers himself.

Lenovo to customers: We only just found out about this Superfish vuln – remove it NOW

Re: Correction

"Superfish were the party in question"

The quote about a 3rd party seems to have been from a statement by Superfish. It turns out that the SSL interception stuff they used came from Komodia. It looks, then as if the 3rd party they're trying to point the finger at is Komodia. So are they claiming they didn't know the implications of the stuff they bought in from Komodia?

Didn't the Left once want the WORKERS to get all the dosh?

Re: However

"Can you really imagine the catastrophic consequences of a President Bliar?"

Don't even mention it.

<shudder>

Re: However

"free to watch matches on BBC"

And that means a disproportionate amount of my licence money going to pay excessive wages to a bunch of yahoos chasing bags of wind up and down fields.

Re: However

@ Sarah Balfour

That's right. Have an elected head of state. What would you get? A politician.

Frankly, I don't envy the queen one jot. I'm a good deal younger than her and retired. There's no way I'd want to be condemned to carry on in harness until I drop.

Linux clockpocalypse in 2038 is looming and there's no 'serious plan'

Re: Not just Linux

" the last modified Julian date that can be represented in the DVB format, which is 22nd April 2038"

Maybe not such a problem.

The key thing is that DVB only needs to be interested in dates after it was introduced. It will never have to deal with learlier. So let the date roll over. After 57074 the next Julian number will appear to be 00000 which will unambiguously signify 23rd April 2038. Introduce this into the standard now so that manufacturers can start building firmware on this basis PDQ.

In 2038 very old kit for which a firmware update either wasn't available or wasn't applied will become obsolete but this isn't anything new with DVB; remember the entire analogue system or the early STBs that could only cope with a few channels?

Of course this assumes that the Ministry of Fun haven't flogged off the DVB spectrum to mobile operators.

Re: So basically...

I suggest you go back up the thread & read thames's posts. You will find that the kernel, you know, the bit that the allegedly shouty Mr Torvalds is responsible for, is now 64bit. The problem is in the userland.

Changing to 64bit in userland is a bit more of a problem than just recompiling everything with a revised time_t declaration as there may be existing data with the 32bit format which will have to be handled sensibly by the new software. That will be a matter for every application which produces and consumes such data.

Re: Nah...

"Alas, Tristram, it looks very much as if you never got to my second paragraph... "

According to the down-votes it looks as if a lot of other people didn't either. So have an up-vote from me to help counter-balance.

As I've written here before I worked on Y2K as well and the client's bean-counters decided to demonstrate it really was a problem. What they actually decided to do was to wait until mid-January before they'd let us cut over to the new system (which they'd already tested & accepted) because they didn't want to take the risk of using something new before they'd completed their year-end stuff. This despite being warned. Yup, Y2K was a thing.

A truly SHOCKING tale of electrified PCs

"a large hammer"

A steel ruler makes an even more convincing sound.

Re: Bad earth.

One house I bought had originally been wired up in Edwardian times & only had bits & pieces of wiring added after that, none of it with the benefit of any sort of earth connection. Some of the main bedroom fittings had wiring brought down from the roof space in metal conduit (the lighting wiring was in wooden conduit). The earth wires from the fittings were simply twisted round the top of the conduit. On lifting some floor boards in one of the children's bedrooms I discovered that the earth of the sockets there was a six inch nail driven into the mortar of one of the walls. It got worse - in the other child's bedroom the earth was a six inch nail driven into a joist.

BOFH: The Great HellDesk geek leave seek

Re: This sounds horribly familiar

"bean counters in collaboration with satin" (satin?)

When I was in the Civil Service Satan was the Inland Revenue (or vice versa). There was always some, apparently new, IR regulation as to why this wasn't an allowable journey, even when the reasoning contradicted that given for disallowing the previous journey.

Superfish: Lenovo? More like Lolnono – until they get real on privacy

Outrage can strike a fatal blow. If it does there's no reputation left to recover. On this side of the pond we have the concept of "doing a Ratner".

"all it guarantees is that top management weren't in control of the company"

Trevor's analysis was that this level of detail wasn't something that would be expected to go up to the top management. I agree with that. Being in control shouldn't mean micro-managing. It should, however, mean that standards are set in relation to the way customers are treated and that breaching those standards are a disciplinary matter. So I'd expect a top management in control of its company to exercise that discipline.

It might well be the case that such standards hadn't been set in which case it might be somewhat unfair to the execs concerned if top management didn't eventually follow them but that's a matter for the board. In the immediate aftermath of things going wrong like this, however, it's the top management who are in a position to act sufficiently quickly, not the board.

"I know you want someone's head on a pike (god damn it, you're angry...)"

Nothing personal; I don't have a Lenovo & use Windows only rarely so I'm not directly affected. My response was purely on the basis of what Lenovo need to do to maintain trust. The same would apply to any other company that breaches customers' trust.

Back in the day we used to hear about businesses being customer focussed; I even worked for one which, at that time took it seriously. Since then just about every big business seems to have joined the race to the bottom. When they get there they have no more advantage over their competitors than when they started; their competitors are still right alongside them. They have no cost advantage over their competitors. In the PC world they are selling kit using the same component bins as their competitors with the same OS as their competitors. The only thing they can compete on is their reputation.

And I disagree with you that reputation only lasts a few months at most. It's a long term asset, hard won, easily lost and, once lost, even harder to regain. So once something like this happens they need to send out a message that this is not typical of they way they want to behave and that breaches of customer trust are and will continue to be a sacking offence.

On the whole I agree with you Trevor except you've missed out one thing - the need to have responded positively and fast. Not only should top management have immediately cottoned onto the fact that this was bad but they should have said so, located the execs responsible, fired them and checked for any similar stuff in other crapware, including in discontinued products, and dealt with it in the same way.

It might or might not have been mildly unfair to the execs but it would have sent a powerful message to the rest of the company and customers that this will not happen again.

From the customer's point of view, of course, the fact that the crapware brings the price down to below cost is good news providing you never intended to use the original OS anyway.

For pity's sake, you fool! DON'T UPGRADE it will make it worse

Re: US International layout (Windows)

@ Steve Davies

This is, at root, exactly the the same problem as Mrs Dabbsie's.

In IT if you don't start by finding out what the user needs you're doing it wrong.

Hellooo, NSA? The US State Department can't kick hackers out of its networks – report

Re: "That's the FBI's and GCHQ's responsibility"

" I though GCHQ had nothing official to do with the US"

Keep up at the back there.

It's illegal for NSA to spy in the US but legal (in US law) for them to spy in the UK & it's illegal for GCHQ to spy in the UK but legal (in UK law) for them to spy in the US. So each contracts out their spying on their own populace to the other. Everyone's happy except for the plebs and they don't count.

So long, Lenovo, and no thanks for all the super-creepy Superfish

Re: What is it with advertisers?

"The goal of advertising is not to increase the available wealth of the target, but but have him allocate wealth differently than it would have been done otherwise."

And it's very effective. I quite frequently reallocate my business away from companies who pester me.

Hello Barbie: Hang on, this Wi-Fi doll records your child's voice?

All those "think of the children" politicians - what do they have to say about this?

Re: ::shudder:: Do not want! At all! This is the definition of creepy.

"What parent, in their right mind, wants a corporation listening to the private musings of a Barbie-aged child and/or neighbor children, talking to a doll?"

The really worrying thing is that there are lot of them who will just love the idea of that email summary.

Re: But does it support WPA2?

'Where did I come from'

'Dunno about you but I came from Hamleys*'

*Other toyshops are available this scans better than some I could think of.

Re: The privacy policy says it records video too?

" I dread to think what things were like back when the first people to see the results were the processing staff at Boots....."

We know what things were like then: http://www.independent.co.uk/news/julia-somerville-defends-innocent-family-photos-1538516.html And yes, it was Boots.

Lenovo shipped lappies with man-in-the-middle ad/mal/bloatware

Re: Secure boot?

"The purpose of the secure boot is to establish a chain of trust from the power ON."

Yes, and it's a very short chain.

" If you, as a root/admin or OEM, install malware which does MITM - UEFI secure boot will not stop you (and it is not even designed to do that)."

This is my point. The chain of trust isn't even long enough to ensure that the OEM OS image is trustworthy.

It might have been a great idea at some time to make a genuinely trustworthy system but if so it was inadequate. For that to happen the boot process would have had to have the capacity to inspect the OS's certificates and if it found any deemed untrustworthy eliminate them or boot into a very restricted mode. Of course many of us might find this sort of behaviour unacceptably intrusive; there's always a trade-off between usability and security.

Alternatively it might have been a marketing ploy to give customers a feeling of security and maybe try to block attempts to load other OSs by establishing a degree of ownership over the hardware.

What it clearly doesn't do is ensure that it the customer at least starts off with a trustworthy machine.

Re: Secure boot?

The whole point is that secure boot is supposed to establish a chain of trust. A chain of trust requires each link in the chain (and you know what they say about chains and weakest links) to be trustworthy. So if Microsoft is signing a bootloader as trustworthy then they should have assured themselves that the system it's loading is trustworthy otherwise that chain of trust means nothing.

If that system is Lenovo's spin of Windows then it's up to them to assure themselves that Lenovo can be trusted to produce a trustworthy system image. That requires Lenovo in turn to assure themselves that anything they include is also trustworthy. It requires due diligence all down the chain.

Re: a different look

Maybe el Reg should have asked them for a comment as well. They only seem to have asked Lenovo & Superfish.

Secure boot?

Does this model boot with the UEFI/Secure boot stuff? If so it makes a mockery of secure boot.

After Brit spies 'snoop' on families' lawyers, UK govt admits: We flouted human rights laws

One thing I'd like to see from all this

The barristers who accepted this information being disbarred. They must have been aware that it was protected by confidentiality. Even if they didn't report it they should have disqualified themselves from the trial.

IT knowledge is as important as Maths, says UK.gov

Re: The problem with "Education" is the system.

"The sad thing is, they were almost always the kids from poorer backgrounds, with parents who thought education was a waste of time."

This is one of the core problems. If parents and their communities in general form an environment where kids aren't encouraged to get on the schools will have an uphill problem. Their first task, more important than teaching literacy, numeracy or anything else must be to teach the kids that this stuff will be within their grasp and worth grasping.

""we need more workers in order to reduce wages"

Nothing much has changed in the 50 years since I graduated.