Posts by Doctor Syntax

MI5 boss: We NEED to break securo-tech, get 'assistance' from data-slurp firms

"I’ve said before and I’ll say again MI5 does not browse through the private lives of the population at large."

Just those using Yahoo visual chat. Or maybe that was GCHQ, not 5?

"You should not imagine that MI5 is always arguing for new powers or more tools"

No imagination required. We keep seeing them do just that.

I'd like to see him start again and specifically address:

Due process. Maybe he could find a date to tackle this one in June when we'll be celebrating the 800th anniversary of Magna Carta which brought this into English law. Restoring it would be a good contribution to those celebrations.

Presumption of innocence. If the population at large are to be presumed innocent than he doesn't need blanket powers. If he doesn't presume the population at large to be innocent then he should come clean and admit he rejects one of the basic precepts of British law.

Reasonable expectations of personal and commercial privacy. If organisations we use in the course of regular - innocent - communication are to slurp data how does he propose to prevent this being (a) sold for corporate profit by those organisations, (b) sold for personal profit by individuals working in those organisations, (c) passed, for profit or otherwise, by his organisation and his confrères as industrial espionage and (d) secured against intruders who might grab the data to be sold for profit.

US kills EU watchdog's probe into EU cops sharing EU citizens' data

Re: No point in kicking a dead dog.

"If you've been under a rock, the latest incident in France will allow the spook agencies to continue to mine private data and share it with the other international agencies."

Irrelevant. The IRA managed to plan and carry out such atrocities and worse for years without the use of the net or mobiles. And not much assistance was given by the US governments it looking at the financial support given by Irish Americans. The US needs to stop being all take and no give.

"And considering the alternatives... its not a bad thing unless you're a terrorist."

If we're to occupy the high moral ground in relation to terrorism we've first of all got to get there.

It seems an odd way to end the investigation. The Ombudsman has been unable to perform its statutory duty therefore the agreement is failing to meet its statutory obligations and should, therefore, be considered illegal and either closed down forthwith or suspended until the Ombudsman is able to give it a clean bill of health.

The EU needs to play hard-ball on these matters. All these arrangements, including Safe Harbour, should be ended until such time as the US is prepared to prove its bona fides.

Cryptowall's ransomware's tough layers peeled

"I'd like to see more information about how it's anti-VM features are supposed to work."

From the linked article: http://blogs.cisco.com/wp-content/uploads/cryptowall-2.jpg

Yup, that's code in a Jpeg.

Erik Meijer: AGILE must be destroyed, once and for all

Re: Blaming the tools...

"We have a daily standup"

I take it you've never suffered from back trouble?

FBI boss: Sony hack was DEFINITELY North Korea, haters gonna hate

Re: What difference does it make

Actually they are - or should be - talking to other countries as well. Every time the US takes umbrage at another country they go looking for allies to "stand shoulder to shoulder" with them. With the nuppit Blair they succeeded. Post dodgy dossier, however, they've been finding it more and more difficult. They need to start building credibility much wider than Soccer-Moms and Red-necks.

@ AC

"For those naive enough to think that the fact they haven't shared all of the evidence means it doesn't exist, well there's little hope for you getting far in life without your tin hat anyway."

You need to realise that they haven't shared any evidence. None. All they've done is make allegations and expect the public to believe them. In any forensic context the purpose of evidence is to convince the public or at least the public's proxies, jurors, of allegations (or denials in the case of the defence). In such a context evidence is what's presented and tested in court. If it hasn't been so presented it's not evidence, it's just allegations.

The question of whether to withhold intelligence material or present it as evidence isn't new. At some point, if you believe in the rule of law you either have to present that material as evidence and have it tested or shut up; just saying you have it doesn't cut the mustard. Having had a lot of your methods outed should make a decision in favour of disclosure easier - if you've got nothing left to hide... Another major factor here is that the US has taken retaliatory action. Even though it has done this without due process it might be wise to present the evidence that would have been produced had due process been followed.

For instance in this case it's being claimed that some messages were sent from addresses "used" by NK. In what way were they used? In their allocation block? In servers outside NK but used to host some service for them? If the latter, what sort of service? The Little Leader's Hotmail A/C?

We are seriously being asked to believe that someone who is capable of a break-in of this magnitude is incapable of covering their tracks in sending messages; is that so or is it more credible that someone who achieved the break-in is also capable of routing their messages to mislead? Sceptics have pointed out that the claims on behalf of NK didn't start until the media had made the link to the film; what's the timing of these messages from alleged NK servers in relation to that link being made.

FYI, although there were circumstances when a tin hat and maybe a Kevlar jacket would have been useful, I've got quite far in life. Part of that has involved looking quite critically at what information alleged evidence actually provided.

Evidence

Where I come from - which is the best part of half a working lifetime in forensic investigation - if you think you have evidence you'll present it in public in a forum in which it can be challenged. If you don't do that you don't have evidence. If it fails the challenge you don't have evidence. If it passes the challenge you've finally got evidence.

On that test Comey doesn't have evidence.

It's really hard to imagine anything which would create sympathy for the N Korean regime. Washington needs to step back, take a long look at what it's doing and realise that it seems to be making serious efforts to create such sympathy.

BAN email footers – they WASTE my INK, wails Ctrl+P MP

Re: Obligations

"What a lot of people don't realise is that under the Companies Act 2006 Private Limited, Public Limited or Limited Liability companies (so most companies in effect), email correspondence to people outside your organisation must include your company name, registration number, place of registration and registered office address. This is the same as the requirements for hard copy letterheads and order forms in the Companies Act 1985."

Thanks for this reminder. Now who is responsible for enforcing this?

What I have in mind is all the companies, especially financial, who follow up any contact with marketing spam, usually send as from themselves but by a marketing company. And often with no other mention of their own domain other than [e-mail] as the From: address. Whose company info should be on such a missive? The bank's? The marketing spammer's? If the marketing spammer puts the bank's info on something they send is this an offence all of its own?

The FCA, bless their toothless grimaces, are likely to take no interest in banks training their customers to respond to phishing. But an offence under the Companies Act might get some action.

Re: HEAR HEAR!!!

"If you send the message directly to the public MX, you have the same expectation of confidentiality as if you sent it first class to their mailroom. If you encrypt the connection using SMTP/TLS you have the same expectation of confidentiality as if you sent it to their mailroom in a locked container."

No. If you send it without encryption you have the same expectation of confidentiality as if you sent it on a postcard.

This is an expectation which we need to improve on with a new generation of email protocol.

It's 2015 and ATMs don't know when a daughterboard is breaking them

Re: Free-standing ATM

"well they have tracking devices in them now."

Good idea! It makes it easier to recover them so they can be refilled.

Yes, we need two million licences - DEFRA

Re: Weasle Wording?

"Glad I'm not the only one to have noticed that."

But did you notice the miss-spelling of weasel?

If Europe is against US's Irish email grab, it must pipe up now

Re: Sloppy corporate structure. Sloppy security. Sloppy access rights

"It does seem weird to me that a district judge is abrogating treaties, I did not think that this was in their remit."

I seem to remember reading somewhere that there is something very odd about the way the US handles treaties. Something along the lines that individual states aren't bound by the treaties the Federal Gov't makes.

Re: Sloppy corporate structure. Sloppy security. Sloppy access rights

"I'm pretty sure no-one in the US has access. But, as the district judge has realised, they can give orders to the people that do, even if they are under European data protection laws"

If nobody in the US had access I don't think there'd be a problem: Judge orders MS/US to pass on the orders. MS/US passes on the orders. MS/IE says "Got the orders. Sorry, can't follow them, local legislation forbids.". MS/US tells judge they passed on the orders but they were countermanded outside their (MS/US's) remit.

Re: Sloppy corporate structure. Sloppy security. Sloppy access rights

"Presumably Microsoft et al would have to come up with some kind of technical rather than managerial scheme"

As I've suggested before, a franchise scheme should work. An Irish owned and staffed company would have the franchise to run MS-branded email services for European subscribers with all servers located in European countries under European legislation licensing the IP from MS. I doubt that setting that up would be beyond the abilities of MS lawyers and if necessary I'm sure they could take a little advice from their opposite numbers at Starbucks.

No wind-up: Second New Year's honour for Baylis music box

Editorial standards slipping

"Department for Culture, Media and Sport."

Should be Ministry of Fun.

Metrics house hails Apple DOMINANCE of X-Mas phone 'n' slab sales

Re: Short memories

"You laugh, but revolution it was nevertheless."

Maybe you didn't notice but the author credited Apple with the mobile revolution, not the smartphone revolution. As if nobody had a mobile that wasn't a smartphone.

Short memories

"Apple, the company that started the mobile revolution with the introduction of the first iPhone in 2007"

Ah yes, I remember the tin cans & string we used for 20 years or more before that.

Survey: Tech has FREED modern workers – to work longer hours

Re: Internet is a necessity

"The rest of us have 2 choices, either work all the hours the boss says to work, or like me, only work the hours the boss pays you to work."

The third option is freelance. All the hours worked are billed.

Re: No Surprise

Translation:

Internet = web

Email = Email

NORKS? Pffft. Infosec bods BLAME disgruntled insiders for savage Sony hack

Re: to massacre the language!

Modern grammarians say that there's no reason to object to a split infinitive. But I still think it's an inelegant construct.

Re: No shit, Sherlock.

"(1) the Admin or other privileged operator who screws up accidentally; ...Recent troubles with POS terminals"

Given that at least some POS hacks have been achieved via subcontractors given access to an unsegmented LAN perhaps these should be attributed to screw-ups.

UK retailers in TABLET PRICE SLASH BONANZA

Morgan

The Galaxy & Playbook are refurbs.

DON'T PANIC! Latest Anonymous data dump looks old hat

On the day after Christmas

Maybe we could have a new carol

On the first day of Christmas my true love sent to me

A DDoS attack

etc.

Buses? PAH. Begone with your filthy peasant-wagons

Re: toll lanes

"This is only half true." etc

Interesting - a couple of downvotes.

Over the years, from school, through university to work I've used a wide range of ways to travel - on foot, cycle, motorcycle (does a BSA Bantam count?) car, bus, train and tube, individually or in combination. I've managed to miss out horse riding, ferries & flight but I think it was a fair sample.

The single worst commute was by train and tube from High Wycombe to central London in pre-privatisation days. No matter whether it was walk or drive to the station, train to Marylebone or Paddington, one tube or two all the rides, walks and waits for trains and tubes added up. At best they added up to at least an hour and a half each way or, as I regarded it, the equivalent of two extra full-days work a week, unpaid and unproductive. The Paddington route ran alongside the traffic jam that was the A40 and was clearly a better solution than that, but efficient? No.

I'm aware that for many an hour and a half each way would be less than many experience. But it's not what ought to be an acceptable way to expect people to live in what's supposed to be an advanced society.

But, my downvoters, don't you realise that your presumably preferred trains, electric cars or whatever aren't the solution? They're part of the cause of the problem. Every advance in transport since the invention of the horse-drawn omnibus has facilitated the clustering of workplaces into ever larger lumps, ever increasingly separated from where people live. It's an unsustainable mess. We ought to be looking at how to fix it, not doing more and more of the same.

Bus lanes

"Indeed the only thing I’d have reservations on allowing in bus lanes would be buses."

The stop-start pattern of buses is so different from that which other road users are trying to achieve that it makes sense to segregate them in their own lanes. If only the damned things would stay in them!

Re: There is no "best" form of transport

"But parking is seen as encouraging cars, and cars are bad."

Seen by whom? By the self-same planners who've spent the last 60+ years carefully constructing this mess!

Re: Some points

"I'm a single guy living on the outskirts of a major city, so YMMV."

And I'd guess you have a direct bus route reasonably convenient to work from home.

At my last gig I had a car commute of about 40-45 minutes all being well. Once I tried to work out if I could do the trip easily by public transport. The best I could come up with was a three leg journey by bus. It was, of course, much less direct than my car journey. Between the first two legs there was a 20 minute wait. Between the last two there was a 4 minute gap which could have been tricky as the intermediate leg included the transpennine section of the M62 which couldn't be relied on for such critical timing. It worked out that I'd have had to leave home at about 6.25 to get to the client site at just after 9.00 if everything went well. I didn't bother working out the return journey.

Re: Buses are like HS2

"HS2 does not solve transport problems and is a centrally planned solution to a non existent problem."

AIUI the journey time is one of the problems its supposed to solve, the other is the lack of capacity. Unfortunately the latter is a current problem to be solved by HS2 in n years' time.

Re: toll lanes

"Trains and tubes run on a managed, dedicated route, so are more efficient if you have a station nearby."

This is only half true.

They're only more efficient if you have a station nearby at both ends of the journey and if they're directly connected by a single route. I always assume that those who laud public transport are those for whom that is the case.

Re: Driverless. It's the future don't you know.

"an electric model with the most pathetic of batteries could do whatever it can manage before heading off to recharge"

Probably right in the middle of someone's journey.

Re: The best urban transport

"Cycle lane put in road that is barely wide enough for car..."

One local stretch of road which has had a cycle lane for years is wide enough. Today, however, was only the second time I've seen a cyclist riding along there. He was on the footpath. The other, some years ago, was riding at night in the middle of the car lane.

Re: Use Broadband, not the bus !

Actually the "prehistoric need for a daily physical commute" isn't that prehistoric. It's very largely the product of post-war town (don't laugh) planning.

I grew up in one of the Pennine textile-producing valleys. In the '50s there were about 4 buses an hour doubled up in rush hours. That worked out very well. Most people worked in mills and had a potential work-place a short distance from home; in some cases their nearest mill would be closer than their nearest bus-stop. Typically a bus-seat would be occupied by several different passengers in the course of a journey as most passengers' journeys were small part of the route. And because some people who commuted travelled up the valley and some down the buses didn't need to make empty outbound trips.

Almost all the mills have now closed. But they haven't been replaced by other workplaces. The predominant theory of town planning seems to have been to separate workplaces and residential areas into separate zones. The workplaces have been concentrated in cities employing so many people that they need residential catchments of over a thousand square miles plus clusters of trading estates largely adjacent to motorway junctions. So the local mills have been replaced by housing (brownfield sites!) mostly inhabited by people commuting to the various cities 20-30 miles away.

The combination of rising population due to the extra housing, a greater proportion of the population being out of walking distance to their employment and the length of the commutes ensures that the old bus service couldn't cope so the car has to take over. But the current roads are simply the roads that were there all along and aren't really able to cope.

It isn't sustainable. And yet it's what 60+ years of town and country planning has worked towards. Adequate public transport is a joke; only a limited proportion of commutes fit neatly onto public transport routes.

Frankly I don't see how it can be fixed. Ideally the answer would be to convert some of the city centre workplaces into residential for those prepared to live and work there and replace them with a combination of home-working and workplaces out in what are currently the commuter belts to restore the balance. But the redevelopment of the old mill-sites into housing isn't easily reversible. As redundant mills the sites had a single owner wanting to sell. Now they have many owners of whom only a few at any one time wish to sell. Short of compulsory purchase it wouldn't be possible to reassemble a plot large enough to build a workplace and the whole notion of developing brownfield sites was to avoid using up more greenfield land.

Re: Use Broadband, not the bus !

"And in London there will be a big poster on the site saying 'Mayor of London' as if the Holy Floppy-Haired Twat even knows about the place."

Probably his newt-bothering twat predecessor wouldn't have known it any better.

Online armour: Duncan Campbell's tech chief on anonymity 101

Is TOR still secure?

With reports of nodes being taken over is it possible that entry nodes as well as exit nodes could be suspect? If an attacker has control of entry and exit nodes it would be possible to correlate the traffic between the two and work out who's talking to who.

Split could force NetMundial Initiative back to the drawing board

"very constructive, frank, and candid discussion"

That's one where they send in the cleaners to get the blood off the carpet.

Hackers pop German steel mill, wreck furnace

Separate LANs

At my last gig (several years ago, given that I'm retired) there were several separate LANs. The nature of the business was secure processing of personal data on behalf of clients. LANs for production systems were kept separate from the office and development systems. If we needed to inspect live data for any reason (to find out how the clients had failed to pass well-formed XML this time) we had to use a specific PC in a secure area under supervision.

It's what was needed to be done there and it's what needs to be done more generally. If data has to be passed across networks then implement some secure bridge that only passes carefully sanitised data, e.g. CSV rather than spreadsheets, checked against attempted buffer overruns etc.

It may seem inconvenient to have air gaps. However having a furnace full of solid steel, yoru customers' credit card details stolen or all your servers' contents dumped online brings home the true meaning of inconvenience.

Bring back big gov, right? If only the economics, STUPID, could tell us more

Re: old ways of doing things

"One of the biggest factors missed out in the report is that nowadays the UK is a player in a world market."

The UK has been a player in a world market for a very long time. The difference between then & now is that we used to run that market.

One thing that mucks up your comparison a bit is that politically 45-73, at least in the UK, covers both Labour & Conservative governments. And Big Unions didn't really become powerful until Wilson's time.

Another factor is that any change in policy is going to have a lag before it becomes effective. How long is that? Does it vary from one change to another? And does it vary between different parts of the economy?

FURY erupts on streets of Brussels over greedy USA's data-slurping appetite

Re: Digital consulates

That's known as safe harbour. It only works if the host country respects the inviolability. It's not working.

I think the committee of MEPs who looked at this post-Snowden bottled out. Instead of issuing vague threats about looking at it again they should have said safe harbour is cancelled, no new arrangements allowed, a short period allowed to repatriate data from existing arrangements, all data subjects with data currently in safe harbour to be warned and safe harbour status only to be restored if & when the US show that they deserve it.

The Shock of the New: The Register redesign update 4

Still not there.

"Top Art in stories - now editorially selectable"

Clear the message hasn't got through to enough editors. I tried removing the block on images from regmedia but quickly reimposed it; overall the site's better without any images than it is with these almost entirely irrelevant clonkers hiding the top of the stories.

Movie industry's evil plan to destroy the internet is going precisely nowhere

Re: Alternative solution

"Why don't we just change all the DNS entries for Sony. If they can't be found, then a lot of people would be extremely happy."

If they couldn't have been found Sony would have been extremely happy now. Or at least less unhappy than they now are.

Judge spanks SCO in ancient ownership of Unix lawsuit

Any of the BSD's, I prefer FreeBSD

Yes, as time allows I'm looking at it. I think that's where I'll be going.

I'm not sure that SCO fell on hard times because of competition with Linux. Back in the day it was a well regarded Unix system but expensive. Had they dropped the price a little & maybe offered a freebie (as in beer) 1 to 2 user system I'm not sure Linux would even have got off the ground and they would certainly have kept a healthy slice of the server market by not playing fast and loose with backwards compatibility. With Caldera they could also have had the chance of being a major Linux player as well. AFAICR it was the new management who decided that litigation might be more profitable that caused the problems.

As I had a few clients using SCO & find its eventual fate disappointing. Not to mention that, with systemd & friends turning Linux into a non-Unix-alike system, a healthy SCO would be just what a good many sysadmins need right now.

Hackney council leaked thousands of locals' data in FoI blunder

"Hackney Homes and the Council takes data protection very seriously"

This must be a meaning of take seriously of which I was previously unaware.

Do these muppets really think that simply saying they take it seriously actually mitigates the offence in some way? And do they really think we believe them?

If, instead of the usual knee-jerk phraseology they actually admitted that they hadn't taken it seriously enough they'd actually get a little respect for their honesty.

Microsoft fires legal salvo at phone 'tech support' scammers

It's a start

When are they going to have a go at the "confirm your login on Hotmail/Live/Outlook" spammers?

EU VAT law could kill thousands of online businesses

Re: Amazon is a seller of physical goods...

"Freelancers and independent artists don't usually have trade orgs"

Maybe not independent artists but for freelancers there's the PCG. Being retired I'm no longer a member but I wonder what their take is on this.

Sony hackers dump more hunks of stolen data, promise another 'Christmas gift'

Re: Wow. Just wow.

"I'll bet long odds that the few folks that pointed out that this leak was happening were the first ones out the damned door. Too much risk leaving them around."

Logically this would be a bad idea. Now the law suits have started they'd be star witnesses. OTOH logic & big media?

Ofcom mulls selling UK govt's IPv4 cache amid IPv6 rollout flak

Re: IPv6

"Out here in the sticks I'd be lucky to get one pigeon a day, and I have to share that with my neighbour"

Maybe collared doves would be OK.

Or pheasants? Don't just shoot the messenger, shoot it and eat it.

Banks, UK.gov must work together to beat cyber-nasties

'Banks currently view cyber attacks as a "technical" problem, rather than an issue which merits "board-level attention,"'

Post-Sony maybe this view will be a bit easier to change.