Posts by Claptrap314

Just because on-prem is cheaper doesn’t make the cloud a money pit

First, never underestimate the impact of u$ using their customers as their QA. If you think "Azure" when you say cloud, then--just don't.

Second, while it is correct that the primary benefits of scale accrue to the providers, if there is any meaningful competition at all, a significant amount of that savings will roll down to the customer. If competition is fierce (and it is not), almost all will.

Third, AWS & GCP are set up to provide something that you simply cannot do on your own until you are nearly a household name--reliability. Even four nines is EXPENSIVE. AWS & GCP can give you all the tools for it in a few minutes.

If you don't mind having your website down all day on Black Friday, then you are likely not to need their services at a much lower scale than if you do.

We're moving off Heroku this year. It's going to be interesting to see just how much it is going to cost us to do all of the things that they are doing for us. My prediction is that our costs are going up. It will be worth it, though, because of the added control. That is, we will have a gain in functionality.

To improve security, consider how the aviation world stopped blaming pilots

Huh?

First, and maybe I've been "lucky", but blameless post-mortems have been the standard everywhere I've been since 2013. In fact, the blame game, as it relates to security failures, hasn't been a thing for much longer than that.

Second, culture has never been ground-up. It flows down. Always has, and it always will.

Third, "culture", at least internal to a company, can never properly address security as it relates to code--at least, not if the company intends to stay solvent, barring heavy regulation. As I continue to stress, the proposition that a given piece of code does what it is supposed to do, and nothing else, is at least equivalent to a master's in mathematics. The cost is more than consumers are willing to bear.

So, yeah, I'm pretty much in agreement with that heavily-downvoted first post--we've been fighting this for decades. Don't assume that you have some sort of genius solution that we're not already working.

Linux kernel logic allowed Spectre attack on 'major cloud provider'

Re: Event Horizon?

Except--not so much. Retpoline, for instance, has pretty much been built into the entire stack. It doesn't matter if your system is entirely in a single security domain or not--you are going to pay the price for these workarounds unless and until you rebuild your entire system without them. (And that is EXACTLY what you do once your operation is big enough.)

There are SOME kernel workarounds that can be turned off with switches. But I would be shocked if this resulted in differently-compiled code being brought in and not just some branches around the more egregious workarounds.

Remember the original recommendation from the Feds? "Turn speculative execution off". That lasted about twelve hours. It's not that they were wrong--that IS the only way to prevent these attacks in that generation of hardware. It's that the cost was too high. Nothing else.

I have not researched this bit, but the thing is that speculative execution in the presence of caches is going to be fiendishly difficult to accomplish without leaks. And by "fiendish", I mean "there may be some analogue of the CAP theorem or the Heisenberg Uncertainty Principal limiting what can be done".

Re: Did any such attack take place? Ever?

First, even after this class of vulnerability was revealed, it was quite difficult to pull off in practice. Then, the mitigations were put in place. While I am very much on record as explaining that this class of vulnerability cannot be mitigated entirely in software, that does not mean that things like retpoline don't make it more difficult to execute.

But you don't wait for an actual exploit to be active in the wild to address it. In particular, if there WERE some massive exploit out there, it would directly affect AWS's bottom line in a big way. So, they care a lot about doing what can be done--BEFORE there is an actual dam break.

Bank rewrote ads for infosec jobs to stop scaring away women

Re: Autistic People too

Yes, I'm autistic. But you know what? EVERY job description I've seen in the last 20+ years (and I've seen way, WAY too many of them) includes "clear communication" as a requirement. Guess what? When I'm looking at your job description, I am screening you. If you say "requires 5 years in X", then either you mean what you say--or you're "clear communication" is a rule for me but not for thee.

Hard pass.

I'm a mathematician. For money, I program computers. If you give me a requirement that x >= 5, that's what goes in the code. If you cannot manage for that? Hard pass.

Google denies Bard trained using OpenAI ChatGPT responses

Re: They're wrong, even if not lying

I recall from a recent article in these pages that "AI" fares much better at detecting GAI content than humans--something about spotting statistical artifact. If true, then your supposition would be deeply challenged.

But I DO agree with the conclusion. The net result is not going to be any sort of improvement when it comes to general usage.

School principal resigns after writing $100,000 check to Elon Musk impersonator

Ever take out a bank loan?

Certainly, in the clear light of day, it's usually easy to spot these ********. But that's the game. They DON'T operate in the light. NO ONE is immune. If you think you are, YOU are the idiot. Pray you don't get targeted.

It's not paranoia--they really are out to get you. And unlike you, they are professionals. Think about that. But try not to think about it too much before bed.

Outage rates fall, but major ones will cost more. Oh and don't bank on SLAs

Sympathy for the Devil

So far as I see, our contracts with these providers have near-zero bite as to SLAs, and this represents a issue.

However, solving it is NOT so easily done. The "shared responsibility model" applies not just to setting up & running an app, but it applies especially to issues of reliability. When I was at Google (2015-6), I'm pretty certain that the uptime of individual datacenters was less than 90%. I would guess it was close to 88%. Over my sixteen months there, we had one customer-visible brownout. It was handled in less than 20 minutes. That's more than 99.97% absolute uptime delivered.

Of course, if you were emergency services and you were hit by those 15-20 minutes, it would have been bad.

The thing is, we were in nine data centers. And there was zero overlap in the scheduled maintenance for these datacenters. So when there was an unplanned maintenance that happened in one at the same time that a planned maintenance happened in another, we had to deal with a week of crazy alarms, but the customer never saw anything.

If your business actually is HA (requires 4+nines) delivered, you are going to have to been in a bunch of datacenters. If your business can afford to staff all that, great. If not, AWS & GCP can give you to tools to achieve HA, BUT you are still going to have to hire a software engineer trained in reliability to actually get there. (More than one, because even 4 nines delivered requires 24x7x365 paging for alerts.)

If AWS has a region go out, and that affects your service's--that's on you. If AWS has two regions go out, and that affects your service--that's on you.

If AWS has three regions go out, and it takes your service down--that should come with real penalties. But tell me--when is the last time AWS had three regions go down?

Publishers land killer punch on Internet Archive in book copyright court battle

Didn't/doesn't Google do a LOT more than IA?

And back when they were trumpeting "don't be evil"?

There should have been ample precedent here, one way or the other, but none is mentioned. Something's rotten in Denmark, and it ain't the fish.

Student satellite demonstrates drag sail to de-orbit old hardware

Re: This should be mandatory

If you have a battery reserved with the power for the operation powering a circuit with a MOSFET where the control voltage is your sensor, I don't see this being very power intensive.

You don't power against the springs.

Winnie the Pooh slasher flick mysteriously cancelled in Hong Kong

Re: Wierd

Nah, this is just commentary on/mockery of Xi. Don't read too much into it.

Re: Wierd

Now THIS is the way that a PLA sock puppet should operate. They more ham-handed stuff gets laughed off too easily.

Okay--you "ask", I'll answer: To increase Xi ridicule. I honestly had no idea why someone would make a Pooh slasher flick until I saw that it was banned in China. Of course.

And if they pull in a few million for doing so? So much the better.

Unknown actors deploy malware to steal data in occupied regions of Ukraine

Re: Powershell ?

Well, don't you remember--Windows 95 got rated, I think, for Orange level, "As long as it is not connected to another computer".

A few years ago, there was an article in these pages about an update to the Geneva Conventions such that hacking a SCADA to effect infrastructure damage is the same as planting charges.

And, so far as I can tell, Ukrainian civilians aren't being afforded any rights in the first place, so there's not much worry about being an unlawful combatant, sadly.

But it will be interesting to see how comprehensive the peace treaty will be.

After 9/11, there were a number of American hackers that took down various Al Queda websites--including ones that the CIA had been using to track activity.

So no, you really cannot make that assumption based on relevant history.

One of the many, many differences between the physical and electronic worlds...

SpaceX tries to de-orbit Amazon's request for a satellite broadband shortcut

About time!

See, THIS is what I come here for--there's drama on the screen, and El' Reg is here with the popcorn (deets) and salt(y commentary). Okay, so it's not strictly IT, but.... BITE THAT HAND!! BITE THAT HAND!!

Russian developers blocked from contributing to FOSS tools

It's not "a bit" like sanctioning sports teams, it's quit a bit like it.

Governments, even totalitarian ones, only continue to exist through the acquiescence of their population. While we generally try to aim sanctions directly at the power centers of the offending government, we also look to ways to sour the broader body public on their policies.

In this case, we have a company specifically sanctioned, presumably because we believe that it is in some way important to the offending government, and an employee of that company is whining about it, dragging out some of the exact same arguments being used by said government.

Moreover, he can do the same thing that outed Holly communists did when faced with boycotts--change his working name and carry on like nothing happened. Sure, it's a pain, but no, he's attacking the sanctions regime instead. If anything, his arguments demonstrate that the sanctions are not baseless.

Don't Be Evil, a gaggle of Googlers tell CEO Pichai amid mega layoffs

Re: some shareholders are agitating for change, and want Alphabet to go even further

I was at IBM 20 years ago. If you think that "sack the workers to boost the share price" was what has caused their downfall, you have no idea just how toxic the situation there was for many of us.

The place was a hot mess of hot messes.

Eufy security cams 'ignore cloud opt-out, store unique IDs' of anyone who walks by

Re: The Rogue Programmer

Among his many valued traits are....

Hong Kong's state-sponsored SEO on national anthem strikes the right note

I've got a better one...

https://www.youtube.com/watch?v=YdXQJS3Yv0Y

Google Cloud's US-East load balancers are lousy with latency

Re: make a hasty move to another region

I learned SRE at G in 2015-6 supporting (primarily) hangouts. This overlapped the rollout of GCP, I was not involved with that effort at all.

We had a number of rules that were involatile. Rule #1 on that list: the minimum number is three. Three DCs (with non-overlapping maintenance schedules), and on at least three servers in each, we would not talk to you (you being an internal G team).

If you want resilience, you MUST be able to handle simultaneous scheduled & unscheduled outages, both at the DC level & at the level of the individual servers.

This is NOT cheap. SRE can tell you how to do it without exploding your cost, however.

Set up this way, and you can simulate scenarios like this one as training. (We preferred Tuesdays.)

Vessels claiming to be Chinese warships are messing with passenger planes

Re: God forbid, if something happens then the world will take notice.

You mean that Iranian plane that was broadcasting on military frequencies, descending towards a US ship and refusing to respond to hails?

I would shoot that down without hesitation. The duty of the commander is to the lives on board his ship, not to the dead bodies put on a plane so they would make for good TV.

The npm registry's safe word is Socket

"When I use, I dunno, a typical .NET library, usually if something goes wrong I can point the finger at the library vendor, or at Microsoft, and that's it."--yeah, and that's the problem. You can point your finger, and that's it. Nothing more happens.

NPM is a steaming pile. Everyone can see that. m$ stuff is a bigger steaming pile, but they don't let you see the details.

Microsoft's Copilot AI to pervade the whole 365 suite

Re: Welcome, new overlord

I upvoted you, but you've mangled the dialogue. It's only been a couple of years since I last played...

As chip sales slump, inflation makes the price of Samsung's Texas fab blow out

Huh...

So maybe inflation is just a teensy bit more than 7%, then...

Cosmic rays more likely to glitch out water-cooled computers

Comic rays? What's next? The Earth's magnetic field? Sunspots?

Re: Gate size

Yes--and we knew about this in the '90s when I was at AMD.

We read OpenAI's risk study. GPT-4 is not toxic ... if you add enough bleach

Re: Complex problem

Quis custodiet ipsos custodes?

We see this constantly: decent, honorable, well-intending human beings get into a position where they have power and an incentive to abuse it, they will do so.

Opening up the model will empower a lot of people to do bad things, true, to some degree. But it will also strongly disempower a much smaller set of people who otherwise are going to wield a lot more power than others.

It's the democratic solution--terrible, just better than all of the others.

Techie fired for inventing an acronym – and accidentally applying it to the boss

Re: Well that was unfortunate.

Most states are "at will"--no cause needed.

Cancer patient sues hospital after ransomware gang leaks her nude medical photos

When the insurance companies failed

our last hope became the plaintiff's attorneys?

"Save us, ambulance chaser, you're our only hope!"

Hands up who DIDN'T exploit this years-old flaw to ransack a US govt web server...

Re: And just when I thought replacing all my Adobe Flash controls with Telerik

I'm assuming op missed the troll icon...

Google taps Fastly to make cookie-free adtech FLEDGE fly

Re: Am I reading this right?

And this is why, as a Google employee (in 2014), I had quit using Chrome in order to do my job.

I have no doubt all of these network traversals & all this processing is directly impacting those using Chrome (or its derivatives).

Anyone want an International Space Station? Slightly used

A modest proposal

I read what NASA says about boosting, and I'm not buying it. We don't have to solve this problem, completely, today.

I am quite surprised at the claim that today, with the "no more missions" option, that the ISS will deorbit itself as soon as 1 year from now. If we change that to 100 years, then we can allow technology to advance, and we can solve the problem much more cheaply then. Throw in compound interest of 2% (for 90 years), and we're looking at a 6x cost savings even without technology advancing.

Start by separating anything small enough to come down by itself safely. Converting those solar panels into orbit-boosting sails. This might require an attitude adjustment & the creation & installation of new engines. Then, send up boost missions to get it high enough that by tacking the solar wind, we get to a 100+ year-safe orbit. Profit.

(I am NOT suggesting that we operate the solar panels as solar sails for a century, just get to a century-safe orbit. Then roll them up.)

Pentagon whistleblower Ellsberg given months to live

Re: The Pentagon has the capability of deploying pancreatic cancer?

"Could deploy"--as in "have stockpiles of deliverables, ready-to-position delivery systems, and trained personnel"? Pull the other one. "Have the technical know-how?" Certainly. But for the reason that appears to have missed you--defensive research. We KNOW these weapons are being used out there. It would be completely irresponsible not to develop defensive measures.

Re: The Pentagon has the capability of deploying pancreatic cancer?

Remember--on the Internet, the troll icon is NOT optional...

Silicon Valley Bank's UK arm bought by HSBC for 1 British pound in rescue deal

I'm pretty sure they learned they could get by with it...

South Korea moves to resolve WWII dispute with Japan that troubles tech supply chains

Re: How far back do we go?

Do you condemn gorillas for killing the offspring of the prior alpha? No? Okay. We, start by judging people by the ethics of the day.

Historically, the behavior during war was generally unconstrained (outside of Jewish Law) prior to the Catholic invention of Just War theory.

Generally, the treatment by Europeans of the various populations that they subjugated during the Age of Colonization was slightly better than the historic norm. Generally. The policy of the US government wrt the Indians was quite a bit better. And yes, I'm counting what was done to my great-grandmother & her family in that.

Likewise, slavery was practiced universally until the modern age.

But let's talk about WWII (the issue at hand is NOT about WWI). Japan was party to the Geneva conventions. They had agreed to conduct themselves in war according to a set of rules, and they systematically violated those rules as a matter of official government policy throughout the war. (I give them a pass on the one hour notice before commencing of hostilities, barely, because they did make a good faith effort to inform us.) After the war, we hung a few top officials, but we needed Japan's and Germany's help against the Soviets. So, instead of aggressively investigating, prosecuting, and punishing war crimes, we made a big show of dealing with a handful of top officials, and moved on. The rights of justice for the hundreds of thousands of violated civilians (and P.O.W.s) be ******.

Ignoring justice (which we humans are so good at), what has happened since has been pure politics. For domestic political reasons, the successive SK & JP governments have done what they have. For grand strategic reasons, the US government has steadfastly stayed out. Now, foreign policy issues are forcing the SK & JP governments to figure something out. Don't expect even the appearance of justice to be a major factor--they just need to appease enough of the SK voters without angering too many of the JP voters.

I'm very certain that this is what is driving this. Realpolitck is a *****.

The Japanese government has had (and to a certain extent, still has) extremely practical reasons to deny, deny, deny.

Likewise, the SK government to press, press, press.

But the Rise of Pooh means that both governments are faces with extremely practical reasons to get along. So...they are figuring out something.

I'm glad it's happening, but this is a strong case of justice delayed.

Nvidia in blast radius as Uncle Sam looks to cut off China's Huawei for good

That's okay. Mendicants remain mendicants because they don't understand statescraft.

Tell Pooh

I said "Hi"!

EPA orders US states to check cyber security of public water supplies

This is step #0. If this is not the first item on the checklist, then I really don't care what you have to say. These facilities cost billions to build. The costs of disconnecting? Employee's whining about not being able to get on TikTok.

US lobbyists commission report dismissing proposed EU cloud regulations

Let's see how many downvotes I get this time

I've been urging the EU to take this sort of step for at least five years--this is the main way I can see to trim the power of these multinationals.

But the basic rule of law applies: do business in my country, abide by my laws. By "do business in my country", I mean ANY of the following: interact with one my citizens; interact with a company domiciled in my territory; transport anything into, through, or out of my country. If you cannot comply with the laws of my country and your own, that is NOT my problem. That's a business decision for you to make.

So if a US entity wants to do business in Europe, or India, or China, or Russia, or Mozambique, the local authority is going to insist that they obey the laws of that country. No ifs, ands, or buts. (Subject to sufficient local currency entering the appropriate accounts, of course, just like at home). So while Google was able to beat Spain, they are going to find it much more difficult to sweat out the EU. Good.

Salesforce promises to follow the Oracle playbook

Bye, bye Heroku!

Good thing we were already on our way out the door--I'll be certain to accelerate things as much as I can.

Snap CISO: I rate software supply chain risk 9.9 out of 10

He would say that

wouldn't he?

Yes, this is a much bigger issue than anyone in management wants to admit (unless they are selling "solutions" like this guy). But 9.9/10? That /10 is intended to invoke the CVE scale, and vuln libraries very, very rarely hit that level.

In practice, we've got more problems with unsecured endpoints & exposed credentials. It's all a matter of anti-bang for the buck.

Yes, more attention needs to be paid to this issue. But much, much more attention needs to be paid to security generally, and this is NOT the first or second issue for almost all organizations.

Tesla hits the brakes on rollout of Full Self-Driving code to new users

Excuse me?

When and where did I sign up to be part of this "beta test"?

These vehicles are interacting with EVERYTHING near them.

Re: What could possibly go wrong?

And anyone stupid enough to be on the road with them at the time.

ChatGPT, write a report about database glitches that crashed you today

Although, in this case, it is best to skip that second part. Please.

SBOM is a 'massive galaxy of mess' for supply chain security

I'm not so sure...

1) While it surely took months to set up Solar Winds, not every attack of this sort is going to be this deep.

2) Not every attack is going to hang out for years until it is discovered.

But yeah, if you think that an sBOM is going to do you any good, never look at your node dependencies.

So I agree that these threats are better viewed from the standpoint of defending against sophisticated actors, I'm just not as smiley about our ability to actually do so.

I do wish they had talked about running your own semi-mirrors. Just because rubygems.org goes down doesn't mean you have to. Just because someone pulls their code in a snit doesn't mean you have to manage some kind of workaround. Just because someone screws up a version indicator doesn't mean you have to wait for half of the community to produce a fix. And should a library actually be compromised on the main server, it's simple to blackhole it on your own server & be done.

Yes, there is a significant cost involved. Security is not cheap.

But again, sBOMs seem to poorly address issues that should be handled at a slightly higher level.

To the Moon? Emojis can be financial advice, says judge

Say what?

"with the expectation of profit 'from the essential entrepreneurial or managerial efforts of others.' "

What exactly was Dapper Labs supposed to be do to generate profit for the NFTs? I'm not going to dig into the case, but this strikes me as...weird. The value of a collectible is what people are willing to pay for it. The main difference (JUST in this context) between an NFT & the Mona Lisa is the nature of the fire that can destroy them.

BTW, this is why baseball cards are not at issue--there is no one driving their value except the market.

Small correction needed in article

"while one investorgambler had reportedly purchased"