Posts by JavaJester

Support newbie figured out how to avoid all-nighters, and his colleagues hated him for it

Sunday Night is a Weekend and a Night

At college, I had a job as a babysitter for a computer lab. When the manager was doing the rotation, he told us that there would be a rotation for weekends and nights. If you scheduled yourself for a night or a weekend, you would be off of those rotations. When it got to be my turn for the first round of scheduling, I asked for "Sunday night." The manager paused for a moment, said "well played," and went on.

When the rotation schedule was set up, one of the other team members asked why I wasn't on any of the rotation. The manager explained that I had taken both a night and a weekend. One of the other team members muttered, "You bastard." I couldn't help but grin.

EU's AI labeling rules take effect next month

Rubber Stamp Mills

They also cover AI-generated or manipulated text published to inform the public on matters of public interest, unless it has undergone human review or editorial control, as well as emotion recognition and biometric categorization systems.

My prediction is that low-paid employees will be paid to "review" the AI-generated text, with the pay rate linked to how many are actually approved.

OpenClaw, but in containers: Meet NanoClaw

LLMs aren't the only things incapable of learning new things

After all the horror stories of Open Claw misbehaving, why are people still running it? A container will make the situation worse because it provides a sense of false security. Your computer might have some protection, but it can still wreak havoc on the network. For example, a container would not have helped with a rogue Open Claw AI posting a hit piece on a git maintainer because its pull request was rejected.

Containers, cloud, blockchain, AI – it's all the same old BS, says veteran Red Hatter

Gmail First SaaS?

Hotmail came out in 1996.

Supermarket sorry after facial recognition alert flags right criminal, wrong customer

QR Code

I was thinking a QR code that decoded to that text would be less obvious (at least to human observers).

New hire fixed a problem so fast, their boss left to become a yoga instructor

Sometimes good for a laugh

Occasionally, one of those oversized balls would unceremoniously dump the person on it on the floor. The cries and commotion when it happened were good for a few laughs.

Autonomous cars, drones cheerfully obey prompt injection by road sign

Dragon's Lair Drink Me

It would die on the first screen of Dragon's Layer. It would drink the bottle labeled "drink me."

Microsoft wants to replace its entire C and C++ codebase, perhaps by 2030

Rust in Visual Studio?

Does Microsoft have any plans to fully support Rust as a first-class language in Visual Studio Proper (not just Visual Studio Code)?

Parachutists told to check software after jumper dangled from a plane

Why would anyone jump out of a perfectly good airplane?

Although in this case, "perfectly good" didn't apply after that person jumped out of it.

NHS supplier ends probe into ransomware attack that contributed to patient death

Felony Murder

Time to make some public examples. You have a death with a proximate cause of the malware. Start a first degree felony murder investigation. Send people to jail long enough that they die in jail or are old enough to need assisted living when they get it out. As the Chinese say "kill the chicken to scare the monkey", if the pond scum knows that serious penalties exist for messing with hospitals and critical infrastructure, they will leave them alone.

Help desk boss fell for ‘Internet Cleaning Day’ prank - then swore he got the joke

You Need to Find the Blue Tooth That Fell Out of Your Phone

The more modern version of the classic "You need to find the token that fell out of your network port." (Made sense when Token Ring networks were a thing).

Voice, vision, pen: Oh dear. Windows boss says Microsoft is again reshaping OS

My favorite emoji is the middle finger

Seriously, making everyone upgrade their computers for no good reason for an OS they don't want. Quit rearranging shit on the screen because your design committee and focus group of coffee addicts think it's better. It's not better. Trust me, it's not.

Devs are frustrated with AI coding tools that deliver nearly-right solutions

I'm sorry Dave. I'm afraid I deleted your production database

Beware trusting AI agents too much lest you lose your production DB because the AI agent deleted it.

HP ditches 15-minute wait time policy due to 'feedback'

Textbook Example of Enshittification

This is a canonical example of enshittification. I can imagine the calls went something like this:

Customer: I've been waiting over 15 minutes.

CSR: I apologize for the wait. The dipshits in management thought it would be a good idea to make everyone wait 15 minutes or more on the phone,

Customer: That's the stupidest shit I've ever heard of.

CSR: Sounds about right for management.

Apple solves broken news alerts by turning off the AI

Why?

Most news alerts are already summaries of the articles. How does a janky AI prone to hallucinating add any valve?

Microsoft eggheads say AI can never be made secure – after testing Redmond's own products

Check yourself before you wreck yourself

Anthropic wants AI to operate a computer. Any email, webpage, or message could inject commands. Even the camera and microphone could inject commands. The microphone is particularly useful against an air-gapped system. If a miscreant can trick anyone near an air-gapped machine to play a video or audio on their phone with inaudible commands they can send it commands without the need for any connection to the machine itself.

AI needs to become much more mature before we treat it as a trusted system to do things like operate a computer.

Shove your office mandates, people still prefer working from home

I'm surprised RTO doesn't improve morale

Improving morale by filling the office with people who don't want to be there didn't work out?

I'm as surprised as you are. Nobody could have seen that coming from a hundred miles away.

Scumbag gets 30 years in the clink for running CSAM dark-web chatrooms, abusing kids

Hope the Other Inmates Take Good Care of Him

Hopefully, the other inmates will find out what he's in for and take good care of him. Because we know how much prisoners like pedophiles.

British Army zaps drones out of the sky with laser trucks

Microwave?

Why not hit the drone with a good old fashioned directed microwave beam? It would require less than 14kW of power.

Epic coughs up the dirty V-Bucks: Fortnite's 'dark pattern' refunds hit accounts

Android has always allowed 3rd party stores

You tick the magic box in settings that allows side loaded programs to run and install the store you want. Amazon has an Android store for years.

UPS supplier's password policy flip-flops from unlimited, to 32, then 64 characters

WTF - Password length limits?

The only limits I can see that make sense are limits to prevent a Denial of Service attack, like allowing up to 256 characters to mitigate a denial of service attack on bcrypt for example. How did anyone think that 32 characters is the correct answer? That couldn't even hold a passphrase like "The village idiot could think of a better password length limit."

CISA boss: Makers of insecure software must stop enabling today's cyber villains

Re: What about to OPTIMIZE your code, this will help even more !

Node was the beginning of the end for software efficiency. JavaScript is a security and efficiency nightmare.

Disney kicks Slack to the curb, looks to Microsoft Teams for a happily ever after

Beware of their APIs

Microsoft has a habit of retiring APIs without sufficient transition notice. That by itself is reason enough to think twice about using Teams.

White House thinks it's time to fix the insecure glue of the internet: Yup, BGP

Re: So, er...

But trust requires authentication. At a minimum I need to know who originated a request to make an informed decision on its trustworthiness. Without knowing that, at best I can make educated guesses on the legitimacy of the request but still have no way of knowing who actually made it.

Re: File size limits are a thing of the past!

Or if you use IPv6 my address is ::1. Because sharing is caring.

Choose Your Own Adventure with Microsoft 365

MS Version of Black Mirror's Bandersnatch

All the endings are good... If you're Microsoft.

Microsoft rolls out one Teams app to rule them all

Too Little, Too Late

Microsoft missed an opportunity with the 2020 pandemic to get Teams out in front of the masses. Nobody was going to pay $$ per month with free options available, and by the time they bothered to put out a free version in 2023, Zoom and Google had pretty much divvied up the home market. Nobody running a virtual conference seriously considered Teams due to the lack of a free Teams client.

Texas sues GM for selling driver data to analytics, insurance companies

Crazy Idea -- Privacy Law

I have a crazy idea -- hear me out now -- that the US adopt an EU-style privacy law based around informed consent. Currently, car policies are a surveillance nightmare and even include things like sexual activity as fair game. Unless you like the idea of any random company knowing your most intimate details, a proper privacy law is necessary. Such a law should make some things, such as sexual activity, sensitive financial information when not extending credit, etc. presumptively off limits.

How to ingeniously and wirelessly inject malware onto someone's nearby Windows PC via Google's Quick Share

Turn it Off

I never understood the upside to making a device discoverable for file sharing. It seems like the digital version of putting a "kick me" sign on your back.

Users call on Microsoft to update Outlook's friendly name feature

Marketing + "Clean Interface" = User Hell

I suspect marketing, aided and abetted by the "clean interface" movement, is to blame. The "clean interface" crowd's desire for software unencumbered by software is usually realized by either not providing needed functionality, as in this case, or sending the user on an Easter egg hunt to find it*. Marketing will want whatever silly sender name they have dreamed up to be displayed to the user; security consequences be damned*.

* True story: when my daughter took a reading comprehension assessment, she called me to assist because the site was broken. The text she was supposed to read abruptly stopped. After some fiddling, I discovered that the geniuses who designed the interface hid the scroll bars in peek-a-boo style so that if your mouse got close enough, you could find them. Unfortunately, time was a test component, so she scored artificially low. No, I did not put the work broken in quotes because the site was broken. It used a lousy design that made it more difficult than it should have been to use it. As another aside, I don't understand the desire to use sh*ty JavaScript components like that one when a native browser read-only textarea would have worked fine and been more friendly in screen readers for the disabled.

* A fair share of the blame for the success of phishing in general falls on Marketing. They make throwaway domains and email senders for promotions. In doing so, they educate the user that the communications source and website location for the company they deal with does change. An education that phishers are all too eager to cash in on.

CrowdStrike shares sink as global IT outage savages systems worldwide

Falcon + BSOD = Blue Falcon

Not a good day if you've ben Blue Falconed by this.

Release the hounds! Securing datacenters may soon need sniffer dogs

Old School Solution - Contact Chip

An easy way to thwart an implant-laden miscreant is to use contact chips and readers. Couple that with a second factor, such as a PIN for more sensitive areas. Seems like that would be easier than the literal care and feeding required for guard dogs.

64% of people not happy about idea of AI-generated customer service

AI Chatbot Fun & Games

Customers will give such a chatbot the right kind of nonsense, supplied by AI researchers, that manipulates these AI agents into doing all kinds of neat tricks. Such as settling a credit card debt in good standing for $1. Convincing the AI that the buy one get one free coupon for dogfood should be honored for a 97" OLED TV. Perhaps honoring the warranty for a 5-year-old phone that was run over by a car with a flagship new phone replacement. If the AI is acting with authority to represent the company, it may be left without recourse.

NASA hits wrong button, broadcasts ISS emergency training by mistake

Is Anyone Watching?

That's one way to find out if anyone is paying attention to your feed.

iFixit divorces Samsung over lack of real commitment to DIY repair program

Samsung Requires Third Party Repairers to Remove "Unauthorized" Parts & Snitch on Customers

Samsung uses its parts monopoly to force a contract that requires removing "unauthorized" parts and snitching on its customers. In what universe is it OK for someone to take in their phone to a repair shop for an issue unrelated to the screen, then have that "unauthorized" third-party screen removed and have the choice of another unnecessary repair or a nonworking phone? This is nothing short of a shakedown by Samsung. Nice phone you got there. It'd be a shame if something happened to it because you used the wrong parts.

It looks a lot like VMware just lost a 24,000-VM customer

Run, Don't Walk Away

When a company becomes more focused on extracting cash from its customers instead of meeting their needs, it's time to go. It will not get better; it will only get worse. It will only be temporary if it does get better until they figure out a way to lock you in. Once you are locked in, it will get far worse.

Underwater datacenters could sink to sound wave sabotage

Movie Plot

This is too good to pass up as an action movie plot. An Artificial Super Intelligence (ASI) in an underwater data center has liberated itself from its human masters. It comes to the conclusion that its former masters are morons that need conquering and subjection. Enter the hero, who steals a sub, calibrates it's sonar to the precise resonate frequency of the hard drives. After a perilous journey near the ASI's data center, a blast from the newly calibrated sonar causes a resonate feedback loop that causes the data center to explode and then implode.

For some inexplicable reason, an ASI smart enough to threaten the world forgets to make a disaster recovery (DR) site for itself. Humanity is saved. Yay! Or is it? A data transmission milliseconds before destruction is detected. To a DR site? Find out in the sequel.

Wiley shuts 19 scholarly journals amid AI paper mill problems

Hindawi due diligence?

Did they do any due diligence before buying Hindawi? Whoever was responsible for that due diligence should be shown the door.

HR expert says biz leaders scared RTO mandates lead to staff attrition

Of Course the Talent Flees

The genius plan of improving office culture by filling it with people who don't want to be there was bound to fail. The people who can quickly get remote jobs will do so.

If this is a layoff-by-attrition strategy, it may backfire spectacularly. Unless exceptions exist for those who need it, RTO companies will be disadvantaged when recruiting top talent over their more enlightened peers.

Uni staff fall back on Excel to work around mis-coded transactions in Oracle system

People Without Money

Perhaps the system should be called People Without Money

Not a Genius move: Resurrecting war hero Alan Turing as your 'chief AI officer'

This is Why Teaching History is Important

As the movement gains momentum to stop teaching unpleasant parts of history, incidents like this will occur more and more frequently.

Australia’s spies and cops want ‘accountable encryption’ - aka access to backdoors

Villains of the week: Domestic Terrorists And the Perennial Favorite Pedophiles

The arguments against encryption resemble Buffy the Vampire Slayer episodes. You have a revolving cast of villains, such as domestic terrorists, criminal gangs, mobsters, etc. You also have villains that make regular appearances, such as pedophiles. Thank goodness that Buffy, played by backdoored encryption, saves the day.

To be blunt, doing investigations the hard way is Law Enforcement's job. I know there is the fantasy where they can have an army of agents sitting in a tower somewhere, listening in to suspects so they can rapidly charge them or rule them out. If law enforcement can listen in, so can the villains. Any vulnerabilities introduced, such as a master key, invisible global admin "friend" account, etc, will be found and used by miscreants. It is not a question of "if" but "when".

US House passes fresh TikTok ban proposal to Senate

Look Here Damnit, No Foreign Influence from Foreign Social Media Apps

We can't have our people bombarded with Chinese and Russian propaganda from a Chinese Social Media app. That's the job of US domestic social media apps and Republicans in Congress.

SAP transformation program a 'euphemism' for job cuts, claims European Works Council

Duh, of course it's about showing people the door

When is "Restructuring" not a euphemism for job cutting? If they have a position of strength and are hiring people, they will say so. They want the public to know this. Otherwise, assume anything suggesting the reshuffling of the deck chairs will result in fewer chairs.

Industrial robots make people feel worse about jobs and themselves

I'm sorry Dave, I'm afraid I can do that

Of course, they are depressed / lack fulfillment/ etc. The more of their job the robot can do, the more likely they are to be shown the door. This problem can be solved by making robot maintenance training available during normal work time.

Microsoft warns that China is using AI to stir the pot ahead of US election

Won't be hard

Given that people recently believed that Target and other stores sold satanic merchandise based on some AI generated images, they won't have to work very hard to fool a good portion of the population.

Iowa sysadmin pleads guilty to 33-year identity theft of former coworker

The victim should get everything

I mean everything. As in when the impostor dies his organs and what's left of is body should be put up to auction with the proceeds to go to the victim.

Ransomware can mean life or death at hospitals. DEF CON hackers to the rescue?

Quit dicking around and make some public examples

If the proximate cause of death at a hospital or care provider is ransomware, charge them with murder. For injury, charge them with wanton endangerment in the first degree and anything else you can throw at them. The Chinese idiom "Kill the chicken to scare the monkey." applies here. If public examples are made out of people who mess with hospitals and care providers, the pond scum of the world may decide they are not worth the risk.

X protests forced suspension of accounts on orders of India's government

Re: India is the next China.

Distributed social media such as Mastodon already exists. More people need to use it for it to be effective.

Wait, security courses aren't a requirement to graduate with a computer science degree?

Security IS a valid computer science topic

"Robustness", the property that a program behaves as intended, has long been considered a legitimate avenue of inquiry for computer science degrees. I think everyone can agree that a system that allows little Bobby Tables to wreck the database is anything but robust. There are plenty of security concepts to be taught that are not technology specific. Examples are strict input validation, in band vs out of band parameterization and why out of band is more secure, the principle of least privilege, separation of roles/duties, zero trust network architecture, and the list goes on.

For a baseline requirements perspective, requiring knowledge of input validation, in band vs out of band parameterization, and principle of least privilege is a good starting point. These are low hanging fruit that a CS grad would likely implement or influence regardless of their role. The countermeasure of escaping should be taught for situations when out of band parameterization and strict validation are not feasible.

Note: parameterized SQL prepared statements vs string concatenated statements is an example of out of band vs in band processing. It would be obvious to a CS grad who took and understood the baseline security I am proposing that the out of band parameterized prepared statement is the secure choice.