Posts by el-keef

Trello! It is me... you locked the door? User warns of single sign-on risk after barring self from own account

Atlassian make it hard to avoid this

Atlassian have a history of merging accounts between personal and work - it's not that easy to avoid. I nearly lost all my personal Bitbucket content when leaving an employer because Atlassian had managed to combine my personal account with my work account despite me trying to keep them separate. I think it happened when they converted standalone Bitbucket accounts into Atlassian accounts, just as they're currently doing with Trello. Luckily I had a good relationship with the account manager at that company and managed to get it sorted out, but it took a while between us to figure out what we had to do.

All the people saying "don't mix work and personal" - it really isn't that straightforward to avoid with Atlassian, they link stuff up behind the scenes without being explicit about it.

Oracle makes some certifications and cloudy content free, in case you have time on your hands

How to access?

Anyone know how to get access to these? I can't find any mention of free stuff on their website, still charging lots of dosh..

Expired cert... Really? #O2down meltdown shows we should fear bungles and bugs more than hackers

Re: Maybe the network needs a friend

The article explains why this is a bad idea - sudden influx of customers onto another network might bring that network down too, causing a cascade effect.

'World's favorite airline' favorite among hackers: British Airways site, app hacked for two weeks

Re: We take the protection of our customers’ data very seriously.

"Without an incentive to actually get off their ass, nothing will happen. Since larger and larger carrots don't seem to work, maybe it's time to apply the stick."

I agree with this statement, I just disagree that a stick which involves CTOs going to jail will be effective.

I actually think the GDPR, if it's actually implemented with vigour, provides a good stick - fining a company some large percentage of their global takings is a pretty decent incentive. But we'll see if companies wriggle out somehow.

Re: We take the protection of our customers’ data very seriously.

Anyone with that level of security knowledge would know that's it's essentially impossible to guarantee absolute security. While there's definitely a lot most companies could and should do, there's always going to be some zero-day exploit that could bite you. Spectre and Meltdown have shown we can't even trust the basic hardware underpinning everything.

Why would anyone take the risk that a new form of exploit out of your control could send you to jail? You'd have to be mad.

If you somehow think imposing this level of penalty would magically make everyone write every line of code from scratch, including the OS, and CPU microcode, to ensure every single byte has been thoroughly inspected, then you misunderstand how business works.

Re: We take the protection of our customers’ data very seriously.

"Data breach? CTO goes to jail."

No-one in their right mind would take a CTO job if this was the case. So you'd end up with even more clueless idiots in charge, or companies would end up without a CTO at all. Either way I can only see this making things worse.

Massive fines seems like a more effective way to solve this. But we've yet to see if this will actually happen under GDPR or if the bigger companies will wiggle their way out through loopholes.

One-in-two JavaScript project audits by NPM tools sniff out at least one vulnerability...

Context lacking

One problem with the npm vulnerability scans is that they don't take account of the context of the dependency inclusion.

For example, a fresh out-of-the-box Angular 6 install will show several dependencies with vulnerabilities. But, if you look closer, some are only vulnerabilities if e.g. deployed on the server-side in Node.js, or if they hit production browser code. Within Angular they're only used as part of the build system which means they'll never see anything public facing, they never become part of the code actually used to provide a service to the end user, so will never cause any issues.

While it's fantastic that tools like npm and Github are reporting library vulnerabilities, the trouble here is that you get 'boy-cried-wolf' syndrome. If everything is is always reporting security audit issues which are easy to ignore then the one that matters, when it happens, will be missed.

Hey, you know what a popular medical record system doesn't need? 23 security vulnerabilities

Why are we still seeing...

SQL injection exploits. In 2018.

Greybeard greebos do runner from care home to attend world's largest heavy metal fest Wacken

Re: Never too old

Yep, I was there too and he was excellent, one of the day's highlights for me. He spent most of the rest of the day wandering around in the audience (still in full makeup and costume!), enjoying the other bands and chatting with the fans.. several of whom looked like they could have been on the run from a care home, but that's another story!

Amazon adds cloudy Linux desktops to encourage developers to code for EC2

v2 LTS release announcement?

That Amazon Linux 2 LTS release seems to have happened very quietly - they've apparently removed mentions of 'release candidate' from most of the relevant pages but I can't find any press release or blog post - anyone found something announcing this?

The v2 LTS release is more interesting (to me, at least) than v1 as they're providing externally hostable VM images (e.g. KVM, which can be easily adapted for OpenStack) so it's a tiny bit less locked-in to AWS. A tiny bit.

ZX Spectrum Vega+ will ship on time, developer claims amid doubts

Indiegogo of course not Kickstarter. Doh.

Nope, they haven't shipped to Kickstarter supporters yet. In fact if you read through the rather tedious comment stream on the site you'll see a note from the suppliers to the effect that they won't be starting shipping until after the "launch" date of 20th October.

As far as I am aware they have not yet published a photograph of a real, manufactured device yet, only prototypes and design moulds. Which might cast some doubt on their claims that small numbers are already being manufactured.