Posts by Drew Scriver

DoS vulns in 3 open-source MQTT message brokers could leave users literally locked out of their homes or offices

Could have sold management on a fail-open config at that point, right? ;-)

Re: Is there a GoS

Wouldn't that essentially be a DoS? After all, the service includes actually locking a door. If that no longer happens that service would be down...

Re: Patch a key

Depends on the type of DoS-attack. For a DDoS-attack you may be able to add capacity, although that's not a given.

However, DoS can be accomplished even with a single request or action in some instances. Generally, no amount of capacity will help in such cases. Although I have seen a web form that required one server per user - two people using the web form at the same time on the same server caused a DoS-sitution. I suppose that in that case you could just add servers...

Ransomware victim Colonial Pipeline paid $5m to get oil pumping again, restored from backups anyway – report

Re: Criminal to pay Criminals?

I had the opportunity to pursue the role of Director of Cyber Security to form (!) a security team at a large regional utility in the west of the USA a few years ago.

The utility fell under city government.

Took one look at their public-facing web site and other city-run web sites (mixed HTTP/HTTPS content, Qualys SSL score of "F") and told the person who contacted me that I was not interested.

Figured the level of support I'd get from management would be close to zero, but whomever got the job would be sacrificed at the first sign of a breach.

Over a decade ago there was a bill in the Massachusetts legislature that would have made executives personally liable for breaches if they had been informed of vulnerabilities but failed to adequately address them.

The bill failed.

Re: There's money in

Pretty bizarre to say it's a "private business matter" if it resulted in 17 states declaring a state of emergency, the President of the United states personally got involved, and the federal government issued an emergency ruling to lift restrictions on oil/fuel transport over land and water.

Where do they find the people who write these public statements? Have some intern use an online media quote generator?

US declares emergency after ransomware shuts oil pipeline that pumps 100 million gallons a day

Re: Presumably the fuckwits in charge ...

Where's that PR-template again? Google: "press release template for hacked comanies".

Oh, here it is.

"While our [service name] has experienced a limited and temporary reduction in service, [company name] remains committed to the highest standards of security. We are working diligently to resolve the situation and we have no evidence that our core operational systems were compromised."

If you don't have anything nice to say, don't say anything at all: El Reg takes Twitter's anti-mean algorithm for a spin

Why 13? The Cyber world might well be a better place if 'contributing' were limited to those of voting age...

Old-fashioned gentleman-like insults will still be fine

In the olden days (and even in today's British Parliament sessions) insults were (are) often masquerading as polite statements.

"I would seem that the gentleman from Bath has not yet had sufficient time to fully study the entirety of the documents."

Translation: "The guy from Bath just isn't smart enough to comprehend a simple statement."

Don't count on AI to filter such insults any time soon.

On the bright side, maybe society will swap the often crass and uncouth insults for polite put-downs.

Just one in 5 Googlers plan to swerve the office permanently after COVID-19

Re: Turn the headline around.

Spot on.

Trouble is that HR and (executive) management tends to attract bubbly extrovert types who thrive on get-togethers and team games on stage.

Notwithstanding the rhetoric about "inclusion and diversity", their ultimate goal seems to be to "fix" the nerds and help (force?) them "reach their full social outgoing potential" so they can be "normal human beings".

For proof one only has to look at the Open Office Floorplan that was foisted on tech workers. It was declared a success even before implementation. Anyone objecting was told "they'd learn to love it" and naysayers were dubbed "saboteurs of true interaction". Answers to survey questions to gauge buy-in tended to be limited to variations of "Love it!" and "Absolutely love it" - and the execs declared that they had been right all along. After all, the survey said so.

Big right-to-repair win: FTC blasts tech giants for making it so difficult to mend devices

Re: Some products are expected to display energy ratings

There's a company that makes high(er) end coffee grinders that puts stickers on the units that read:

"STOP! Don't Dump It - Fix It!"

It's designed to be fixed by the consumer. I'm the very happy owner of one of their grinders.

So it appears some of you really don't want us to use the word 'hacker' when we really mean 'criminal'

Re: ...-boffin

One man's hack is another man's release code...

Iterative design. Agile development. Nimble coding.

Unfortunately, those terms are often redefined to function as justification for poor coding, lack of planning, avoidance of testing, and a general disdain for user-focused design. In short - a hack.

An anecdote along the same lines. A number of years ago I found myself having to come up with all kinds of "workarounds" and "creative hosting solutions" to fix poorly coded applications. This lasted for years, until I started calling my 'creative solutions' and 'workarounds' by the happy name of "kludges".

Calling a spade a spade was quite satisfactory, especially in the titles of Change Requests. Oh, the fun I had defending my solutions in CAB-meetings! What do you mean by "Implement kludge to ensure data integrity"?

As expected, it caused quite a bit of consternation among management - especially on the development side of the house. Although I was pressured to refrain from calling my hacks "kludges" in the end it resulted in a focus on quality among the developers.

Homo sapiens: Hey you, Neanderthals! Neanderthals: We heard that

I still get hung up on the name "Neanderthals", as it makes little sense grammatically. Instead, they ought to be called "Neanderthalers" (or preferably Neandertalers). As the name is derived from the "Neander Tal" (Thal), or "Neander Valley", it makes little sense to call the inhabitants of the valley "valleys" themselves.

And please, drop the "h", especially in the pronunciation...

Splunk junks 'hanging' processes, suggests you don't 'hit' a key: More peaceful words now preferred in docs

Your post needs a trigger warning*.

Isn't "house" a privileged term also? Vast numbers of people have no access to houses. At the very least they might be reminded of their plight every time they encounter the word.

*Isn't "trigger warning" problematic in and of itself? After all, triggers tend to refer to implements of war.

The point I am trying to make is that stripping communication of all words that might be deemed offensive by any one individual will soon leave us speechless.

By the way, what I am missing in most of these edicts is whether the people for whom this is done have themselves be consulted on the matter.

Re: Special characters

That depends on the language...

I've always regarded the term "invalid" in reference to a "person with a handicap" to be offensive. Invalid = without validity. To me that sounds much worse than "handicapped". Even "handicapped" is an odd term, though, as it originally referred to something done to the better-performing to slow them down to limit their advantage.

"Mannequin" is a sexist word. It is apparently derived from "manneken" - Flemish for "little man" (or boy).

Racism is "the doctrine that one's own racial group is superior or that a particular racial group is inferior to the others".

It does not include judgement based on skin color per se, nor does it refer to "treating people differently". There has to be a sense of superiority on the part of the person who is judging.

What is even more baffling is that the concept of "race" as a biological differentiator is not only a fairly new phenomenon, it is scientifically unsound.

Don't get me wrong - racism as a sociological issue is very real. But it makes no sense biologically.

LastPass to limit fans of free password manager to one device type only – computer or mobile – from next month

Family of 7 = too big?

"or $4 a month for the six-user family option"

Somehow that feels discriminatory toward larger families. I understand that creating an unlimited family-option might result in some fraud, but the same argument could be made regardless of the limit.

But hey, at least they didn't limit it to one child per family like World Population Balance advocates...

There's no Huawei on Earth we're a national security threat, Chinese giant tells US appeals court

Re: Huawei will this end?

Right - all Trump's fault.

But explain how most large companies have had policies in place long before Trump became president that require the use of disposable tech for visits to China. Upon their return the equipment may not be connected to the corporate network and has to be destroyed.

Maybe, just maybe it's because they have due cause to suspect foul play on the part of the People's Republic?

On a related note, why are T-shirts, flags, and the like with Ernesto's likeness so popular among many on the left in the USA?

Even as a non-supporter of Trump that makes me wonder...

Nespresso smart cards hacked to provide infinite coffee after someone wasn't too perky about security

The coffee lady...

Back in the day we had a coffee lady walking up and down the offices to serve us coffee (and tea) and cookies.

Sadly, she's been replaced by Mi Fare Lady Nespresso machines :-(

Smartphones are becoming like white goods, says analyst, with users only upgrading when their handsets break

Re: As expensive as flagship phones are they should be grateful anybody ever upgrades.

Do those execs really believe it is realistic to expect consumers to spend $10,000 on phones in 10 years? Or even $5,000 in 10 years? For every person in the household?!?!

Even whitegoods don't cost that much - and you only need one of each appliance for the entire household...

President Biden selects Jessica Rosenworcel to head up FCC as acting chairwoman

Re: Interesting

Maybe tonight. At the moment they're busy interviewing Pai for the new job.

Realme 7 5G: Parents, this is the phone you should have got your kids for Christmas

The phone you REALLY should have bought your kids for Christmas... is one they can eat

The phone you REALLY should have bought your kids for Christmas is the one from the candy store. Just a chunk of milk chocolate wrapped in tin foil with buttons and a screen printed on it.

No monthly fees, no text-neck, no anti-social behavior (other than refusing to share the chocolate), no issues with Snapchat, Facebook, TikTok, or Instagram, or stupid games.

On the negative side, they may increase their attention span, have real conversations at home, learn independence, read an actual book, play an actual board game, build something tangible, cook a meal, or learn to move about without an instant parental safety net.

For every disastrous rebrand, there is an IT person trying to steer away from the precipice

Re: UK Crayon Departments are just as bad

Over the the years I've come across quite a few issues with names. Here are a few gems:

1)

A car manufacturer that wanted to introduce their S5-model in the Netherlands. I was part of the market research team that had been hired. My supervisor told me the project was going to run for several weeks. I predicted it would be abandoned within a few days. S5 is the Dutch military designation for failure to pass the intelligence test...

2)

The Project Management Team at a company I worked for jumped on the bandwagon to call everything "Services". So, PMT naturally became "PMS". A gal in the neighboring cubicle pod worked for this team, and we could never keep a straight face when she answered the phone. "Good morning, PMS, this is Susie."

3)

Another team decided to run a campaign called "No More Lies". It had to be catchy, of course, so they settled on "No Moo Lies". With the domain name "nomoolies.com". Fortunately they dropped that when I pointed out that "moolies" is a derogatory slang term.

4)

Just this year a school district in the US created a new website for their online school. The county name starts with an "H", so add "Online School" and you get "hos"... They did in fact use the subdomain "hos.schooldistrictname.org". A quick online search would have immediately revealed that "hos" is not exactly an appropriate term. Radio talk show hosts have lost their jobs over the use of it...

HP: That print-free-for-life deal we promised you? Well, now it's pay-per-month to continue using your printer ink

Re: print-free-for-life plan was "an introductory offer,"

Given the quality of some of their gear, a couple of years truly is a lifetime...

Re: print-free-for-life plan was "an introductory offer,"

HP did the same thing with their "Printables" service a few years ago. Advertised certain printers to have this feature, which would deliver printed documents on a schedule.

Examples were the New York Times daily digest and educational materials.

Then one day users received the "Unfortunately HP Printables will be discontinued... Your support has been truly overwhelming... We couldn't possibly have taken this service this far without your participation and enthusiasm."

Heck yeah, we should have access to our own cars' repair data: Voters in US state approve a landmark right-to-repair ballot measure

Re: Cars collect some interesting data...

Agreed, but they could have just installed a sensor that triggered above a set force. Turning the seat into an actual scale seems overkill.

But it would be funny to install that LCD and display the actual weight of the passenger. Would be a great conversation starter...

"What's that number in front of me? I've noticed it before, but it used to be below 100. Now it's over a 100."

"Oh, that. It's a metric mass gauge. Came with the car."

Cars collect some interesting data...

A while back I hooked up my Toyota Corolla to my laptop and accessed the on-board data. Quite interesting and revealing.

For instance, it reports the actual tire/tyre pressure for each individual tire. However, the dashboard indicator is just a simple light that will merely show a general "one of your tires is below the threshold". No details even on which tire/tyre. It would be trivial and inexpensive to show those details. But for that I'd have to upgrade to a much more expensive model, of course.

The most intriguing metric, however, is the weight of the front passenger. So far I have resisted the temptation to install an LCD in the dashboard to display that value... ;-)

Trump H-1B visa crackdown hit with legal double whammy: Tech giants, Chamber of Commerce challenge rules

The tech companies could do it, but they prefer compliant workers who don't complain, never ask for a raise and can't look for jobs elsewhere.

H1-B is a the best thing since the days that entire villages were built and owned by the company.

Please, tell us more about how just 60 hydrogen-powered 5G drones could make 400,000 UK base stations redundant

Re: Won't work

You forgot ML and the Digital Divide.

You can't spell 'electronics' without 'elect': The time for online democracy has come

"Fifty-two different states with fifty-two different voting systems feed into an electoral college designed in the days of slavery."

There was a candidate once who said "57 states", and he was elected president of the United States of America.

But writing "52 states" in an effort to make the case for online democracy? The remainder of the article is equally challenged. The USA are not a country in the sense of a single European country like Belgium or the Netherlands. It's better compared to the European Union. Any takers to have Brussels dictate how the elections are run in each EU country?

Then there's the misguided premise of "old is by definition bad, new is by definition good" that permeates the article like the scent of President Snow's roses...

But hey, I'll play along. Currently, in order to vote you have to either be 18 (something about wisdom, life experience) or pass a civics test. Don't know how many seats there are in the House? Can't remember the name of the Speaker of the House? The number of Supreme Court Justices? Who wrote the Federalist Papers? No citizenship through naturalization, and no voting.

So, let's drop the age limit and require everyone to take the current civics test for naturalization. Online, of course. If you can't pass the test you won't get to the ballot...

SpaceX’s Starlink finally reveals its satellite broadband pricing for rural America: At $99 a month, it’s a good deal

Re: Be careful what you wish for

Agreed to an extent.

However, Starlink won't be a competitor to traditional ISPs. The latter will be quite happy to drop their (pretense of) a commitment to rural broadband if there is an alternative.

At an average of $100 per meter running cable is often cost-prohibitive if there are only a handful of homes on a rural road.

Starlink won't be able to provide service in densely populated areas since each satellite can handle only a relatively small number of subscribers. As such, its complementary and not competitive.

Re: $5 each from a few dozen households

The genie is already out of the bottle in most of the western countries, although you are certainly right about attempts to curb the flow of information.

Still a lot of countries left that would not like to lose their control over information.

But hey, who needs government censorship if you can have the masses and the elites join forces in "cancel culture"?

For a decade?!?! More like 20+ years. That's 5 four-year-terms for many political offices, and 10 for many others.

Promises, promises.

I think it was less than 2 years ago that Virginia finally eased the restrictions for utilizing the right-of-way along highways.

Re: Searching for Signal

Starlink uses a frequency that is not much affected by weather, including snow.

There are still some questions about foliage. That may become a problem for people in dense forests. On the other hand, in Virginia the satellites seem to be higher on the horizon than originally estimated. Only need about 75-100 feet of clearance with 100' trees according to Starlink's iPhone application, especially if the antenna is mounted on a roof.

Time to tune up the chainsaw...

Re: Be careful what you wish for

Rural Virginia here, less than 20 minutes from the state capital.

A whopping 3 Mbps on DSL - for as long as it lasts. We're at the end of the DSL reach. Our neighbors (300 feet away) get 1.5 Mbps. The next house over gets nothing.

Verizon is not selling any new subscriptions. Comcast cable a mere 3/4 of a mile away - or $75,000. Probably $500,000 or so for our entire road (30+ houses).

Mobile service is spotty and of course comes with a throttle/depriorization/extra cost over 20-25 GB a month.

WISP has been promised for years, but the first company went bankrupt and the next one has delivered nothing more than promises. Keeps the politicians happy and the grants flowing, but doesn't help the residents.

Lest you think we knew this going in, we made sure to check with both Verizon and Comcast before buying the house. "Sure, we can provide broadband service at that address."

Only to get their "sincere apologies" when we called after closing to start the service.

Federal government is hapless also. Question in the latest Census Community Survey:

Something like, "Do you have access to high speed internet, DSL, fiber, cable? Yes/No"

In other words, the feds check the internet box for an address whether it has 0.5 Mbps DSL or 3 Gbps fiber.

Re: $5 each from a few dozen households

In many areas people can already rent mobile phones for short periods of time to make calls.

The biggest problem won't be the monthly cost - it'll be that the service requires a computer or mobile device.

In the poorest areas it will require outside money, either from NGOs or GOs. However, keep in mind that many countries will be none too pleased if their citizens will suddenly be able to obtain uncontrolled news and, maybe even worse, will be able to communicate freely with the outside world.

Trump administration proposes H-1B visas go to highest-paid workers first

Re: So what's the catch

Another possibility: tariffs on the portion of income that leaves the USA. To be honest, I haven't considered this carefully just yet, but it may prompt companies to pay foreign workers more to offset the tariffs.

Re: So what's the catch

Intriguing thought, but income taxes are calculated based on AGI (Adjusted Gross Income) and not on a worker's gross income. Deductions will vary based on family size, medical costs, standard vs itemized deductions, owning vs renting a home, et cetera. This would make the collected income tax quite unreliable as a gauge, unless a company would be on the hook to pay the federal government the difference. However, local governments in the USA usually also levy income tax. This would complicate matters even more.

Would be better to base it on the taxes the companies have to pay on their workers.

Another option would be to require transparency from the companies regarding compensation for the different categories.

Trump's official campaign website vandalized by hackers who 'had enough of the President's fake news'

Re: A sign of the times

Curious about all the downvotes.

I assume it's because of the portion about Harris' stance on abortion rights and/or the legal rights of a viable fetus in the US vs. some progressive European countries (like the Netherlands). However, those are verifiable facts and not opinions on my part. The reason I added them was to indicate that Harris cannot truly be considered a moderate.

Re: A sign of the times

It seems that many of her actions have been mostly based on political calculations and not on her personal convictions.

Although she has not explicitly stated that she supports abortions up to the moment of birth, she has made it very clear that she opposes any restrictions - even past the age of viability.

Even in the more progressive European countries a viable fetus is legally considered a person and certain legal protections are therefore extended to the unborn. At the federal level in the USA personhood is not granted until birth.

Microsoft: After we said we'll try to promote more Black people, the US govt accused us of discrimination

Re: This is just because of Trump

Thank you for providing the link.

I was aware of that ban, but you stated "block companies that do business with the government from having any diversity training". The Executive Order appears to be more limited in nature.

Granted, it does include sex-based sensitivity training, but it does seems that the limitations end there.

From the EO:

“During the performance of this contract, the contractor agrees as follows:

1. The contractor shall not use any workplace training that inculcates in its employees any form of race or sex stereotyping or any form of race or sex scapegoating, including the concepts that (a) one race or sex is inherently superior to another race or sex; (b) an individual, by virtue of his or her race or sex, is inherently racist, sexist, or oppressive, whether consciously or unconsciously; (c) an individual should be discriminated against or receive adverse treatment solely or partly because of his or her race or sex; (d) members of one race or sex cannot and should not attempt to treat others without respect to race or sex; (e) an individual’s moral character is necessarily determined by his or her race or sex; (f) an individual, by virtue of his or her race or sex, bears responsibility for actions committed in the past by other members of the same race or sex; (g) any individual should feel discomfort, guilt, anguish, or any other form of psychological distress on account of his or her race or sex; or (h) meritocracy or traits such as a hard work ethic are racist or sexist, or were created by a particular race to oppress another race. The term “race or sex stereotyping” means ascribing character traits, values, moral and ethical codes, privileges, status, or beliefs to a race or sex, or to an individual because of his or her race or sex, and the term “race or sex scapegoating” means assigning fault, blame, or bias to a race or sex, or to members of a race or sex because of their race or sex.

Full text: https://www.whitehouse.gov/presidential-actions/executive-order-combating-race-sex-stereotyping/

Also, the EO includes quite a few statements underscoring equality. Just a snippet:

From the battlefield of Gettysburg to the bus boycott in Montgomery and the Selma-to-Montgomery marches, heroic Americans have valiantly risked their lives to ensure that their children would grow up in a Nation living out its creed, expressed in the Declaration of Independence: “We hold these truths to be self-evident, that all men are created equal.” It was this belief in the inherent equality of every individual that inspired the Founding generation to risk their lives, their fortunes, and their sacred honor to establish a new Nation, unique among the countries of the world. President Abraham Lincoln understood that this belief is “the electric cord” that “links the hearts of patriotic and liberty-loving” people, no matter their race or country of origin. It is the belief that inspired the heroic black soldiers of the 54th Massachusetts Infantry Regiment to defend that same Union at great cost in the Civil War. And it is what inspired Dr. Martin Luther King, Jr., to dream that his children would one day “not be judged by the color of their skin but by the content of their character.”

"If their advancement is simply to meet some ideological quota, that's racist."

Only if it is based on the premise that the advancement requires the action of a group that is inherently superior. Of course, it that were the case it wouldn't diminish racism.

One of the problems in these types of discussions is that the definition of the term "racism" is often assumed to be universally understood. As such, it frequently expands into any negative attitude or even action toward others with a different background. To further complicate the matter, sometimes other backgrounds (e.g. specific religions) are also grouped under "race".

In reality "racism" has a very narrow meaning that necessitates a concept of superiority based on the artificial construct of "human races".

Re: Just do what I do.

Aren't you essentially saying that finding the best talent may require extra effort so ensure that the net is cast wide enough because some candidates may not be represented in narrower searches?

If so, you wouldn't you still be focusing on merit? If the best-qualified candidate happens to belong to a certain group of which you would like to see greater representation within the company that would merely be a side-effect, wouldn't it?

Re: This is just because of Trump

I am quite certain that your statement ("block companies that do business with the government from having any diversity training") is factually unsound.

However, I'm always open to learning more and adjusting my conclusions accordingly. Can you provide some URLs with information about this ban?

Infosec researchers pwned Comcast's voice-activated remote control so it could snoop on household chit-chat

At least one of the top-10 banks in the US has issued a Cyber policy mandating that all "smart devices" within earshot are turned off if you work from home. I'm pretty sure they have a very good reason for this rather unpopular policy.

Re: In case you wondered

The way it works stock, I hope it doesn't listen to a thing until you hit a microphone button on it.

IBM manager had to make one person redundant from choice of two, still bungled it and got firm done for unfair dismissal

Re: "involuntary separation"

Funny story about those euphemisms.

I spent ten years in a state that has a lot of military bases, so we always heard about people being deployed to various conflict zones across the globe. Often this would be their second or third tour, so we were used to redeployments.

Then I moved to another part of the country for a job at a progressive company. Pretty soon we had a major round of lay-offs and people were getting the axe left and right. In the midst of this my boss told me that one of his best friends just got redeployed. Thinking that this meant that this friend had been spared and moved to another department I told him that I was very happy for him...

Turns out that "redeployed" was this company's euphemism for "laid off".

I never worked for GE...

If I'm not mistaken GE got rid off that rule after Welch left. Company I'm talking about is another Fortune X company.

They also believe in 360-reviews, where you're supposed to obtain (written) reviews from other employees. Oh, and the feedback cannot be submitted anonymously and is visible to the subject.

Well, you say, only get/give positive feedback. They thought of that, too. Some directors have stated that all feedback will be ignored unless someone also has negative feedback.

Company I have first-hand experience with:

"We only hire the best and the brightest."

"We know ahead of time that 15% of our employees will perform unsatisfactorily. They will have six months to improve, or they will be dismissed."