Posts by Kabukiwookie

Linux kernel 'give me root, now' security hole sighted, dubbed 'Mutagen Astronomy'

Re: Thanks for clarifying.

Sometimes small words, talking slowly and repetition isn't enough to guarantee understanding.

That's because you forgot to add 'louder' to that list...

'World's favorite airline' favorite among hackers: British Airways site, app hacked for two weeks

Re: We take the protection of our customers’ data very seriously.

fining a company some large percentage of their global takings is a pretty decent incentive.

Fines will be borne by the company, which will translate it into their cost. This means that with the large oligopolies that we're currently having, the customer eventually pays for the f**k-ups of poor management.

I am not saying CTOs should immediately go to jail without any investigation, but if their Security Officer has been warning the CTO time and time again that things need to be improved and the CTO doesn't act, the CTO did not perform his/her 'due diligence'. This should be at the very least a fire-able offence without pay / golden parachute.

The issue I have with this is that even if this happens (it does not), that incompetent previous C-level manager will happily start working somewhere else at the same level, due to his golf-buddies and f**k things up there.

Jail time seems to be the only way to actually get the message across. It doesn't even have to be years (I am actually against long incarceration), but even a few months being deprived of their freedom will quickly change not only their perception of the seriousness of the job, it will also change the perception of the next board looking to hire C-level managers.

I have no problem with competent managers being compensated properly. I have a problem with bumbling fools being elevated above their capabilities, f**king up things for all employees in the company, then move on to the next one using their golden parachute.

Re: We take the protection of our customers’ data very seriously.

Now, if the *developer* was to go to jail for errant and grossly negligent practices (i.e. using off-the-shelf code and libraries, externally hosted or not, with zero understanding or care of the potential implications), then perhaps these f**k-ups wouldn't happen at all.

Most of these f**k-ups only happen, because with every IT project, corners are being cut to meet arbitrary dead-lines (often linked with bonuses for management for finishing early/under budget).

As it stands we have a market flooded by f**k-ups who think they're able to manage a project, who are paid well over £600/day, but are too moronic to listen to the highly paid experts when they tell them not to cut any corners. Only a poor crafts-man blames his tools.

Re: We take the protection of our customers’ data very seriously.

If you somehow think imposing this level of penalty would magically make everyone write every line of code from scratch, including the OS, and CPU microcode, to ensure every single byte has been thoroughly inspected, then you misunderstand how business works.

Of course it would would not magically happen, it would require real work. Things 'magically happen' because someone else will take care of it is the current way of thinking, where C-level management is absolved from any wrong-doing, because they're 'not able' to control what everyone else in the company is doing.

The key term here is 'due diligence'. Right now a lot of top management has no interest in ensuring they do a good job, since they are able to hide behind the excuse that they can't control what's happening on the lower rungs in the company.

misunderstand how business works.

I understand very well how businesses (and their internal politics) currently work and I also understand quite well what it would take to make them work well. You however don't seem to understand human nature.

Without an incentive to actually get off their ass, nothing will happen. Since larger and larger carrots don't seem to work, maybe it's time to apply the stick.

Re: We take the protection of our customers’ data very seriously.

No-one in their right mind would take a CTO job if this was the case.

You mean, nobody who doesn't know anything about security, how to enforce it and check that subordinates are indeed implementing said security would take the job.

And that's exactly the purpose.

Someone who cannot ensure that subordinates are doing what they're supposed to be doing should not be in any position of power. C-level management requires a person to have leadership skills, not being best golf-buddies with members of the board.

Re: We take the protection of our customers’ data very seriously.

We take the protection of our customers’ data very seriously.

They just leave out the bit ', but not enough to spend any serious money on it, since damage control if something happens is still cheaper for us than actually making sure your data is secure'.

These things will not change until C-level management is made directly responsible if things like this go wrong.

Data breach? CTO goes to jail.

Problem will fix itself within the next 6 months.

No, eight characters, some capital letters and numbers is not a good password policy

Indeed.

This is good advice:

https://xkcd.com/936/

Re: Over Your Head

This is why any Security Officer should be reporting directly to either the CEO and/or board of directors.

What usually happens is that the person responsible for security winds up attempting to shove shit uphill,

When's a backdoor not a backdoor? When the Oz government says it isn't

Re: Question:

Simple. Alice goes to jail or gets find $50,000.

Facebook's security boss is offski. Not to worry, it has 'embedded security' in all divisions

Re: A great start

My thoughts exactly.

What are the chances that any of the embedded security people gets cut off at the knees when complaining about a security issue that needs to be fixed that endangers the delivery date of a new feature?

Without a direct connection to C-level management, any push for security will be doomed to fail.

Bank on it: It's either legal to port-scan someone without consent or it's not, fumes researcher

Re: They are running code in my machine without my explicit consent for their own benefit...

Law supersedes any wording in private contracts if the private contract breaks the law.

FBI boss: We went to the Moon, so why can't we have crypto backdoors? – and more this week

Re: Eggs out of pancakes

Literally, the signal-to-noise of what they want plummets the second that you capture ordinary people in the loop

That presumes that the real reason is an attempt to capture the 'bad guys'. Problem with that again is thay the definition of 'bad guys'is constantly shifting.

US voting systems (in Oregon) potentially could be hacked (11 years ago) by anybody (in tech support)

Re: Security through obscurity?

It's Symantec, did you have any other expectation?

Russia's national vulnerability database is a bit like the Soviet Union – sparse and slow

Re: Two Russia cyber stories ..

Can't imagine why anyone would have a negative view of Putin

It's just that a lot of people are tired as fsck about articles with a lot of whataboutery. For some reason, you don't see similar articles about US run sites like CERT, which for instance completely lacks any mention of where Student originates from (who'd have thunk it), but you don't see articles being written pointing this out (and that's good, because it would be just as useful as an article pointing out that water is wet).

Everybody already knows that each government has their own intelligence machine and their own political motivations to point out what their 'enemies' are doing because they're evil.

Please keep technical articles technical.

And btw; insinuating that anyone complaining about this sort of this is a putinbot is so last year.

AAAAAAAAAA! You'll scream when you see how easy it is to pwn unpatched HPE servers

Re: Home-written HTTP servers

That's why I always use my Bash HTTP Server.

https://github.com/avleen/bashttpd

Banks told: Look, your systems WILL fail. What is your backup plan?

stopping free banking for the general public.

Which part of the planet do you live where the general public gets 'free banking'?

Re: Having backup plans is good.

Management listening to their SMEs regarding what are best practices is essential.

The problem is usually cutting corners to meet ridiculous arbitrary project deadlines.

Another staffer at mega-hacked Equifax slapped with insider trading rap

Re: "... charged with insider trading – and has promised to pay back his alleged ill-gotten gains."

Only if you're C-level management.

On Kaspersky’s 'transparency tour' the truth was clear as mud

Re: Seriously?

if you don't understand the difference between a freely elected government and a government ran by a pseudo-dictatorship which invades a peaceful nation and runs hundreds of thousands of people out of their home at gunpoint.. then I believe you have a lot of research and self-reflection to do.

Indeed, the false choice in the US between a turd-sandwich and a shit-bagle can't actually be called a democracy.

Along with their lang-standing tradition of overthrowing democratically elected governments in other countries they don't like, they should be stripped of their veto power in the UN.

Or is that not exactly what you had in mind?

From here on, Red Hat's new GPLv2 software projects will have GPLv3 cure for license violators

Slippery slope?

Not sure what the 'cure' term is in GPLv3, but while in this extension the time in which a licence breach can be fixed in 30-60 days (if caught at all).

What's stopping all the proponents for this addition to GPLv2 to slowly start extending this 'cure' term to 144 years?

♬ Finland, Finland, Finland, the country for new cloud DCs ♬

Use of public infrastructure

Aside from the fact that you're still giving your data to a US company, I hope the Finnish government is actually taxing Google, instead of giving ridiculous tax breaks.

Google is using the highly skilled workforce and public infrastructure, which is all paid for through taxes. At the very least they should contribute to Finnish society in the form of taxes, instead of leeching off of public infrastructure paid for by Finnish citizens, while moving profits to a tax haven.

Internet luminaries urge EU to kill off automated copyright filter proposal

Re: Invest in hard drives

EVERY rightsholder supply free copies (or hashes) of EVERY copyrighted work to EVERY Web site?

Free copies? No, not free. Anyone who's required to implement these measures can probably buy a solution with a hit ratio of 1%, with a forced subscription model to ensure the signature database is updated at regular intervals.

June 2018, and Windows Server can be pwned with a DNS request

Maybe MS can find some better code in Github, they can't seem to write anything that's not severely broken themselves.

Microsoft commits: We're buying GitHub for $7.5 beeeeeeellion

Re: Aladdin

They'll want to monetise it somehow

They'll have access to lots and lots of private repos, full of IP of companies doing software development.

Re: Worst thing: M$FT has now full access to our PRIVATE REPOS!!

Why else do you think MS would pay 7.5 billion USD?

This'll teach you to use any service that's owned by a US company.

With the rise of huge mega corps in the US, your data is not safe if it's stored with any US company. Even if the data is not directly stored in the US.

Stop shooting yourself in the foot and go somewhere that does take privacy seriously.

FBI fingers North Korea for two malware strains

Re: Credibility

Compulsive liars, need to prove they're not lying this time.

Interestingly, this was immediately attributed to North Korea, while if you check for Stuxnet on the same site, there's not a single link that implicates the US and/or Israel.

For some reason it looks like 'technical' statements from US Cert are highly politicised, and that should already be a reason to take anything they say with a grain of salt.

Internet engineers tear into United Nations' plan to move us all to IPv6

UN has pretty much been crippled by politics and made meaningless for a long time.

Yes it has, but the value of the UN and active participation is seriously hampered by the few countries that have 'veto' rights. This essentially means that as a non-veto country the only way you can pass any significant changes is if you make sure any proposal you want to pass is in the interest of the countries that do have veto rights.

The only way to fix this is to remove veto rights completely.

GCHQ bod tells privacy advocates: Most of our work is making sure we operate within the law

Re: "If you whack governments on privacy it will only drive the vulnerability market."

ruthless but selfish minorities.

Of course, if you look at history, it's always the minority groups with no power who abuse said lack of power.

Some people who see 'evil terrorists' in every nook and cranny, don't seem to understand how power corrupts selfish humans who should be working for the good of general population.

Folks are shocked – shocked – that CIA-backed Amazon is selling face-recog tech to US snoops, cops

All your data are belong to us

CIA-backed Amazon is selling face-recog tech to US snoops, cops

So what would be the chance of all data stored in the Amazon 'cloud' are actively being harvested by the CIA or any of the other TLAs?

US Congress mulls expanding copyright yet again – to 144 years

Re: Copyright extensions need to stop

Not only this, but copyright should only be given to natural persons, not corporations.

Agile development exposed as techie superstition

Re: Agile is b*llocks. Any non-idiot knows this.

'using the cloud' is nothing more than putting your balls in someone else's vice and hoping they know which way to twist the handle,

Utter brilliant; I'll definitely be ripping off your comment and will randomly throwing it into polite conversation.

Software development slow because 'Most of our ideas suck'

"release now and download updates/fixes later

You mean make customers buy DLCs later, once they're already committed.

"Most of our ideas suck," he said, attributing the quote to software consultant Jeff Patton (though any cynic, unbidden, will say as much).

"But some of them are amazing," he added. "If we can try enough of these ideas out, we can play a numbers game. We can find that ideas that will really help our customers."

Isn't this essentially the same idea that if you put enough monkeys in a room with typewriters that eventually one will create a master piece?

https://en.wikipedia.org/wiki/Infinite_monkey_theorem

So what does that say about developers that are proponents of this idea?

Re: Precious

After reading that line I thought this was a SystemD article for a short while.

S/MIME artists: EFAIL email app flaws menace PGP-encrypted chats

Re: Am I missing something?

Surely they need full access to the target users computer not just the target's email account.

No, just having an email file itself allows an attacker to modify it, resend it and have (part of) the encrypted content fed back to the attacker as a URL that attempts to connect to an HTTP capable service owned by the attacker, due to the way that some email clients handle poorly formatted HTML in emails.

This is however only possible if the email client actively connects to URLs embedded in emails to retrieve content and the attacker must already have access to the emails, which mean either access to a user's account or access to a mail server.

The main group at risk of this, may be whistle blowers and political activists targeted by nations states who have access to email servers that contain a copy of the mail with encrypted content already and then only if they are using one of the affected email clients that allow retrieval of dynamic content in HTLM formatted mail.

Home Office admits it sent asylum seeker’s personal info to the state he was fleeing

Re: AC AC Cognitive Dissonance

why should the US burden itself by taking refugees who are unskilled from "sh*thole" countries - such as Haiti 

Maybe because the US is one of the greatest 'contributors' of turning countries into 'shitholes'. Either by bombing them back to the stone age or overthrowing democratically elected governments, because their interests conflict with the interests of the US.

You love Systemd – you just don't know it yet, wink Red Hat bods

Re: Spherical wheel is superior.

I do know that I never saw a non-distribution provided init script that handled correctly the basic of corner cases – service already running

This only shows that you don't have much real life experience managing lots of hosts.

like application double forking when it shouldn't

If this is a problem in the init script, this should be fixed in the init script. If this is a problem in the application itself, it should be fixed in the application, not worked around by the init mechanism. If you're suggesting the latter, you should not be touching any production box.

"La, la, la, sysv is working fine on my machine, thankyouverymuch" is not what you can call "participating in discussion".

Shoving down systemd down people's throat as a solution to a non-existing problem, is not a discussion either; it is the very definition of 'my way or the highway' thinking.

now in the real world, people that have to deal with init systems on daily basis

Indeed and having a bunch of sub-par developers, focused on the 'year of the Linux desktop' to decide what the best way is for admins to manage their enterprise environment is not helping.

"the dogs may bark, but the caravan moves on"

Indeed. It's your way or the highway; I thought you were just complaining about the people complaining about systemd not wanting to have a discussion, while all the while it's systemd proponents ignoring and dismissing very valid complaints.

Re: What's the alternative?

All admins serious about the Unix way of working seem to be moving towards Devuan or Slackware; Devuan is probably the most 'enterprise-ready' and the Devuan team is working to get enterprise support established in the longer term as well.

Like Redhat, but done properly.

Zookeepers charged after Kodiak bear rides shotgun to Dairy Queen

Re: Sense of humor

I feel sorry for all bears living in the US.

At least in Canada people don't have the right to bear arms.

Systemd-free Devuan Linux looses version 2.0 release candidate

Re: I don't understand...

So what's the added value aside from having to additonally maintain a blacklist (if that's your thing) and constantly having to deal with systemd dependency issues as systemd swallows up more functionality over time.

Along with the fact you'd be making a statement when dropping Debian, there seems to be no reason for not switching to Devuan.

I've been a rabid Debian fan up until they adopted systemd.

Now it's Devuan all the way. At least that distro's maintainers seem to be concerned with stability and manageability of the OS, instead of attempting to make themselves seem more important by adding new unnecessary features and with new security holes and then slowly increasing the scope of their project.

Microsoft sees Red ...Hat for OpenShift-on-Azure public cloud offering

It's time for another Enterprise Linux distribution than just Redhat (and no Oracle Linux, with Oracle support logging tickets with Redhat support themselves is not a good alternative).

The lack of real competition in the Enterprise Linux market, has not done us any good.

Pentagon in uproar: 'China's lasers' make US pilots shake in Djibouti

Re: Binding Protocol?

That's why the US does not acknowledge the jurisdiction of the International Court of Justice.

Not only that, the US will invade The Netherlands if there's ever a USian brought to trial there.

https://www.csmonitor.com/World/Europe/2009/0213/p05s01-woeu.html

Of course people don't like USians, because of their 'freedom', not because they threaten anyone at any time for any perceived sleight.

Re: Binding Protocol?

So your neighbour shines the laser, you end up dead in the resultant explosion and your death is marked as "collateral damage"...

Yes, but it's fine, because it's 'nothing personal' and it's not them, just some brown person in a third world 'shithole' as Trump said out loud, but what a lot of USians seem to think even if they don't say it.

The good thing about Trump is that the veneer of civility has completely cracked and everyone can now see the barbarians for what they are.

Re: Binding Protocol?

Hellfire missiles seem to be appropriate for any occasion; weddings, funerals, why not 'terrorists' with laser pointers.

Re: You'd havve thought.....

Same reasons they lied about WMDs in Iraq, Gulf of Tonkin, Viagra fuelled gang rape in Libya, babies thrown out of incubators. The list goes on and clearly shows a pattern of pathological lying.

The US government has been caught lying so many times, that even if they were telling the truth, anything they say will be taken with a grain of salt by anyone aside from the most rabid flunkies.

Most second-hand car dealers are perceived by most people to be more reputable than the US government.

Re: Laser canon and sonic death rays.

The Americans none the less persist in blaming Cuba.

If your only tool is an oversized military, every problem requires a casus belli.

If you're looking for bad news about Microsoft, top tip: look away now

Re: beggars belief

Yes, you can pay for the privilege of your data to be mined.

At least Google doesn't require you to pay to give them your data.

Under-fire Silicon Valley to gain new copyright 'safe harbour' in EU, fume critics

Private property

the cost of policing infringement falls heavily on the rights-holder, and on the small rights-holder even more so. 

And this is exactly how it should be. If copyrighted material is private property, the cost of monitoring infringement should be borne by the copyright holder. Not paid for by communal taxes.

If someone trespasses on someone else's property they should take action themselves (with calling the police as an option).

What's happening now is that copyright owners expect tax paid guard to stand at their driveway.

If a copyright owner does not want to pay to enforce their copyright, it's apparently not all that valuable.

Good news: AI could solve the pension crisis – by triggering a nuclear apocalypse by 2040

If your only tool is a hammer, every problem becomes a nail.

US sanctions on Turkey for Russia purchases could ground Brit F-35s

Re: Who Ever Thought It A Good Idea To Buy . . .

Very good observation.

How would the battle of Britain have gone if Spitfire engines needed to be shipped across to Ireland if they needed to be overhauled.

This just demonstrates that the F35 is a dead duck. Very expensive fireworks once they fly over territory that's covered by S400 air defence.