Posts by doublelayer

After injecting cancer hospital with ransomware, crims threaten to swat patients

It's a bunch of people from everywhere. One common setup involves Russia, because it and surrounding countries have had a lot of people who have technical skills but few job prospects, and Russia has turned a blind eye to criminals who don't attack Russians and occasionally help them disguise government actions. That's why some of the largest operations are based there. However, even those have a lot of outsourcing. For example, they might write the encryption software themselves and run the negotiations, but they let someone else break into the networks to install it. That person gets a cut and could easily be outside Russia. Similarly, even those who work for the group need not be in Russia, and very commonly are located elsewhere. Ukraine had a lot of participants, and while the Ukrainian authorities were much more helpful in arresting them when identified, it didn't stop it being a country with plenty of participants. A group can form in any country, can have employees or partners in any other set of countries, and can be created by multiple types of people, from those interested in a quick heist to governments trying to disguise military actions as a criminal enterprise.

Re: Brutality

The quality of the prison doesn't change the expectation of ending up there. People do things all the time where the severity of the bad outcome is high but the risk of incurring it is, or they perceive that risk to be, low. Ransomware operators already have received very long sentences, but that's a small subset of people, and some of the others are living with quite a bit of wealth and happily evading law enforcement. Criminals have chosen to believe that they'll be like the latter and avoid the situation of the former. So far, they're mostly right to think they'll avoid the arm of the law, although they're often wrong about how well they'll be paid for the work. Increasing the severity of what will happen if law enforcement gets them won't have much of an effect unless law enforcement starts getting to more of them, and I think that the effect would be similar without increasing the penalties at all if they could only be applied more broadly.

Re: Would it not be possible to give a patient list to the police...

It should be, and for all I know they may have some method of determining that which for some reason isn't used for many calls. However, criminals who have even a bit of a clue could find ways to relay calls from their location to somewhere local, or even pay someone to make the calls on their behalf. There was a group of adolescents interviewed on a security podcast who operated swatting as a service operations, so they could try outsourcing the work to those guys. It probably won't end well for the less intelligent of those ones, but it offers them another proxy.

For those who are interested in hearing it, the specific episode is Episode 83: 'DING-DONG DITCH' ON STEROIDS (link goes to Apple podcasts).

Re: Would it not be possible to give a patient list to the police...

Fine with me. And those are? The problem with crime of this nature is that we usually don't know all the names and addresses, and when we find out one of them, it's usually more useful to hide it because there's a chance we may find more, while publishing the one we have will just alert them that we're getting close. Some criminals have been arrested successfully when law enforcement has succeeded in unmasking them, but unfortunately not often enough to stop others doing it.

Ransomware payment ban: Wrong idea at the wrong time

Re: class ransomware as a weapon of mass destruction?

Do you want that tested over your house? Are you really planning your international policy on Russia being unwilling or unable to maintain some nuclear weapons to back up the frequent threats, weapons they already had? I'm sure the Russian arsenal is less modern and well-maintained than the American or British ones, but an old nuclear weapon can still kill a lot of people. The reason that nuclear powers usually have a strong line against any use of nuclear weapons is that even one detonation can be catastrophic. Unless you seriously believe that Russia somehow managed to break every nuclear weapon they've ever had, you need to take their ability to use them into account when planning actions against them, which means that nuking them yourself is a really risky thing to do.

But let's assume it's not Russia. It's the People's Republic of Alphia which doesn't have any nuclear weapons. They can't get any meaningful revenge if you decide to attack them. Are you satisfied dropping a nuclear weapon on them when criminals operate from them and they don't do something about it? That will result in thousands to millions of innocent Alphians who didn't do that dying. It will probably cause people in Alphia's neighbors to die as well. It will certainly cause complete chaos in the region. It will likely cause a lot of Alphians to hate your country, so expect some Alphian terrorist movements trying to make you pay. Is that something you're comfortable doing, both from a moral and a pragmatic point of view?

It depends what you have to do to get cut off. If it's really difficult, effectively making yourself a pariah to everybody, then it won't matter. The only country that's achieved that is North Korea, and basically nothing comes from their tiny address space. All their attacks come from other countries' addresses, most of that launched from Chinese proxies (as the first link in a chain to more proxies), and some also committed by people operating from a different country already. If it's really easy to get a country blocked from the internet, what makes you so sure that the one you're in won't get blocked for some reason? Russia may have burned a lot of its bridges with European countries and close allies, but they've got plenty of links with other countries, especially including India and China. How would we ban Russia from the internet if India and China were voting on their side and could easily proxy as much traffic as they needed to. Would we try to ban those two as well for not complying with our ban? The decisions required to implement that and trying to decide who should have the power to make them is a very difficult task.

Re: How about a bounty?

They do that. For example, from this paper alone:

US offers $10m for info on DarkSide ransomware gang chiefs

US puts a $10m bounty on Hive while Russia shuts down access

US offers $15m for help catching Conti ransomware gang

If you have lots of cash to spend on that, you can keep doing it. I'm not sure the rewards promised in any of those have actually been paid, and I don't know how many useful leads they got from having those programs, but it is a tool and the US, at least, has been using it on occasion.

It won't destroy cybercrime, but it would weaken it. Anyone could have set up an insider trading scheme based on causing sabotage any time in the past. However, it's much more difficult to implement correctly. You may not know, for example, how much damage your sabotage will do or when it will become known. If your attack occurs in July but they don't announce financial results until September, you don't know how bad it will look then and there's a chance your trading either fails or, more likely, produces a really tiny profit for a carefully-planned attack. If we could destroy ransomware entirely and only be left with things like that, that would be an improvement. I won't pretend that banning payment of ransoms would completely kill ransomware, as I'm sure there would still be some people willing to circumvent the ban rather than incur the consequences, but it would be helpful.

Re: class ransomware as a weapon of mass destruction?

Sure, that will work great.

US: Excuse me Mr. Putin, but we detected some criminals operating from your country infecting hospitals with ransomware. We have a small missile pointed at Moscow and another one targeted at Volgograd, where we're pretty sure these guys are. We're about to kill two million of your citizens. What do you say?

Putin: One moment please.

...

Putin: I have thirty missiles ready to fire at thirty of your cities. I will kill fifteen million of your citizens. What do you say?

US: I have a hundred missiles. Thirty million citizens.

Putin: Five hundred missiles. Too many citizens to count.

US: Most of the missiles. Your country will not exist.

Putin: All our missiles. Your country and those of your allies won't exist.

The concept of mutually assured destruction is not new. You would do well to learn it.

Re: "Such a ban would need to be universal"

If you want the logic to say that big business can do whatever it wants because it has ultimate power over everything, then let's just accept that. It's wrong and self-defeating, but we don't even have to argue about that to resolve this question. If the biggest businesses are beyond our ability to control them, then we still have the power to influence what everyone else can do, and that power is still big. So, whether we are powerless or not to regulate the actions of the largest companies (we are not), we can still make an impact by regulating what smaller ones and government-controlled entities as mentioned in the article, can do.

Re: Wrong

"How can you frame it as a crime to pay to get your own data back under threat of damages to your company?"

Paying money to known criminals? It is already illegal if you replace "criminals" with "terrorists", because you know the money will be put to use committing terrorism which is assumed to be worse than whatever problem you're having. It's pretty easy to make that logical leap, and the law would be compatible with other criminal legislation that already exists. There is no legal obstacle, as far as I know, that would prevent you from passing and enforcing such a law. Therefore, it comes down to whether we, as the voters in democracies, wish to make that a criminal offense or not.

Re: Wrong

The fact that someone made a mistake does not mean that we should adjust our laws to let them do whatever they think necessary to recover from their mistake. I have left too late for things before, but that didn't give me permission to treat the public streets as a racetrack to get where I needed to be on time. Making mistakes leads to consequences. Consequences are why you try to avoid mistakes when you can and to have contingencies for when you can't.

Open source's new mission: To boldly go where no software has gone before

Re: What but not why...

"It also (as another poster raised and promptly got downvoted for) can be wildly abused as a mechanism for denying the reward for work done."

They got downvotes because it's not abuse. It's specifically written into the license the person doing the work chose. If I write some code and say you can use it for free, and you can make money from using it, then maybe I should have tried to charge you in the first place. There's a reasonable chance you wouldn't have used my code in that case, but if I choose to give you the right to use it for free, then I should expect that you get to use it for free. There are a lot of options for making software which cannot be used in commercial situations without payment. If you don't choose any of those methods, and you specifically choose one that does allow it, it is not abuse when people do what you said they could.

Microsoft pulls the plug on WordPad, the world's least favorite text editor

Re: Word Processing in the Cloud

It appears people disagree with my supposition. I'm curious if others have another reason they'd like to propose for why a school would intentionally remove both editors from a system? It can't be Microsoft doing it; Notepad is always there and Word Pad has been thus far as well. To actually remove them would take someone deliberately trying to do so. As much as we might try to blame Microsoft for it, can you actually name a version of Windows that has had them stripped out to push Office365, or for any other reason?

Re: the application will be removed on upgrade

Because there is a risk in telling people that they ship this binary on everyone's installation but it's not supported. If, for example, a security vulnerability was found in it, would they really be able to claim that they don't support it, so that's not their fault? They would be blamed for that, so if they're no longer going to maintain it, they remove it. You can always put it back. It appears to be one executable, one DLL, and a resources file for each installed language, so it should be pretty easy to keep even after it's removed from preinstallation.

Re: Word Processing in the Cloud

I'm sure that, if this is true, it was done intentionally by the place of education. If so, they likely did it to prevent students from writing something locally, saving it to a disk which isn't meant for storage of student work, and either losing important work or claiming that they did to get out of turning something in. The same reason why I've been asked to prevent people from being able to save documents except to a network drive, because evidently just telling people is not working.

AI-generated bug reports are seriously annoying for developers

Re: Charge bug bounty hunters an entry fee

It won't affect academia or Project Zero types because those people have a lot more ability to report things without penalty and they are also listened to if they have to report something publicly. If a company wants to get rid of the HackerOne types, they have a clear option: don't have a HackerOne presence. If they've decided that the noise from people looking for an opportunistic quick reward is worth the potential benefit of more people looking for and reporting real issues, then this is a more important problem for them. Public bug bounties have always been prone to bad submissions, a problem that AI will probably exacerbate, but each company can individually choose whether to participate.

I'd argue against this, but I think you misread the situation so much that it's virtually impossible to debate the point with you. Somehow reporting a problem is the same as advertising, even though I don't pay anybody to use libcurl and the article mentions nothing encouraging use of it. I think you might need to read the article again.

Re: Charge bug bounty hunters an entry fee

It will probably get rid of all hunters, both those who submit crap and those who don't. Hunters may be concerned about submitting a real bug and getting charged for it, especially if companies are being vindictive as they sometimes do. While I don't do commercial bug hunting, I've had the experience of reporting a vulnerability to a company and getting a nasty message back because they didn't like having a problem brought to light, so I'd be careful not to do that if it involved getting a nasty message and paying them for the privilege. I think that's what you'll get, but we can always try. I wish there was a better way, but I don't have one.

Google to start third-party cookie cull for 30 million Chrome users

Re: What's the betting

It probably won't be as simple as rm Chrome/Profile/advertiser_files/*, but I expect it won't be intentionally obfuscated as you appear to suggest. They just don't need to do that. If someone was motivated to do that, they could do all sorts of things, for example just creating a basic profile containing their settings and, every time Chrome closes, delete the old one and substitute in the premade one. Google hasn't prevented that or even made it at all more difficult. They don't collect data by making it impossible to avoid, but by making it difficult to avoid and counting on people not bothering to do anything too complicated. The things they have gone after have been the ones that are easy for lots of users to do, for example installing an ad blocker, which can be managed by a nontechnical user who is willing to push a few buttons, and even that isn't particularly common among the general public. The reason it doesn't happen is that those of us who are willing to take more invasive measures are less likely to be running Chrome anyway, using either Firefox or a Chromium-derived alternative with some of this stuff stripped out, though not as much as would be ideal.

Re: What's the betting

I'm sure you can purge the advertising cache files every time Chrome creates them, but that will just cause Chrome to recreate them every time. With a 10 MB limit, it's likely those will be hideously compressed on disk to fit as much as they can in there, so expect to be downloading 10 MB per advertiser when it restarts. The good news: it will probably be different advertisers each time.

This is a good enough reason not to use Chrome if you can't disable this, and I already had a good enough reason not to use it.

Tech support done bad sure makes it hard to do tech support good

Re: A penny saved and a pound lost

I've also seen some disasters of doing things on the expensive. Mostly, it's people who don't want to spend the time to build something right, so they figure that the expensive option will mean they can skip that part. Alternatively, people who actually do get things set up properly, but spend so much on the expensive things that they eventually run out of money for other things they also need, usually just at the level of the project budget rather than the entire company, but I'm sure other companies run into a similar problem.

This situation looks unrelated. I see nothing here that says the private feed they were using was required over the cheaper option, so someone who told the company that they should stick with the private option to avoid this mess would be needlessly spending money. What they actually needed to do was to properly implement the new option they switched to, but that's on their processes and the vendor's docs, not the decision to switch feeds.

Windows keyboards to get a Copilot key – but how quickly will users jump?

That's what I was saying. Folder represents the abstract concept at the user level because folders appear to contain files and more folders. Directory represents the abstract concept at the developer level because directories contain the name and location of other things. Both are abstractions to some degree because the directory is actually a linked list of strings which are serializations of objects which contain strings and integers which refer to filesystem-relative locations which are translated into disk-specific information* which can be used to locate linked lists of strings which can be concatenated to produce the big string the user put there before, but nobody wants to deal with the concept on that level unless they have to.

* Or sometimes there are more levels in the middle, such as virtual disks, RAID arrays, filesystem redundancy, etc. Either abstraction is much nicer.

Re: Cart Before The Horse?

"But for Bobby and Susy Office Worker, what exactly does AI bring to the table? I can get useless search results even faster? What's in it for me and the millions of other average users?"

If you need to write an email but don't want to be bothered thinking or typing, then you can use this to create a message that looks like it answers a question but really doesn't. If the person you are sending it to isn't bothering to read it, then you've saved yourself some time. Otherwise, you'll end up looking like a person either being deliberately unhelpful or someone with reading comprehension problems. That appears to be the use case for office workers that AI companies have thought of. I'm sure some people will try doing that. I didn't say it would be a good thing.

"BTW, what's the difference between directories and folders?"

The level of abstraction involved in the name. Both are pretty abstract, but "folder" was intended to represent to the user what the thing does, and "directory" was intended to represent to the user how the thing worked. The concept that they're doing is identical.

SpaceX accused of firing employees critical of free speech fan Elon Musk

Re: Don't get this confused with free speech.

Musk has spoken frequently about "free speech", that is to say, not government restrictions on speech, but others' reactions to that speech which he doesn't like. Now, he is reacting to others' speech that he doesn't like. The inconsistency is common. I think he has the right to do what he did, but it is inconsistent with his complaints when others were treated similarly. I interpreted the headline to be referring to his previous statements about speech and its consequences, which he has contradicted numerous times including now.

Re: Don't get this confused with free speech.

I didn't disagree with that. In fact, I was using that as part of my statement that there are always consequences, and that the free speech legislation in the US does not prohibit companies from using employees' speech as a reason to fire them. What I asked about was why the original poster thought their opinions should be excluded on a free speech basis, but that the people in this article don't qualify for the same. I think the law doesn't give an exception to either, which is internally consistent, but their post did not have a similar consistency, nor even an argument for why their exception should be specially excluded from consequences.

Re: Don't get this confused with free speech.

So let me see if I understand your statement correctly:

If someone says something that you agree with then it's a free speech issue and you should be allowed to say it without fear of losing your job. If it's something different, which you probably disagree with, then it's not a free speech issue and bring on the consequences.

Sorry, if your boss can fire you for one thing you said, they can fire you for other things as well. Consequences always apply. The only exceptions are when labor law restricts them, which could be in everything or not. In the U.S., those laws are not strong, meaning that you can be fired for lots of things you may choose to post. This means that I don't expect these workers will get anything in this case, as they can be fired for the statements their managers did not like. It does not mean the views you prefer would or should get to bypass this reality unless the law is changed. I'm having trouble seeing your distinction between what counts and what doesn't other than you agree with one and don't with another.

What comes after open source? Bruce Perens is working on it

Re: Better idea: Go nuclear

That wouldn't happen. If everyone got the source code to every application, the freedom to share being absent would not stop people from sharing it anyway, nor would it prevent other groups from making "competing" versions that are pretty much just copies. If a country tried it, they would simply not get any direct sales. People would still be using Windows, but they'd be using Windows imported from a country next door or using pirated license keys. The same is true of most other software. In practice, we all have the ability to reverse engineer software we have, and we have some rights to do so, but the practical difficulties doing that make it useless to most people. After all, what reverse engineering tasks are you capable of completing but currently blocked from doing by legal obstacles? I imagine that the only significant legal obstacle is with distributing the result, but there are some practical obstacles as well.

Re: MIT/BSD anybody?

It's true that Linus didn't have the ability to just switch everything to GPL 3, but he could have done something to make the terms apply to some important part and apply the restrictions to most users. Based on his comments at the time, it seems he didn't have a major objection to the tactics that the FSF wanted to prevent with the GPL 3, so he didn't try to do that.

Re: Eclipse Versus Borland Delphi

"Companies don’t need Open Source if they want to cooperate."

True, but it helps. They could form a consortium and build something closed. That consortium could even sell licenses and that might help make some money. But it makes it really hard for new companies or individuals to join and start working on it as well, and it reduces the number of users, which can be important if you want contributors. They appreciate that it's free as well, but part of the reason that it can be is that there are so many people interested in maintaining it.

Re: Let's say he creates this post-open "contract"

It's not about willingness to pay so much as knowing whether or not I have to. I don't object to proprietary software; if I want it, I will and have paid for it. The companies that employ me do so all the time. The charities I used in my example do so less frequently because, as I said, they don't have a lot of money so asking them to spend five figures on some enterprise software is a hard sell, but they still do it if it's important enough. However, I know that when I suggest the option. I don't say "Let's use Office365" and get surprised that Microsoft wants money for it. Using something sold as open source and then finding out that the license is not compliant is a much larger surprise, especially if I've previously contributed code or donated money to that project.

One of the reasons I might adopt open source software instead of proprietary is the freedom it offers me, and I don't just mean the freedom to read the source and modify it in my environment. Chances are that I won't be doing a lot of that for the infrastructure software anyway. One other freedom that I value highly is the knowledge that, no matter what the authors did, I can keep using this. If the authors gave up and stopped developing it, I still have the software and the right to run it here. If the authors started demanding a higher price than I can pay for some feature, I still have the old software and can work around this change while using what I already had. In either case, I can take the code, make my own version, and work with others to keep the software alive despite it. In an environment where certain uses require permission or payment, I no longer have that guarantee. If the authors have the choice to tell me that my use is now forbidden, then I have lost something that traditional open source provided.

A tale of 2 casino ransomware attacks: One paid out, one did not

Re: Forensic accounting is a thing as is KYC.

"10M without someone getting their fingers dirty, from a legal perspective, would be really hard to shift quickly."

Let's be clear that the people who would be doing this have already started out by breaking into someone's system and installing ransomware on it. I don't think they're too worried about staying legal. They're only worried about the pragmatism of whether they get the money without being identified. Therefore, several of your objections do not apply. For example, tracking the person who bought the gold before it got to you: they don't matter. Paying ransoms is still legal, so that person can go out in public and say "I'm buying gold for these evil guys" and they are fine. So are the criminals. Nobody cares if that link is tracked down.

Similarly with the arguments about the slowness of cash processing. This is the same problem that criminals receiving cryptocurrency have. They don't really want cryptocurrency, as there are only a few things you can buy with it directly. They need to turn it into something else, and there are problems doing so quickly in a way that evades local authorities. It has no advantage over any other commodity that isn't immediately convertible into high-value purchases. While doing it in gold or physical cash has that annoying feature for the criminals, cryptocurrency has it as well.

Re: All because of crypto

"I never claimed (and if you disagree: show me were I did) that this is a silver bullet that will magically solve all cybercrime."

I agree, you did not. The person to whom I first replied did, or rather that it would magically solve all ransomware. I've seen the argument before, and similar to the discussion elsewhere in these threads about whether you could start a global trade war to stop ransomware, it could theoretically help but not as thoroughly nor as cheaply as people would like to believe.

I also agree that disabling cryptocurrency, if we could do so unilaterally, would cause some serious problems to ransomware operators. So would several alternative methods, such as making payment of ransoms illegal or having a larger dedicated police force for identifying operators and tracking them until they come to a country in which they could be arrested. We could try all of these things and more. Each would probably have some effect. None would have the ultimate effect we both want, and I fear that cryptocurrency might be among the weaker of them given the scale involved. There are a lot of criminal organizations that have spent time and effort figuring out how to move large quantities of money before cryptocurrency existed, and ransomware has become large enough that they could start to do the same. I think that there is an appetite to shut down ransomware that is strong enough that people are abandoning the step of considering the costs and likely results of possible measures. This has led, in these comments alone, to suggestions to send assassins to kill the ransomware operators and to commit acts of war against the countries in which they are located. Banning cryptocurrency is much less outlandish than either of these, but that doesn't make the description realistic.

Re: All because of crypto

Did I say that you need to keep cryptocurrency because it's so useful? I did not. What I was arguing against was this: "Get rid of cryptocurrency and the problem goes away." Sorry, that would be great, but the problem won't go away with a flip of a switch. If you pretend it will, it will only result in disappointment when you spend a long time convincing people to do the difficult work required to shut down or make effectively worthless all cryptocurrencies and ransomware operators are still around. A counterpoint is that, if we could retroactively disable cryptocurrency a decade ago, I think we might have prevented ransomware because they started with small attacks and small ransoms where finding a transfer method was not worth it, but you rarely hear about a ransomware attack on a personal laptop anymore. Nowadays, it's large groups going after large companies or governments for millions in ransom, and that scale is where finding alternatives is worth the effort and much easier to try.

I don't much care whether cryptocurrency exists. I have none, I don't want any, and the benefits it was supposed to bring it hasn't and won't. Let's still be honest about the realities involved in both the ransomware industry and the cryptocurrency industry before we claim easy answers.

Re: All because of crypto

Challenge: find a way to get £10M from someone who has it and is willing to pay it, into your hands without the police identifying you and you win £10M. Do you really think that, with an incentive like that, people will really just give up if the first one they used isn't working anymore? Can you really not conceive of a method that might work?

What if I give you an extra asset, one the largest ransomware organizations tend to have: if you have some people in Russia, the Russian police won't try to arrest you anyway. That means you can do things in Russia that wouldn't normally work in a different country, if any physical interaction is needed. I'm guessing you have some ideas that don't involve cryptocurrency. And they already have the software, so trying some new ones would be close to free. If it fails and their transaction is reversed, they can always try another method with the next company, or even call back the first company and try again.

NAT, ATM, decentralized search – and other outrageous opinions from the 1990s

Re: Year End Reminiscing

I'm not sure they're trying for high quality sound. I agree that it's not good enough for a lot of uses, but they are probably willing to forego the customers who need studio-quality sound. Those people, and I have at times been one of them, are really particular about their needs and may not be great at understanding when the network really is the limiting factor preventing it from happening. Meanwhile, there are a lot of people who, if they weren't using a videoconference, would be using a conference call over traditional phone lines. The sound on those is generally even worse, but people put up with it. These are the majority of users who will be easy to please with the basic audio and who will be using whatever cheap laptop microphone they have, which doesn't help improve the quality. If I choose to use more of my bandwidth on the audio, I can produce significant improvements without making a real dent in my available bandwidth, but most of the people I'm talking to wouldn't care that I had.

CEO arranged his own cybersecurity, with predictable results

Re: Unannounced security tests

This kind of response is exactly why tests at my company do not go to everyone at once. Someone refraining from clicking a link because someone else specifically told them not to is not good enough. If an attacker sends them, and only them, a message, then they still need to catch it and at least ask someone who knows what they're doing. Warnings on something you know to be a test are harmful.

"This implies that the best way to do phishing is by posing as a phishing test service."

There is a reason why I said that, to be reasonably sure, you would not just check that it looks like a phishing test service, but the one that previous tests have used. And why I said that to be completely certain, you would get explicit confirmation from the team that handles reports or sends out the messages. No, it does not imply that impersonating a test service is the best way to do phishing. Unless it can successfully impersonate your test provider, it won't pass my stated requirements, and if you know enough to check those requirements, you're not going to be filling it out anyway.

Re: Unannounced security tests

If the link they're clicking on is to a phishing test provider, the one your company contracts with, you can probably take a pretty good guess that it's a phishing test. If you're not sure, you can ask whoever sends them out, and if they tell you that it is one, then you know for certain. There are ways to know that other than being the sender. If you're trying to test vigilance, it can be useful to know who will click on something when there isn't someone shouting for them not to; a real attack will not necessarily go to the users who know what they're doing. Clicking on a link even when I'm looking over your shoulder and telling you it's a bad idea is a bad sign, but someone who avoids doing that is not necessarily good enough to avoid the real risks.

"our process for checking suspicious links that look plausible involves clicking them"

And almost certainly telling the attacker that this address exists and has someone who clicks on links, so send some more over there. Sure, it's a lot better than if they actually got what they wanted, and I'm assuming you clicked them on a machine that didn't have any credentials to try to steal, but does the risk of sending information to the attacker about the link clicked cause any concern?

Re: Unannounced security tests

If you know for certain that it is a test, then you also know that there isn't a risk to security if someone clicks on it. Not telling them means that the test is better, because it tells you what things would look like if they were the only or first person to get this message. They can't always count on you having received any phishing attempt before it is sent to them, so they need their own vigilance as well as listening to you. This is why phishing tests at my company are intermittent, so if one person gets a suspicious email and asks me whether I got one as well, I will usually say no completely honestly because I did not get this one. This requires them to either test the email on their own or enlist someone like me to help them do so, which is what we want them to be doing with suspicious mails anyway.

If you don't know that it is a test, tell everyone.

Re: Customers are the security liability

It wouldn't have happened automatically, but it would have been easy to open. I'm not sure about others' workflows, but I read the message before opening the attachments, mostly because there's a chance that the message will tell me that I don't need to bother with that file so opening it is a waste of time, but also to detect risks with the file. If others weren't doing that, suggesting that they might want to read the message first is not a bad plan.

Irony alert: Lawsuit alleging Chrome’s Incognito Mode isn’t will settle on unknown terms

Re: a new computer and trashing it

Why is it the default? Google wants data and will use the smallest of excuses to begin collecting it. The difficulty turning off location tracking makes this obvious; it's probably illegal, and that hasn't stopped them, so it's not surprising that they use any data the users enter. It also is necessary to use some of the features that Google provides and people tend to want if you ask them about it. For instance, you can't use Google's find a lost device or wipe it if it turns out to be stolen without having logged in. That doesn't bother me, but it is probably something users have come to expect. In general, though, they tend to expect that if the phone asks you to do something when you start it up, you have to do that thing, so they create an account and log in. Google doesn't see any reason to change this.

Re: I'm shocked!

I'm curious why people disagree with that? It's not too different from what Firefox says:

Private window: Firefox clears your search and browsing history when you close all private windows. This doesn’t make you anonymous.

Learn more

Of course, Google does a lot more nefarious stuff than Mozilla does, but their warning doesn't hide that incognito is a very basic thing that is limited to the local device. I don't mind that someone sued Google over collecting a bunch of data and tried to link it to their Chrome privacy record, which is pretty terrible, but the message they show does indicate that they haven't opted out of collecting data on their end and nor has anyone else.

Is it time for 6G already? Traffic analysis says yep

Re: Who's really driving the bandwidth demand?

Not only is there significant increase in demand from more people watching more video on their phones, but there are also more people using the networks for other devices as speeds increase. When my network went down, I still had to work and didn't want to go into the office, so I used my phone to tether my work computer. It worked pretty well. With a lot of people doing things like that, some of them will wonder about whether they need wired internet when they're already paying for this, so some people may shift even more traffic to those networks as they cancel expensive ISP contracts. I wouldn't want to do that, but with my usage, it would probably at least somewhat work. Bandwidth demand has been increasing for a long time over both wired and wireless connections. I'm not surprised to see projections that it will continue to do so.

Re: Pretty sure you can't change the laws of Physics...

The laws of physics don't change. That's why your radio receives one channel, just Morse code. After all, the first radio experiments worked that way, and the physics isn't any different today. The advantages are in our more efficient use of the laws of physics. Instead of using all frequencies, we limit to a smaller band. Instead of using analog data, we use digital data which can be more tightly packed. Some of the changes are redesigns like that, whereas others are simply improvements in manufacturing technology allowing transmitters to use less bandwidth while not getting prohibitively expensive. The laws of physics say such things as how much power your signal will have based on the distance and items between the receiver and transmitter, that is unless you use other physics hacks like finding a way to reflect it, but those laws say nothing about how low the power level can get before your receiver can no longer use it, let alone how many bits per second you can manage to shove in there. That's down to your tools, and those do change.

As for WiFi, you can have that. Lots of countries have some ISP who came up with this idea and has a public access method. Find which ones do that in your country, they probably exist, and sign up for an account. Congratulations, you have WiFi access from the house of anyone who has the same ISP and didn't change the settings on the supplied equipment. It doesn't work for people like me who buy my own equipment and configure it myself, but my neighbors have these, so you'll have coverage. That is you'll have coverage when you're near someone else's house, but I spend no effort making sure my WiFi coverage extends outside those walls very far. If you're in the street near a house, you'll probably have something, but if you're in a more open space, you won't. The same applies if you're moving between these access points. Most importantly, there are a lot of places without houses where you won't have any APs to connect to at all, and if you want the internet there, you'll need something that has better coverage than home WiFi.

Re: 5G speed not just affected by signal

I would guess that it's for tracking and billing because your provider will be responsible for charging you for billed usage and paying their partner network. Alternatively, it could be related to protection of your data so they can use networks you otherwise wouldn't trust, but I don't know whether their tunneling includes encryption or not. Both of these are guesses, though. I don't know if they are correct.

War of the workstations: How the lowest bidders shaped today's tech landscape

Re: Survival characteristics

"dictating correspondence to experienced secretaries and having it produced by a dedicated typing pool is almost always going to be quite a lot faster than writing it in something like Outlook or Word, for example."

This might be just because I'm young enough that typing pools were gone by the time I started working and dictation is done with a speech recognition program, but this doesn't seem true to me. If I dictate into a basic audio device, I can't edit anything without either verbal backspacing "Let's review this ... discuss this ... just use discuss this" or figuring out what I want to say and then reading out in one go. Either way is slower than just using the backspace key to erase the words until the document only contains the words I want. Part of it is probably that I can type quite quickly and the previous managers could not, but even so I'd imagine that they could figure it out without having to wait for their dictation to be sent to someone to type it up, a paper copy produced, them to review that, and it to be given to someone else to drive it further along. Which brings up the other speed advantages of computers which could, once a document was produced, transmit it to places faster than previous methods. I'm thinking of sending a ten-page document to ten people over one fax machine, for instance, versus sending an email to ten addresses and going back to some other work while the early network transmitted it.

Re: Correctness and Simplicity

If your comment was meant to explain what I missed, I still don't get it. Yes, one of the reasons people may have used the option the writer doesn't like could be that that one came first. Or that that one is cheaper. Or that that one was faster. Or that that one is better. Or something else entirely. Either way, it still boils down to the author complaining that people don't use the thing they wanted.

Here's an example. I don't much like Javascript because writing it is painful and it lacks a lot of stuff that a proper programming language would have, it's inefficient and calling into anything else is a mess of incompatible standards into which companies like Google want to cram everything. Unfortunately, it is the only feasible option for client-side web scripting, so we're stuck with it. The above two sentences are a better argument than that essay was because I at least told you what the system I don't like is and why, albeit in very little detail. The famous essay doesn't do either. Neither of the approaches refer to a real system with real complaints, but to theoretical systems with complaints that have been deliberately exaggerated. My two sentences are also a bad essay, because if I'm actually going to complain about web scripting, then I need to acknowledge the also ran, which would involve me explaining why Javascript is certainly a lot better than client-side Java was, and it beats Flash, and Silverlight is a word that nobody wanted to see in this sentence. In short, to admit why Javascript is where it is today. I think it is possible to create a better scripting language than JS, but that doing so is not justified because it is too popular for an alternative to be adopted, but I could specify what characteristics a replacement should have. An essay like that would make a point that others could debate. If I instead chose to make a fake language that could be JS or maybe not, then explained that everyone who was involved in it was sloppy and undisciplined, but that the good people couldn't succeed because the sloppy people got to market first, then I'm doing my own argument a disservice by ignoring reality in two different ways.

Cyber sleuths reveal how they infiltrate the biggest ransomware gangs

Re: Fascinating insights

Yes, absolutely. As a powerful ransomware operator, I have drawn the following conclusions from reading this which I will be conveying to all my staff:

1. They try to trick you.

2. They have some people who speak languages well so they can pretend to be from a place. Those people are actually from that place.

3. They try to know what they're talking about so they don't look incompetent.

As a result, I will be instructing those who look for new people to only accept incompetent people who sound like they're not from the place they say they are. We'll be victorious. All your data will be ours.

Unfortunately, the article had to leave so much out to avoid what you're worried about that it basically said nothing at all other than that the company named does this kind of thing.