Posts by BBRush

Marching orders delayed: Veterans' Digital ID off to a slow start

Re: What do they expect?

Paper can also be forged or lost/stolen in exactly the same way as [badly designed/implemented] digital IDs can.

Yes: If the main service goes down, then a digital ID can't be checked, but if a paper ID requires the checker to know what a fake looks like (instead of having a strong authentication method to verify the user) how reliable is that at identifying a person?

Let's be honest here, digital IDs are the future but their use is based on having a good set of use cases, a solid, SECURE design and a well implemented (and secure) delivery. In the case of the UK, I think that it needs also to have a really honest and persuasive way of communicating why it is a good idea. No one has done that last bit yet and the use cases all seem disjointed, isolated and badly communicated..

I'm also going to say that, with the current crop of main consultancies (Crapita, Fujitsu, etc) having a solid, secure design and implementation is likely going to be a challenge.

Probably not the best security in the world: Carlsberg wristbands spill visitor pics

Disclosure times

Having been on both sides of the disclosure coin, I can understand Carlsberg's point (that it takes time), but a 90 days (industry standard?) disclosure date _should_ be enough for something relatively straighforward.

What's not cool is the lack of response from Carlsberg. At the very least they should be acknowledging the mails sent and offering some sort of calming platitudes to make the slow response time slightly less bitter. Not replying, not being honest about the progress of a vulnerability is the quickest and easiest way to get zero-dayed. Oh look! Look what happened here!

Parachutists told to check software after jumper dangled from a plane

Re: Better mockup needed...

Current jumper here too (AFFi with but a mere 900 jumps) and the video shows pretty clearly (to me anyway) that the flap pulled the reserve pud down far enough to pull the reserve pin and trigger the reserve. Yes, they might have had a mockup, but I'd put money on the fact that it does not have a representation of the wing on it and so their ground-based trainign would not have picked this up. If they'd done the same jump on a Twin Otter, I don't think it would have been a problem because of the size of the door and the distance from the front to the trailing edge.

On similar incidents, I saw something nearly identical happen this summer whilst I was filming a 10-way speed formation competition. A jumper clipped the corner of the door in the exit hard enough to pop the reserve. Luckily the dive out meant that the pilot/freebag and reserve missed the stabiliser (and me) and they _just_ had a long ride down from altitude.

Sadly, the two other relatively recent incidents that have involved mass/balance going wrong have been very deadly (Umeå and Örebro) and have taken too many friends from the sport. Loading/seating should be a priority for jumping, but simple things like being aware of your equipment is up there as a personal prio.

Re: Software for parachute jumps ?

The pilot might well be running an iPad, but the manifest could have been using Burble or SkyWin for their manifesting. No idea what they were using for mass/balance ahead of loading.

Aisuru botnet turns Q3 into a terabit-scale stress test for the entire internet

Re: Stupid question

I don't think anyone is trying to DDoS them. They just have the most hooks into DDoS protection (via their customers and *cough* people hosting skit behind them), so it is easy for them to report on large botnets like this.

I would be shocked if Akamai is not saying the same thing somewhere (because they have a similar level of insight into network traffic).

Re: Stupid question

I'd say that could well be part of it (for some countries/actors), but if this is available for just a few dollars (and large botnets are), then the market is really anyone that will pay.

You can DDoS a website, then threaten them that you will do it again unless they pay. Some people will pay, so as long as you earn more in ransom than the subscription, it's a 'W'.Once you know people will pay and you are in profit, put that cash back into the system and keep on rolling.

As an absolut lowest case, an aggreived kid with pocket money to hand can use it to DoS a game server that's banned them for cheating, or a school that has given them bad grades.

Cabling survived dungeons and fish factories, until a lazy user took the network down

Re: What is it with managers and training costs?

Had something similar to that once before when I handed my notice in at a job.

Boss (massive bully) called me in and told me that he was putting me on gardening leave for the rest of my notice period (yay!) and taking some of my accrued holiday for my attendance at a mandatory course a few months previous (WTF??). A course that had been free, on-site and which he had insisted that we (the team) must come in early and stay late on the training days so that we could clear off the work we would be missing because of the course.

HR was in the meeting and looked embarassed. I found out he got sacked a few months after I left.

VMware isn’t budging in its pursuit of Siemens for alleged unpaid licenses

Re: so june 2027

If the practice is not illegal and fulfills the US parent company's primary requirement to drive shareholder value, then that is what they will do, right?

Ex-CISA officials, CISOs dispel 'hacklore,' spread cybersecurity truths

Re: Is this really the priority?

Also not forgetting that a lot of the QR code phishing came through otherwise well configured mail servers without a problem because it was "just" an image file. Users then took out their mobiles and scanned the QR code away from all the protections of the managed corporate devices.

So they can be a legit source of effective phishing, more so than a link or a pdf with a link.

Back to the article, I kind of agree with what they are trying to do, but at the same time, personal IT security is a mindset and small things can be important attack vectors if your role changes or you go to a part of the world that has a different set of surveillance goals.

Microsoft is building datacenter superclusters that span continents

Re: a big FU to the GDPR, right?

Which, sadly, appears to be the case with the larger providers.

If your margins are more than that and you know that you're rarely (if ever) going to get fined the full 4% and, even then, not for several years of appeals and reductions for actually paying, it makes perfect sense for a company that is legally obliged to put shareholder interests first.

Cisco creating new security model using 30 years of data describing cyber-dramas and saves

Open Source?

Wow, kind of impressed with that and may actually get me to have a deeper look at it.

Again, I have to state that I do not believe that LLMs are ready for the big time wrt, well, doing almost anything, but a specifically trained model such as this that can give advice on potential solutions is a better assistant than something like ChatGPT (IMHO).

Boffins: cloud computing's on-demand biz model is failing us

Re: Remember

"It was the main selling point of the cloud - you can add resources quickly in the event of surge of traffic and scale down when you don't need it."

The harsh reality is that the science is not a key market for the larger providers and, as such, it is niche and expensive, meaning the cloud provider will charge way more for this kind of flexibility, assuming they make it easy for the research team to even scale down to 0 or scale up to 11 when needed.

Cloud computing is market driven and exists for the masses, their generic workloads and the profits they make for the business, not the small, specific, low margin/cheap use cases.

Ex-CISA head thinks AI might fix code so fast we won't need security teams

Does not really solve the problem for companies...

I could see this approach working if everyone ran everything in the cloud and build pipelines could update continuously with fixes as the AI DAST/SAST tooling found vulnerabilties and fixed them,

BUTT...

This does not fix the problem with operating systems being vulnerable to things (as they are not 'cloud') nor will it help with locally deployed apps (unless there is near constant updating of the apps), nor will it help with testing compatibility for clients that consume the updates, or the changing user experience.

I'm torn here between marvelling at the vision of people that think AI can save the world (even when it seems like the use cases are scraping the bottom of the barrel with a plan to throw it against the wall and see what sticks) and the shot-sightedness of the same people's understanding of how normal enterprise IT works.

Former UK prime minister Sunak becomes human Clippy for Microsoft, Anthropic

Genius!

"Known for creating systems that defy logic and often require a forced restart, Sunak will continue to serve as an MP on the Conservative backbenches."

And yes, I now need to go find paper towels to clear tea off my keyboard.

Have a beer for that one!

Ex-NASA chief: China likely to land humans on Moon before Uncle Sam does again

Re: And?

The purpose is to have a permananet presence on the moon and 'control' it for the purposes of further expansion in the Solar System.

I doubt that the US will be going up there for the good of humanity (well, not in the current climate), but I doubt even less that China would.

BOFH: The auditor is asking too many questions. We have just the laptop for that

There is only one way... ->

Europe slams online tat bazaar AliExpress for dodging obligation to stop dodgy traders

New? Hell no! It's been in use for years!

Defense Department signs OpenAI for $200 million 'frontier AI' pilot project

Asimov's laws

Why in the hell are these companies not explicitly tying in Asimov's laws to AI systems now?

Oh, that's right, profit...

Automatic UK-to-US English converter produced amazing mistakes by the vanload

Re: Whoops

The "Trousers - Pants - Shorts" debate is the one that keeps giving for me. Trying to explain that, or at least the differences between British English and US English versions of them, to Swedes is always fun.

UK Ministry of Defence is spending less with US biz, and more with Europeans

Re: The GCAP is (currently) a British/Italian/Japanese project.

I do not entirely agree.

I think making the military responsible is a good thing, but the revolving door between MoD/Armed Forces and the arms companies needs to be stamped on hard. If you have responsibility for making decisions on kit, it should be for the benefit of the people using it, not for your personal gain in fiuve years when you don't come off your next list and fancy supplementing your pension with some private sector work.

Other than that, yes. Kit takes far too long to develop, costs faaaar too much and frequently is not fit for the purpose that it was designed, specced or bought for.

After that 2024 Windows fiasco, CrowdStrike has a plan – job cuts, leaning on AI

Re: Great idea

But they have such cool free t-shirts! I for one will miss the ability to avoid another day of laundry if they fold.

M&S takes systems offline as 'cyber incident' lingers

Re: British Library - comms good, actions bad

It could also be a question of how the organisaiton is perceived in the market and whether this could affect their position within it. Commercial entities may not want competitiors, investors or shareholders getting the unfettered/honest updates, whereas a public body may have more ability to be honest over and above the required disclosures.

Sharing IOCs and post incident reports, even redacted, to allow others in a market sector to protect themselves could be seen as nearly heresy in the commercial world.

Trump kills clearances for infosec's SentinelOne, ex-CISA boss Chris Krebs

Re: How pathetic can you get ?

FAKE GNUS!!!

He's also saving the US from the tyrany of lefty-woke showers:

https://www.whitehouse.gov/fact-sheets/2025/04/fact-sheet-president-donald-j-trump-makes-americas-showers-great-again/

Where's the slow handclap emoji?

System builders say server prices set to spike as Trump plays customs cowboy

Re: muppet show

He failed to make money running a casino ffs. IN VEGAS.

That alone should tell you all you need to know about his business acument.

Musk's xAI swallows Musk's X in ego-friendly, all-stock deal

And absolutely not financial chicanery to inflate the value of something. No. No way would that happen.

Governments can't seem to stop asking for secret backdoors

Re: Gibson already predicted the outcome: Columbian Data Havens

Upvote (and a beer) for the Snowcrash reference

Wanted. Top infosec pros willing to defend Britain on shabby salaries

Re: I wish their managers the best of luck

Not a .gov story, but related to a US software company...

Similar to London salary weighting, the only way the company could attract people from the bigger (and sexier) Silicon Valley companies was with money. Sadly HR made the banding inflexible, so people had to be hired at senior levels to get a salary that could let the hiring manager compete with the likes of Adobe, Amazon, etc. New grads were getting hired in California as "Senior..." tech grades and poisoning the whole system in other locations (around the US and worldwide) with their lack of experience.

Back on topic though, governments the world over need to learn that they are not going to attract the best talent with their salaries. They might attract the ones that want to work for them, but that's not necessarily the best talent and is certainly not the right way to retain them long term.

NASA's Astrobees need a new buzz – any ideas for the space-dwelling bots?

3D Pong tournament. Best of 501, winner gets bragging rights for the first robot to win a ball game in Spaaaaaaaaace

Chinese national cuffed on charges of running 'likely the world's largest botnet ever'

Wang cuffed, shirley?

Raspberry Pi Pico cracks BitLocker in under a minute

Re: Hurt Locker

I'll wait for the sports version: Gym Locker

UK PM promises faster justice for Post Office Horizon victims

Re: No Justice

That is the way of modern corporate culture; I doubt that even those proved to be complicit will face a hint of justice. You only have to read Private Eye's extensive coverage of this travesty to see the way this is going.

US House boots TikTok from government phones

Re: Again I ask...

People who want engagement with younger voters in that pesky 18-24 year old bracket. And upcoming voters.

"Look at us, we are so hip and trendy", etc.

Chinese auto-maker accused of altering data after fatal autonomous car accident

Re: Conspiracy

Cynical... I mean, for a start, you'd need a way to remotely disable the airbags, steering and brakes and there is no way we'd ever let those be controlled by something linked to a remote source.

Rental electric scooters to clutter UK street scenes after Department of Transport gives year-long trial the thumbs-up

Re: Trials?

The thing is, that is their main value add over, say, a Boris Bike.

You find one near where you are (after a bunch of them have been seeded at areas of high use), rent it and then un-rent it when you get to where you are going. If you have to leave it somewhere central, then that will defeat the purpose of it.

Yes, they are a massive pain in the arse and people drive them like morons. Yes, people do not abide by the usage agreement, not by traffic rules either and yes, as a cyclist, I hate them with a passion. Here (Stockholm) they are also way more expensive than taking the subway or a bus. BUT... You can find them everywhere and take them most places you want to go.

The problem, with most things, is people. They are the idiots that leave them everywhere and cause an issue. I do hope though, that the trial in this case will ensure that a hire includes liability insurance. If a helmet and a driving license is mandatory, it should also mean that enforcement of things is a lot easier: No helmet == ticket and points.

FBI extends voting security push, LA court hacker goes down, and more D-Link failures

Remember Fight Club? IT companies can do this because the sums involved are small. How much is a consumer router? €100? €250 max? A car is €x0,000 and has a service life of many, may years whereas a router? Five tops before it will be replaced. Even Apple puts handsets into obsolescence after four years.

I can't even remember what router I had 10 years ago, I certainly would not be still using it.

Orford Ness: Military secrets and unique wildlife on the remote Suffolk coast

Good article!

As a Suffolk native until a few years ago, I approve of this and recommend Orford Ness to anyone making the journey east. It can be a bit barren in later months, but that part of the coast is really quite stunning.

While in Orford, do make time to go to the smokery there. Their smoked eels are epic.

No guns or lockpicks needed to nick modern cars if they're fitted with hackable 'smart' alarms

Re: Zombie cars

Simple solution to this: Make ever car permanently convertible. If someone does hack your car, simply climb out and let it go on its merry way.