Posts by ttlanhil

To save paper, mainframe tech ruined a week of work

Re: Inconceivable

Worse yet when you only want black ink, but it refuses until you replace the colour cartridge...

BOFH: Smells like team spirit

Re: Old Electricians

You're reminding me of the character Nitro from the movie Down Periscope, although he did reboot due to electricity sometimes

Scientists find planet made on new matter recipe, and it formed after a Red Giant ate a solar system

Re: "crushing them with massive gravity"

I agree that sounds wrong - A few guesses for what maybe it was meant to mean...

Firstly, while the net force of gravity is the same, it's more spread out, so maybe some shear forces come into play?

No crush, but maybe there's a shred.

Alternatively, if a planet's orbit is within the new bounds of the stellar atmosphere, collisions will start to slow the orbit of the planet and it will spiral in.

It's already well roasted before that, and I'd guess torn apart as it gets absorbed by the star - but maybe whatever isn't torn to plasma could descend and be crushed (I'd guess more by density than gravity)

OpenAI agents ‘infiltrated Australian government website’

Re: So, is it legal to hack with an AI

No, of course it isn't.

It's legal to break the law if you're rich/powerful/connected enough that you won't be prosecuted.

That part isn't a new problem, it's just the LLMs part that's new

Re: Plenty of blame to go around

Correction - they're not doing anything a huge number of humans with large data farms and no morals (and no chance of being caught) couldn't have done

Because of the scale, this is more equivalent to a rogue nation state than what a single human could feasibly do

BOFH: Oh no! The CMS ate 500 pages of corporate documentation

Once upon a time, they'd leverage their synergies - but that's old-hat now

‘Global reckoning’ is coming for big tech, says Australian minister

Re: however

"Buy our bread, it doesn't have sawdust in it!"

While presumably true, in some countries that can get you in trouble since you're implying your competitors do put sawdust in their bread - why else would you say it?

And PR folks (including politicians) have been saying things that aren't strictly false without giving you an honest view of matters for years

Techie sent to fix Nobel Prize winner’s PC almost set it on fire

Special printer port?

Maybe that smoke-powered port was actually intended for a special type of printer; the one that "lp0 on fire" messages refer to?

Re: "found no reason to suspect it was broken"

Not all users are like that - some will stop and call you because shapes are confusing

Time lords prepare to kick leap seconds into the next millennium

That would present guarantees about it being tested... But that's also a little unfair.

The "move fast and break things" crowd is relatively new. Plus going back in time is the opposite of fast.

OSes have had clocks that assume time is monotonic (i.e. can only go forward) for a long time.

A negative leap second would break that assumption, allowing us to finish a calculation before it's started (with appropriately perverse definitions and consequences).

Batch file automated a clean-up job, then fouled itself by deleting the wrong directory

That's how we got the likes of docker

Re: That was OK

No, you misunderstand, he got it operating again (I couldn't bring myself to say fixed it, or got it working again)

Ancient ‘Who owns Linux?’ case now has one foot very deep in the grave

You could put caps on it to limit it to reasonable levels - if you as an individual are spending $10k on your case, and losing means you pay another $10k? That might work.

Won't cover the legal fees of a large company you sue, but if you're suing another normal citizen (not a large corp or a millionaire) that's some reassurance to them that they can afford to tell you to stick it

The what, why, and how of pull requests and source comments

> but spaces now make more sense "because it always works and it's always consistent."

If you think spaces for indentation is consistent, that means one of two things:

1) you're not comparing against tabs for indentation, you're mixing tabs and spaces (which is *always* stupid - you get the downsides of both), or

2) you think your indent size is appropriate for everyone else's screen, font size, eyes, etc...

Tabs are more consistent - one tab is one indent level.

Not the 1 vs 2 vs 3 vs 4 vs 8 spaces per indent level some people use (I've seen all of those).

I use 4 spaces because that's most common, so it's what my editor is set to.

Consistency and standardisation is one of the most important things.

Except if I have to edit a Makefile, of course

Five years after quitting a job, developer's former boss asked for rapid tech support

Re: Well done

Why would you ever trust any system? Safer if you're always cautiously concerned

Re: Well done

Anyone who's done IT support knows anything electrical belongs to the IT team - at least if it's not working the way the luser wants

Support newbie figured out how to avoid all-nighters, and his colleagues hated him for it

Re: Bad data coming in

Sometimes...

But often they value your privacy, meaning they only share your personal data with people they have a business relationship with - getting value out of you.

Providing it to random other customers doesn't let them exploit your data so much

Re: Bad data coming in

Or data sprinkler, when it shares your personal information with any random advertiser the company has talked to...

Tech support scam caused massive data breach at Australian airline Qantas

https://letmegooglethat.com/?q=PII

personally identifiable information

It's a common enough term that many will already know what it means, and anyone else will find out with a quick search

Re: Hmm

Ok, which part?

That security is hard?

Or that Qantas isn't big enough to be able to do a thorough code audit of all of the code from Salesforce, Microsoft, Google, and anyone else whose software they use?

Re: Hmm

Maybe, yes, and no. In that order.

First the yes:

Part of the justification was that they had proper role-based access, people could only access the information they were meant to, so they have obviously heard of minimum privilege.

And applied it well enough that inspectors accepted they had taken reasonable steps.

Second, the maybe:

I'm not sure of the CRM in question, but a quick googling suggests Qantas' main CRM is from Salesforce. I'll assume that it's the one in question here, but that may be wrong.

Salesforce is a big enough player that they have some trust.

So if the ability to exfiltrate was due to a bug on Salesforce's side - liability should lie with them.

If it's a configuration issue, then maybe Qantas, maybe Salesforce. Depending on defaults and documentation. Unless they had Salesforce consultants set it up for them, in which case blame is still on Salesforce' side.

It's reasonable to assume that Salesforce should have a secure system, just like you need to trust Microsoft, AWS, Cloudstrike, Visa, whoever else.

Yes, you still need to do risk analysis on it. But there comes a point where you have to trust someone - you can't have every company in the world auditing the source for every bit of software they use, it's just not viable.

Finally, the no:

The person giving the verdict may well be a paper pusher, relying on others to delve into technical details, but they've applied the law as it stands and done a thorough analysis. Read the actual report if you haven't yet, it's linked in the article.

Now, do you disagree with the findings? That's reasonable if you can make a solid argument.

Should we punish anyone with a data breach even if they did everything right on their side - or at least did everything that the laws require and government recommendations on cybersecurty say (essential eight for now, although that's being reviewed)? That won't work well in the long term.

Re: Hmm

Unfortunately, security while maintaining functionality is hard.

There aren't really a large number of options for CRMs for big players - who has the time and technical capability to audit it all?

Qantas is big enough that they should be able to audit stuff, but also big enough that the amount of functionality they want is large (and hence there's more to audit)

It sounds like Qantas have complied with the legal obligations, and probably have a reasonably well locked down system and training program (people will always fail eventually)

It sounds like the attacker knew how to walk someone through a few steps in Qantas' CRM that allowed external access... The CRM probably shouldn't have allowed that, but the phishing using their own CRM means the employee probably didn't do anything "wrong"

As for moving it from a SaaS tool to internal? That's no quick task for a major system - 12 months isn't enough for planning or testing (let alone development - assuming you can hire enough developers and testers and security experts) if you want it done right; your suggestion would almost certainly reduce security

There are issues with Qantas for sure, but in this case they seem to have followed best practices as far as they reasonably can, and better than most companies (how many can say "we schedule deletion of data we no longer have permission to hold, and none of that data remained in our system at the time"?)

KDE Plasma users face a dire omen of change: 6.6.6 arrives

Re: "Book of Revelations, the Oxyrhynchus Papyri, page 115 says that the number is 616"

Well, Australia hires some UK police, so summoning one back occasionally doesn't seem too unreasonable

GitHub cuts short offer to burn repos on CD after mockery ensues

Re: Ah, Sony

Nah. If you don't have a copy on a computer you control _you_ may lose access, but someone else probably has a copy somewhere (maybe in the training data for an LLM)

Hackers shoveled snow for company, were rewarded with network admin access

Re: Old Advice

Depends where you are (type of industry) - in a lot of places, actual paper for the Official Paperwork is more believable for someone inspecting things

If they don't like that, there are things many of them will dislike even more!

In one of Deviant Ollam's stories of pentesting, one of the times he got rumbled after hours was because one of the workers saw his car on the weekend (driving past, not at work) and went to check it out.

The workers all knew each other (so claiming to be from another site didn't work) and cared about the company - because they'd been there years/decades, because there was a good culture and management looked after staff

Security boss thought MFA would be too much security

Re: Regarding "yelling"

Those are times when it's appropriate to yell TO someone, but not AT them

How dare you stop data loss – that's not your job!

Re: Same kind of experience

For quick daily backups of everything, drag all of the desktop shortcut icons to an external disk (the icon is the part you interact with, so that should include everything, right?)

A crashed system is harder to break into (mostly)

Users claimed they'd never seen a spell checker and panicked at the sight of red squiggles

Sometimes that's a lack of knowledge, but sometimes it's a distrust of computers

You only need to find out that 2+3=MAY once to get concerned (or worse yet, if 2+3=JUNE)

Re: older generations

> Where UI designers, in order to justify their employment, change the UI in every edition...

Oh, if only it were that simple, we might fix it!

No, you missed a bit - where not only was there research on UIs, but there was also training for UI designers. Plus UI was its own field (as opposed to getting the front-end developer to do it)

As for UI changes as justification - that's at a company level, not just individuals - how will the customer know we spent heaps of time building this new version that they should spend more money on, unless it looks different?

They won't notice half as many crashes, but they will notice a ribbon menu!

Re: Sometimes these things are downright unhelpful

Alternating green bars need to be delivered by tractor

Re: Sometimes these things are downright unhelpful

Things that you wrote yourself can be the hardest to review, particularly if it's without delay (rereading the following day may help)

spool chequers and similar are useful tools, as long as you remember that they're just tools

Re: Simple fix

No, but IT could pre-format the blank forms before they get collected and filled in

Or, really - anyone who realises that it's the wrong approach can probably figure out the formatting for you

Re: "this is just how MS Word works"

Ahh, the joys of "English (simplified)" when you want "English (traditional)"

Firefox 152 understands 'Sssh!'

Re: Um...

> > how do you not also accidentally hit the wrong tab close button?

> I do. Hundreds of times. This is why I prefer keyboard control to mouse, and why I keep banging on about standards-based keyboard UI.

Firefox has keyboard controls - new tab, select address bar, paste, back in history, close tab, cycle to next/prev tab - can all be done without mouse - so if you struggle to use a mouse, why keep doing it?

Leave it to the side and just use the keyboard, if that's better for you

There's nothing you need to use a mouse for around the tab bar area if you don't want to, or are unable to use a mouse with precision

Touch interface has inherent imprecision, and needs more spacing, but that's a different kettle of fish

> > The audio playing/muted/waiting to start icons don't take much space

> Which is a problem, because they leave less space on the already very small click target of a tab.

It's not a small target for me, but maybe that's usage because I don't have a lot of tabs open most of the time (I'll bookmark if I want to save for later, or use another window if I want to run through a list of things)

But even then, minimum tab size if I shrink the window right now is favicon, a couple of letters from title, and a close tab button

If I want to select, mute, or close - those are all about the same size clickable areas

What do you actually want? tabs and buttons so large that you can't misclick them? If you're struggling with that, it's not a tiny audio icon that's the problem

> > (no UI clutter on a desktop screen) - and they're more visible that knowing a magical phrase for the address bar.

> Controls that only appear when they are needed, i.e. when there's something for them to do, are better for skilled users, and that is the core market for Firefox: it is the web browser for power users.

An icon that shows "this is the tab that's playing audio" is sensible - tabs playing audio should be a rare event (rare that you'd want more than 1 tab, very rare you'd want more than 2)

And since it only shows when there's audio playing, and you can click that to mute - that's the *definition* of only appearing when needed and there's something to do!

More broadly, UI should be intuitive and discoverable.

Audio plays? an icon shows up. Click the icon? audio is muted. Easily discoverable, and I'd say intuitive (or at least a common pattern - as I said, KDE's menu bar does exactly the same).

Typing something other than an address or search term into the address bar? Not very discoverable unless you know already. Not intuitive unless you're already hooked on siri/chatgpt/some other nonsense

And I say that as someone who learnt to use the kio protocol addresses in konqueror and other KDE apps - that's a power user feature, muting audio should not be!

Re: Um...

> Yes, I know. I regularly hit it by mistake and wonder why the radio went quiet. I could happily lose that button.

If you clicked and the radio turned off, it should be pretty obvious, so you shouldn't be wondering long - and if you're having trouble accidentally clicking a tab mute button, how do you not also accidentally hit the wrong tab close button?

Also, how often do you have multiple tabs playing audio?

For me that's mostly if I opened a few youtube links and visited those tabs (as until you open that tab it pauses waiting) - if I want to stop audio in something, I usually want to go to that tab to pause the video as well.

I'll acknowledge that sometimes ads play sound in random tabs if you don't have good blocking, but other than that, is it common?

The audio playing/muted/waiting to start icons don't take much space (no UI clutter on a desktop screen) - and they're more visible that knowing a magical phrase for the address bar.

And if I've muted a tab, I usually want to know which one it is - either because it's something I want to restart later, or it was unwanted and something is misbehaving on that site.

Not identifying which tab/site it was isn't necessarily a feature

Sure, maybe a mute-all is useful sometimes, but it's something I need less once a year (KDE's task bar has playing/mute icons for each window - so I've used something equivalent but faster than typing in the address bar).

KDE Plasma 6.7 brings the X11 era to a close

Re: Oxygene and Air are back!

> use Wayland and it works just fine

wayland nowadays mostly works pretty well, but it's a bit short of "just fine"

As far as I'm aware there's no way to dock thunderbird into the systray (in x11, you could use kdocker), and I think we're still waiting for ability to script sending input to a window with any sort of standard tooling (i.e. don't need to download from non-distro sites). But I haven't checked for a little while, so maybe they finally addressed those?

I realise there were some security minded reasons for why they locked some stuff down - but anything that was sending input to other windows could presumably also be executing arbitrary other commands so it's not much help

I'm sure there are other issues as well, those are my pain points that come to mind (until very recently, I was also getting memory leaks which seem to happen a while after suspend/resume)

The Y2K bug is back! Dutch dev digs up untimely flaw in old BSD build

Re: 2.11BSD

SHAR - there's a name I haven't seen in a while...

From back when it wasn't such a security concern for your file transfers to be done as live code

This is your BIOS speaking. Please fix me. Your PC is broken

Obviously not often - the company paying for tech support didn't pay for repeats!

Re: Anyone else remember

And full games, that were first of three in a series (so you sent away money to play the sequels)

All the passwords were stored in Active Directory description fields

Re: Read the fricken manual

Money?

active is the opposite of PASV

dynamic is the opposite of static

As someone who's tried to store data through patterns of rubbing balloons on jumpers - static is not reliable

'Please do not vibe f--- up this software': Broken backups spark AI coding row in rsync project

> the algorithms themselves are inherently non-deterministic.

> or, more realistically in practice, use them to seed a good (deterministic) PRNG

The second time you got it correct - algorithms are deterministic.

If you know which algorithm it is, what seed was used, and how many samples have already been taken, you can predict the next sample because it's deterministic (unless there're additional inputs being used at generation time - in which case you'd need to know them as well)

They're based on random sampling. PRNGs (psuedo-random number generators) tend to be deterministic given the same seed.

You need special hardware to get strong or true randomness, it's not in software

Under-trained techie didn't claim overtime for mistakenly failing to phone it in

Re: A Demonstration Everyone who is going to plug anything into a LAN.

> † I regret I never asked him how exactly did one ork a cow. An innate talent I suppose.

I believe you have to provide them with 40k tiny warhammers, plus some green paint

Marketing demanded IT add website feature that was already working

Re: If I don't understand, it can't be important

Depends how they announce it

"We've added apple pay as a payment method. If you load our site on an iPhone or iPad from today, you'll be able to see the option to use Apple Pay"

Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’

Re: So many good things in this article

> Also, he appears to be going a bit soft, with age. Where is the volcanic outrage ?

Linus' rants are mostly limited to people who do the same stupid thing over and over and ignore being told no.

His rants have gotten headlines often, but when you read past the headline, it's usually something like "on date, you were told this was wrong because of reason X. Then on date you tried again, and were again told that it was wrong because of reason X. Now you're trying a third time to do something that's wrong even though it's been explained multiple times? what's wrong with you?"

You generally need to have a track record that Linus himself is aware of - and imagine how many people he interacts with (occasionally it's a rant about how stupid the design from a certain company is - that's a different kettle of fish)

No, Linus is correct

If it's a security bug found by generally available LLMs - that can be assumed to be public knowledge

Hence there's no need for a private list - it's presumed public, so public lists are fine

You could /maybe/ have a generic LLM bug report list, but there's not really much benefit - just ensure anyone submitting the bug report properly documents and checks it's a new report and it's all good

There is one exception - not generally accessible LLMs. New models that do different security analysis, etc., before they're public

But those are uncommon and run by people who can coordinate a unified set of reports that don't result in overlap - they can be handled like any other security specialist company

Backup script ingested an accidental asterisk and deleted everything

Re: Who me? 1988

Only a big plus when it's mounted

When it's being moved around, it's a multiplication

And yeah - capital punishment can put the fear into other people, but it's a bit all-or-nothing and you don't have much scope to escalate from there (next step is decimation?)