Posts by Guy de Loimbard

Meet your new colleague – the ML Admin, who tames LLMs so they're ready to rock

Anyone else

Bored of the continually re-hyping of AI/ML LLMs etc?

I had nearly got through this week without seeing some shite about ML being awesome too!

Culture comes first in cybersecurity. That puts cybersecurity on the front line in the culture wars

Re: Cloud Act?

Good point.

How long it would take sovereign states, or the European Collective to create alternatives to the major cloud providers, remains to be seen.

If the collective puts itself to work, it has shown its capability at being successful a number of times.

One can but hope, there is a change, one that benefits everyone who wants to use Cloud based thingys.

Open source text editor poisoned with malware to target Uyghur users

Re: @Guy de Loimbard - What is it

If you're going to be A/C, then I'm not playing :)

What is it

with authoritarian regimes and the need to persecute minorities?

There's an awful lot of similarity to these TTPs and a number of other historical persecutions of minorities.

Makes my blood boil that this still goes on in this day and age!

We’re calling it now: Agentic AI will win RSAC buzzword Bingo

Re: Just a minute there

On the point and as eloquent as ever Pascal.

I fear we will keep seeing iterations of how "AI" is going to help us do something for a while.

At least until we all get so bored of the AI rhetoric and mantra, that neither you or I even bother to respond to these repetitive, but variation on a theme AI based nonsense representations that continually attempt to convince us this is the new world order!

Re: Hmmmm? Is that new and really different from a old slick trick?

"These agents are designed to learn and improve over time, serving as intelligent assistants....."

At what cost?

Also, isn't that pretty much the definition of a human agent? Designed to learn and improve over time?

FFS.... Where else can you jam "AI" into to try and sell your vaporware?

Fujitsu promised to sit out UK deals ... then Northern Ireland called with £125M

Totally trustworthy and....

Keep to their promises .... "In January last year, Fujitsu wrote to the UK government to confirm it would no longer tender for business in the public sector "

So they actually wrote to the government? Perhaps we should bring said letter out of archive and wave it around a bit to remind them of what they said.

I'm all for letting the past be the past, but Fujitsu were complicit in the mass wrongful convictions of hundreds of people.

They should not be allowed anywhere near UK PLC's infrastructure for at least 25 years!

Rant over!!

America's cyber defenses are being dismantled from the inside

Surely

We're all missing a trick here?

Surely the great orange man baby knows what he's doing, yes?

It really can't be that the orange buffoon, plus all his sycophantic cronies are all imbeciles? Surely?

In wake of Horizon scandal, forensics prof says digital evidence is a minefield

Re: It's not just a data integrity issue.

100% - The Concept of any entity being able to act as judge, jury and executioner in this day and age should be outlawed.

Shocking level of autonomy that isn't allowed anywhere else I can think of.

Thorough legal review

Has been required for a while.

Anything that can clarify how to validate digital forensic evidence, particularly for use in Court proceedings, will be a huge step forward.

If we can define a set of rules to define integrity of evidence, or at least some sort of playbook for this field, it will go a long way to presenting solid evidence in court.

Of course, the vary nature of technological complexities, will not make this an easy thing to achieve, but the fact it's being looked at is a step in the right direction.

EU gives staff 'burner phones, laptops' for US visits

Good drills for security

It's a shame that a country once seen as an ally, has descended to this level of distrust between it and it's allies and in the reverse, its allies no longer have trust in them.

Many moons ago, when young and able bodied, I travelled to all sorts of places to consult, you always knew you were liable to tapping and intercept in certain countries, it just became part of the SOPs to limit confidential conversations, topics and data to your home base.

If you're on the move and mobile, expect your cellular and internet traffic to be monitored and recorded by someone.

Expect no privacy and you'll not be disappointed!

UK officials insist 'murder prediction tool' algorithms purely abstract

Minority Report

That is all!! :)

'Copilot will remember key details about you' for a 'catered to you' experience

We asked....if this would be an opt-in feature

And M$ declined to answer that directly, which directly answers the question.

You'll be getting CoPilot, whether you want it or not.

You know it will be included as a sub feature in a critical patch or update.

Run for the hills, the shite AI is coming and is not going to be your companion, just a spy and scraper of content to please the hive mind!

Oracle says its cloud was in fact compromised

Only 14 days from

The start of full on denial, to "Well something may have happened to some customers" BS party line.

As David123 says, grab the popcorn, this is going to be good.

Specsavers takes off the Oracle glasses, sees better ERP options

If these internationally operating businesses are looking for solutions, please please please don't listen to the sales team from any of these large vendors, they really don't care about your business, only what they can get from you.

I'm also intrigued, if Specsavers are using an associate/partner/franchise type model, seems there's not going to be a universal one vendor solution to these myriad options.

If you want a laugh, why don't you also invite Fujitsu into the mix?

UK threatens £100K-a-day fines under new cyber bill

Re: Hah! -- More "We Are Doing Something" Misdirection Emitted From SW1

You echo the thoughts I was having as I read the article.

Rules are one thing, who is going to enforce?

You need to invest in the regulatory bodies as well as just generating legislation, which half the time, is only for headlines and sound bites.

I welcome anything that will improve security posture and reduce the likelihood of cyber incidents.

You will still need a regulator that has teeth, will enforce the rules and will send the "inspectors" in to check the state of play, which to date, is something we're missing in the UK.

Cardiff's children's chief confirms data leak 2 months after cyber risk was 'escalated'

Re: Unaccepatble

All valid points Tiggity, until you add into the mix the usual lack of decent IT Security skills that I've seen within most councils nationally in the UK.

Quite often it's yet another area that won't be invested in, much like road infrastructure.

You know that generative AI browser assistant extension is probably beaming everything to the cloud, right?

Most end users are clueless to what they are enabling.

All Terms and Conditions are TLDR for all users, everyone knows it including the ne'er do wells that write these 13 pages of BS terms that are hard to understand, even for the author.

Also, dressing up extensions to sound like they belong to something else, is yet another classic TTP for shite bags to harvest data from you.

The mind boggles.

UK wants dirt on data brokers before criminals get there first

Be good if we could remove

Such Data Brokers in their entirety.

Too much data, minimal controls, race to the bottom in the pursuit of profit.

We share way too much as it is and in the case of phones and home based "smart" devices, which we're all paying for, you get to be mined for data that can be sold to these data broker buffoons.

Not sure who we're supposed to kick off with as we're all culpable here, mainly for letting it happen because we agree to some TLDR terms and conditions.

Claw back control, I suspect is the best course of action, but we're way past the event horizon I suspect.

Don't want Copilot app on your Windows 11 machine? Install this official update

Remember the days when you

Could actually select the updates you wanted, were relevant and essential?

I know this goes back a while, but I used to take some time to look at the patches and updates, read what was being addressed, fixed or improved, then taking my time and selecting the correct ones for my environment.

It now seems all vendors just provide an update that will either break your kit, or not, or add features you don't want, just to keep the vendor amused and making money.

Right, I'll stop reminiscing about the simpler days when the PC was nascent and your options were plenty.

This is the FBI, open up. China's Volt Typhoon is on your network

Re: I am deeply impressed.

I second your view!

I think it should make a good poster boy/case study for how to deal with this sort of issue, from beginning to end.

Re: Nice article!

Indeed, a good article.

Also, you couldn't make up some of the catastrophic choices being made in the US at the moment.

It's almost like opening the doors and leaving the lights on when you go on holiday.

At a time of heightened cyber activity, you don't slash and burn your capabilities.... surely?

Microsoft: So what if it costs 4X as much to run Windows Server in AWS, Alibaba, and Google?

riding roughshod over Microsoft's intellectual property rights

How exactly is IP being riding over roughshod?

MS want to drive people to Azure so they can make even more money.

It's not hard to see it for what it is.

The challenge you now have is that the organisations are so large internationally, that they don't really care about any Anti Trust CMA type actions as they can just pay the "Fine" or spend years arguing it in courts.

How Google tracks Android device users before they've even opened an app

Re: we do not agree with their legal analysis

Totally with you.

The article didn't appear to suggest anything about Legal Analysis by the researcher, merely the findings, which appear to be confirmed by Google.

Seems a lot of bluff and bluster about yet more privacy shenanigans, but ultimately use any phone OS at your peril, unless you want to use GrapheneOS or similar, to lock your phone down, then find it's not as convenient.

YMMV of course, but hardening a phone isn't too hard to do, but do you want to?

Think of all the convenience of your pocket PC with a Cellular Module?

Always seems to be a trade off between security/privacy and convenience.

Ghost ransomware crew continues to haunt IT depts with scarily bad infosec

Re: Path of least resistance

Fair comments.

Scratch the surface and you may find all sorts of horrors!

Integrity is key, but not all teams have solid management and leadership, either within the team of above.

Path of least resistance

Actors will generally go where it's easy to carry out whatever nefarious activities they are into.

FFS, I'm always gob smacked at how often simply patching and keeping things up to date, will reduce these incidents.

I know every IT team and Cyber Security team is under pressure, understaffed etc, but there's no excuse to not patch, considering the threat landscape out there!

DXC paid 50% more than original contract value for disastrous public sector Oracle project

Local authority incompetence

Given most local authorities are clueless when it comes to technology full stop, this article comes as no surprise.

Oracle, and other entities in the consulting space know very well that they can rinse the local council with nefarious actions and clauses in contracts that allow it to happen, it's almost par for the course when it comes to bidding for these contracts.

Healthcare outfit that served military personnel settles allegations it faked infosec compliance for $11M

No liability

Seriously, individuals need to be held to account.

This concept that you pay a fine, but without admitting liability, which if you didn't do it, why are you paying the fine? Is just some farcical merry go round that keeps perpetuating the same lackadaisical approach to cyber/information security.

It's a joke that fines are levied and a no liability statement somehow exonerates the company, "executives" aren't being held to account and they really should be.

Fines and criminal records for business executives may help here!

FreSSH bugs undiscovered for years threaten OpenSSH security

Re: updates

If you work in this field, I think you should have a reasonably confident expectation that you have some job security....

Treadmill indeed my friend!

Sophos sheds 6% of staff after swallowing Secureworks

Re: Time to leave

I'm with you Simonlb.

Never good to see one company with a portfolio like that!

Re: Time to leave

A noble sentiment my friend, but capitalism being what it is, someone is greasing the palms of whomever they need to ensure these firms continue.

It would appear everyone and anyone can create an equity firm, just call it Something Capital, get your mates from the right schools involved, who have also got friends from the right schools in government and regulations, and hey presto! You are now the proud owner of a firm with a licence to print money at the expense of the plebs!

Shameful but pretty accurate representation I think!

US cranks up espionage charges against ex-Googler accused of trade secrets heist

The middle kingdom does like a bit of IP

They're not going to stop finding ways to advance.

I'm sure there are other governments doing the same.

What's the answer dear El Reg readers?

Ontario responds to Trump tariff by pitching Starlink deal into the trash

Re: Great pic *roll eyes*

Like what you did there!

Minehead By Election, great sketch by those chaps!

Oracle starts laying mines in JavaScript trademark battle

I don't follow the Oracle logic here, if there is even such a thing.

They have no tangible Javascript products, they don't flog it, or consult on it to the best of my knowledge.

So why keep being such an insufferable horse's appendage about this?

Just let it be and do something good for once?

Too much to ask I know!

WFH with privacy? 85% of Brit bosses snoop on staff

Re: Confusing activity with productivity again

I'm lucky to have had a string of clients/bosses, call them what you like, who are interested in output/results and don't micro manage to get the output.

Last boss I had said " keep/run/operate whatever hours suit you, all I'm interested in is the correct output, at the right level of quality I need " It's refreshing to hear, but alas, it is also a rarity in the workplace too often.

I've also had bosses who track "productivity" based on the status of your collaboration tool, so Teams showing amber/away as an example. Which is a complete fallacy!

Spending watchdog blasts UK govt over sloth-like progress to shore up IT defenses

If they want to take action

They could do so.

I suspect, much as the article alludes to, that HMG IT infrastructure is so convoluted, with disparate systems aplenty, that there is no real quick answer here.

The fact that they've used external reviewers, rather than continue to self assure, is very much a step in the right direction.

Legacy systems, and there are a lot of those in HMG, can be protected, but only if you truly understand the risk.

Not everything needs to be upgraded to provide security, however, if you can identify the risk(s), you can likely install necessary compensatory controls, to good effect, without having to get rinsed by the big 4 to tell you there's a problem, without addressing it.

Which is probably what's going to happen next!

I'd happily help them on this quest, but I doubt HMG even thinks to look into the pool of experts on El Reg and elsewhere, as we probably didn't go to the right school!

Why does the UK keep getting beaten up by IT suppliers?

Re: It's a lack of understanding

I'm with you on this Philip.

I had a strap line for my team of internal security consultants, in short, without giving it away, it was along the lines of: "support our colleagues to get what they need to be productive, but do it safely and securely to protect the business and it's customers."

Help out where we can, but don't introduce unnecessary risk, it's not too hard to do, surely? YMMV

Meta's pay-or-consent model under fire from EU consumer group

Re: Meta should consent or pay me

I'd like to see that in action.

I'll pull up and sandbag and get the popcorn ready for a long drawn out wait for a response :)

Noble thought, but it's Meta, so you know what they think of you!

VMware users gripe over 3-year commitment to renew licenses

There's a theme here

Broadcom didn't acquire VMWare for the good of it's end users.

More of this to come as the washing is hung out to dry in front of the public.

I suspect there will be many more tales of VMWare migrations!

Brit competition watchdog takes aim at Google, Apple's mobile ecosystems

Heaven forbid that any spin or soundbites don't actually end in any tangible improvements for Joe Public now!

HMG has been largely toothless on many fronts, I don't see what is going to be achieved by this latest "investigation".

Who is DDoSing you? Rivals, probably, or cheesed-off users

You would think

Actively DDoSing a competitor would be illegal, say, somehow against some sort of cyber crime legislation.

If that's the case, why isn't anyone suing the living crap out of each other in this space?

Biz tax rises, inflation and high interest. Why fewer UK tech firms started in 2024

Re: Easy to address, actually

That's one area to address for sure.

But there's so much to work on, across the board, that I don't think this concept, on its own, is enough.

It's a great idea, I've been observing the alleged housing crisis we have for a while and wonder where the empirical evidence is, you know the one to justify all the new build appearing on every parcel of land conceivable around the UK?

I'll throw my cynic's hat into the ring, has anyone seen the remuneration packages for the CEO's of these various house building entities is?

This is a tough one to adress

So I'll not go into Macro issues and Economics.

The UK has, for a long time, been increasing its debt and not investing in the right areas.

We have devolved governments, who blame Westminster for everything and in turn, Westminster blames the devolved entities for mismanglement!

We have a high rate of tax on everything and rather than find a way to decrease the burden on the public purse, we only seem to be able to increase it, then borrow and then hike taxes.

I'm all for taxation, if I can see tangible benefits of where my money is being spent to benefit the country and our communities.

Everyone, less the excessively rich, is feeling marginalised and no-one believes any of the hot air that comes out of politicians mouths.

How do we address this apathy in the UK?

Probably by moaning in the press and then just getting on with it and "harumphing" a lot as the Brits always do!

Everyone is so busy trying to get by that no-one is focusing on how to change things for the better, as we've got government for that, haven't we......?

LinkedIn accused of training AI on private messages

Not sure the lawsuit will do anything

People need to vote with their feet.

I left LinkedIn.

Don't miss it, don't miss the shite posts, don't miss the fake jobs, don't miss the self congratulatory posts from smarmy wannabe's.

It had a use, some time ago, before it got filled with nonsense and adverts.

Tool touted as 'first AI software engineer' is bad at its job, testers claim

Re: Stop the AI Marketing spin

Couldn't agree more.

Stop naming everything AI.

It's artificial alright, but it's all lacking intelligence at the moment.

Seriously, some of this shite is being pitched as if we've managed to create sentient, autonomous beings..... We really haven't!

Real datacenter emissions are a dirty secret

These aren't the Droids you're looking for!

Move along, nothing to see here!

Former Amazon exec appointed as boss of UK's competition watchdog

Re: Former head of competition watchdog not "sufficiently focused on growth."

Also see:

The "the new boss of XXX department worked in big tech so they must know what to do!" mantra, which the equates to shockingly high levels of remuneration and a "hope" they can fix the problem we haven't actually defined!

All at the expense of the public purse and more shenanigans and no doubt a personality change in XXX months or years.

UK tax collector's phone service 'deliberately' bad to push users online, say MPs

The problem with the "save money" mantra, is that it often then adds inefficiencies, as you generally kill head count, then either rehire cheap or think tech can do the job and then find out it is orders of magnitude more expensive than actual humans with knowledge and skill.

Apple Intelligence turned on by default in upcoming macOS Sequoia 15.3, iOS 18.3

.... WILL free the roughly 10 GB it takes up, right? Right?

That's a good point!

Exactly how much space and bloat does this Intelligence bring?

Ransomware scum make it personal for Reg readers by impersonating tech support

Re: You got me at....

Good catch.

There should be some serious inward reflection and thought as to why default configurations are so easy to overcome.... yes I'm looking at all the Software and Hardware slingers!

Well because they come out the factory with the equivalent of Password123 credentials.

FFS.... Secure by Design should really start to appear in OS/Software slingers too.

There should be no "easy for end users" default configurations!