The Register Home Page

* Posts by Dave Null

111 publicly visible posts • joined 7 Dec 2020

Page:

Trump jumps from 'anything goes' to 'strict regulation' AI policy

Dave Null

it'll be driven by Mythos

Mythos, and OpenAI's similar TOC, have scared a lot of people. Probably an overreaction but automated chaining of automatically discovered vulnerabilities is a big thing and govs/large customers are already getting gated access. I presume this is enshrining in law that this has to happen for adversarial models like this. May not be a bad thing - I firmly believe that AI regulation is important (and also that a US gov-driven directive may not be exactly what it says it is)

Anthropic's super-scary bug hunting model Mythos is shaping up to be a nothingburger

Dave Null

this should be obvious but

the risk of Mythos is the ability to chain together potentially "small" vulnerabilities very rapidly into a complex but successful attack chain.

Initial reports suggest it is very good at this. I suspect the main focus will be third party OSS that many enterprises rely on in their software supply chain...

Dev stunned by $82K Gemini bill after unknown API key thief goes to town

Dave Null

Re: Bad Business Practice

Sounds like a business idea for an agent to detect this. Your VC funding is incoming!

Worried Europeans can now cut Azure's phone cord completely

Dave Null

Re: Bollocks

It doesn't though. Orgs using Azure Local can disconnect from MS backbone entirely, and users of Azure Sovereign can do the same. (You can also BYOK to public Azure/M365).

Ex-Google engineers accused of helping themselves to chip security secrets

Dave Null

You'd have to be pretty dumb to think DLP wouldn't catch this

Data loss protection is pretty standard these days at automatically identifying insider data exfiltration

Snyk CEO bails, wants someone with more AI experience to replace him

Dave Null

Doesn't really feel like a story

CEO feels he's not best equipped to move the company in the direction the board wants. Steps aside. There may have been board / shareholder dissatisfaction, there may not. Either way when a CEO leaves they have to say something to protect the company. He could have just said "I want to spend more time with my hobbies" but probably that isn't a good enough statement for future employment and probably wouldn't have got publicity the company probably desires...

Microsoft throws spox under the bus after Parliament testimony on ICC email kerfuffle

Dave Null

summary

US Gov tells MS to cut services to an individual. MS don't / can't access customer tenants so are unable to comply: this has to be done by the tenant admin at the ICC. MS realises if the ICC admin doesn't do this, they will have to cut the entire tenant and expresses this to ICC admins. ICC admins then remove the account. Have I got this right?

Future jobs in AI will come with a hardhat and boots, tech bigshots argue

Dave Null

Doubt it

Assuming you have land, adequate power and cooling (and latest gen MS DCs are closed loop water cooling) then it doesn't take years or thousands of people to build a DC. They can drop additional slabs and get an extension building up in 3 months now as they're prefabs. I doubt there will be lots of DCs in every town, they'll be centralised in regions. When they're built a modern DC is pretty much lights-out - they are not places where humans work long term, you'll have a few security folks based there, and hardware techs that pass through, and that's about it.

House of Lords votes to ban social media for Brits under 16

Dave Null

a better approach: regulate the platforms

Class the platforms as publishers, hold them to account via a strong regulator. Sure, going after FB or X is going to have a backlash from the US government but it'd be worth it.

Also, there should be strong age verification services in place before anything like this is done: otherwise it's going to be a shitshow of leaked personal data, browsing habits and it'll have a chilling effect on non commercial platforms like mastodon et al.

ATM maintenance tech broke the bank by forgetting to return a key

Dave Null

Not me, but

I work for a very large hyperscaler. The physical keys for DCs have GPS tracking as well as RFID alerts on external exits and are automatically blocklisted if they leave the facility, which also kicks off a "what the hell is someone doing?" audit workflow.

Wikimedia’s 25th birthday gift: Letting more AIs scour pages volunteers created

Dave Null

Re: Wikipedia is quite good

"wikipedia is quite good" is perhaps the most damming with faint praise I've ever heard.

Wikipedia is excellent. Yes, there are inaccuracies but it's the least-worst option for a non-corporate knowledge base that we have. The overall utility of Wikipedia vastly outweighs the need to use critical thinking when reading it. I'd imagine with proper funding they could improve the corrections rather than it being 100% volunteer led.

Windows App forgets how to log in with first security update of the year

Dave Null

Bravo, sir. This is the best comment I've ever seen on El Reg

Microsoft appears to move on from its most loyal ‘customers’ – Contoso and Fabrikam

Dave Null

Re: MS has many more "brands" than just Contoso and Fabrikam

Old-timer here. Nah, this is an official "new" one to add to the list. MS doesn't mess about with this stuff any more, it's all quite regimented. You can set up an internal demo for a customer for the "brands" automatically using internal tooling which is pretty good: e.g. if you want to demo Fabric rather than have to manually set up a test environment, populate it with users and data manually - it can all be safely (from a legal perspective as well as a technical perspective) done in a few clicks. Massive timesaver as well as legally safe.

Dave Null

MS has many more "brands" than just Contoso and Fabrikam

There are many - all cleared to be a) inoffensive in any language and b) not to infringe any copyright. There's even an internal tool to populate usernames for demos where you can pick a demographic/region etc. It makes sense given the crazy number of demos given at any given time by MSFT folks.

Other examples include AdventureWorks, Northwind Traders, A. Datum, Coho Vineyard etc. Each is tailored to a different demo audience.

Contoso has demos for pretty much anything Microsoft, Fabrikam tends to be more around identity/messaging etc in a traditional enterprise scenario etc.

I'd imagine that Zava's been picked as an example of a startup/cloud-first scenario - all the demos are very big-data heavy e.g. demand for products across seasons which presumably lend themselves well to AI conversations like demand prediction, supply chain etc for smaller, more agile potential customers rather than traditional heavy enterprise.

You are likely to be eaten by the MIT license: Microsoft frees Zork source

Dave Null

Great move

Scott H (who is a very nice chap) has an idea that now MS owns Activision, they can do this, he gets a cute Ignite demo and the world gets opensourced Zork. Win win and nice publicity all around. Good move, MS.

YouTube's AI moderator pulls Windows 11 workaround videos, calls them dangerous

Dave Null

this isn't being done by microsoft

I know the article doesn't claim it is, however lots of folks seem to love jumping to conclusions. This is a YT AI moderation issue.

Twist in Tesco vs. VMware case as Computacenter files claim against Broadcom, Dell

Dave Null

I hope BC get it in the neck

this was one of the most egregious monopoly abuse scenarios I've heard of in recent years. Tesco is a formidable customer to most large IT providers and not shy of going legal. Good luck to everyone apart from BC.

UK data regulator defends decision not to investigate MoD Afghan data breach

Dave Null

Probably pragmatic

...I mean, if they fine the MoD, they're fining the UK taxpayer...I'd imagine the MoD have agreed to document what process improvements they intend to make etc. Yes, a massive fuck up, but I'm not really sure what practical use the ICO fining them would have right now.

Explain digital ID or watch it fizzle out, UK PM Starmer told

Dave Null

Do it like the swiss e-ID

The Swiss e-ID is an electronic version of a physical ID card. It only holds data locally for authentication, it does not rely on a massive remote database and you can choose on each transaction what data you share: https://www.eid.admin.ch/en/e-id-e#doc-1j09kufn60

US Navy: I can't quit you, Azure

Dave Null

Re: Cloud...

What on earth do you think the choice of Office apps installed on desktop PCs has to do with this?

Microsoft thinks cloud PCs might be overkill, starts streaming just apps under Windows 365

Dave Null

Re: But why?

Well, I guess the market will decide. This is a fairly simple thing to offer given WVD already exists. I can imagine a few scenarios where a LoB app needs to be accessible to users (e.g. a PoS system or similar) and pushing that as a virtual app that is centrally managed seems quite a sensible idea. For a kiosk PC this would allow multiple users to log on to app only rather than the kiosk OS itself.

Huntress's 'hilarious' attacker surveillance splits infosec community

Dave Null

seeing as you didn't include the link...

here it is https://www.huntress.com/blog/rare-look-inside-attacker-operation

Microserfs ordered back to the office, given 10 days to appeal

Dave Null

Outside of the US...MS doesn't have enough office space

UK headquarters shrunk from 5 buildings to 1, London office already full. Satellite offices in UK are tiny. There isn't enough space for us all, and a lot of us don't have any team mates that are in our nearest office anyway. I presume it's a head count reduction lever. Many folks don't live anywhere near their official office and haven't for years either. This is going to be rough.

Microsoft wares may be UK public sector's only viable option

Dave Null

it's not just about application software though is it?

It's the cloud service behind it. Hosting your own OSS mail servers/team collab software/data storage etc isn't easy or cheap to achieve. Running a hyperscaler cloud offering is a massive undertaking that individual companies are going to struggle to do at less total operating cost. Think security - if a nation state decides they want your org's data - can you secure it as well as a hyperscaler? Probably not. People thinking that this spend can be removed by swapping Word for Libre Office aren't really thinking about the bigger picture...

Europe slams online tat bazaar AliExpress for dodging obligation to stop dodgy traders

Dave Null

there's loads of dodgy stuff on there

...tasers, knuckle dusters, illegal power lasers. I appreciate access to cheap stuff from Ali but a quick scan shows lots of things that obviously should not be sold to UK markets for example

Microsoft boots 3% of staff in latest cull, middle managers first in line

Dave Null

Re: Jobsworths

I know a bunch of people who's lives are really affected by this and they certainly aren't jobsworths, the cuts have been apparently random and some extremely talented folks have been let go overnight. Be kind.

When Microsoft made the Windows as a Service pivot

Dave Null

Re: Lessons skipped and still not enough paranoia

You're talking about during a support ticket here. They're not running these blindly en masse, they just have a legal process for what they are allowed to do during a support ticket. They also redact PII from support ticket logs.

'Once in a lifetime' IT outage at city council hit datacenter, but no files lost

Dave Null

Re: Did they try turning it off and on again?

This. Practicing a drill like this at a hyperscaler is an interesting experience...

Payday from hell as several British banks report major outages

Dave Null

downdetector is showing a load of similar looking outages

anyone have any insight into what's going on? DDOS attack on last friday of month on payday? Supply chain failure? ISP routing problem? It can't be coincidental...

100-plus spies fired after NSA internal chat board used for kinky sex talk

Dave Null

I think you should retract this article, you're pushing propaganda...

see https://www.theguardian.com/us-news/2025/feb/27/transgender-us-military-personnel-pentagon-memo-stood-down-trump-administration

Transgender service members will be separated from the US military unless they receive an exemption, according to a Pentagon memo filed in court on Wednesday – essentially banning them from joining or serving in the armed forces.

Donald Trump signed an executive order in January that took aim at transgender troops in a personal way – at one point saying that a man identifying as a woman was “not consistent with the humility and selflessness required of a service member”.

This month, the Pentagon had said that the US military would no longer allow transgender individuals to join and would stop performing or facilitating procedures associated with gender transition for service members.

Trans military members on the feared ban: ‘I would meet Trump to show how we’ve served our country’

Read more

Wednesday’s late-evening memo went further. It said that the Pentagon must create a procedure to identify troops who are transgender within 30 days and then within 30 days of that, must start to separate them from the military.

“It is the policy of the United States government to establish high standards for service member readiness, lethality, cohesion, honesty, humility, uniformity, and integrity,” said the memo, dated 26 February.

“This policy is inconsistent with the medical, surgical, and mental health constraints on individuals with gender dysphoria or who have a current diagnosis or history of, or exhibit symptoms consistent with, gender dysphoria.”

There is no requirement for transgender troops to self identify and the Pentagon doesn’t have a precise number.

The Pentagon said waivers would be granted only “provided there is a compelling government interest in retaining the service member that directly supports warfighting capabilities”.

It added that for a waiver, troops must also be able to meet a number of criteria, including that the service member “demonstrates 36 consecutive months of stability in the service member’s sex without clinically significant distress”.

The military has about 1.3 million active duty personnel, according to Department of Defense data. Transgender rights advocates say there are as many as 15,000 transgender service members. Officials say the number is in the low thousands.

The move, which goes further than restrictions Trump placed on transgender service members during his first administration, was described as unprecedented by advocates. “The scope and severity of this ban is unprecedented. It is a complete purge of all transgender individuals from military service,” said Shannon Minter of the National Center For Lesbian Rights (NCLR).

Dave Null

This isn't what happened: it's an LGBTQ purge

The chats in question were LGBTQ employee resource group chats, not "kinky sex". This is an excuse to fire LGBTQ NSA employees. https://www.motherjones.com/politics/2025/02/queer-trans-federal-workers-fear-lgbtq-purge-lavender-scare/

This Reg article is harmful.

Trump administration threatens tariffs for any nation that dares to tax Big Tech

Dave Null

Aimed at stopping EU imposing penalties on US social media

This is how Twitter/X will be planning to continue to push society-damaging social media to the world without pushback. Another country wants to stop them pushing hate speech and regulate them? Tariffs.

UK Home Office silent on alleged Apple backdoor order

Dave Null

TCNs are "secret" in the UK

hence the WaPo breaking this - whoever leaded it knew that Technical Capability Notices are not discussed in UK media...

Brits must prove their age on adult sites by July, says watchdog

Dave Null

great for blackmail...

...access dodgy site, which knows who you are and exactly what you've been watching...

Fujitsu does not trust Post Office in use of Horizon data in future third-party prosecutions

Dave Null

Re: You'd think

if you've ever been involved in any ERP deployment (even a "simple" one) then you'd have less confidence that it's readily doable...

UK government plays power broker with small modular reactor suitors

Dave Null

this is going to be critical to staying relevant in the DC business

Given all the major cloud providers are struggling to expand capacity at the rate their customers want, this is going to be key. Designating DCs as CNI will hopefully make planning for SMR deployment to power DCs easier given at the moment it is not clearly defined how a private enterprise could leverage SMRs to power DCs as MS/Amazon/Google all want.

There's probably a revenue stream for the UK Gov by providing SMRs as a service to private enterprise in scenarios like this.

UK gov report to propose special zones for datacenters, 'AI visas'

Dave Null

clear regulation for SMR?

Given MS, Google and Amazon have all expressed interest in using SMR reactors for powering DCs, and the UK has in Rolls Royce, Amentum et al a manufacturer that can make them but no clear regulation about deploying them, this seems to be an area where some clear regulation could help.

Dave Null

Re: Bargain basement

I really don't think this applies to skilled AI workers working for the large tech companies

Microsoft turning away AI training workloads – inferencing makes better money

Dave Null

Re: "we are literally going to the real demand"

they choose what they sell and they are selling the mature solutions with highest demand. The market will decide if this is the right decision. MS have no responsibility to do everything every customer asks, they build SKUs and sell them...

Keir Starmer tells regulators to chill as Microsoft exec takes wheel of advisory council

Dave Null

Less regulation - relating to SMR power for DCs?

I wonder if part of the "less regulation" approach, rather than being aimed at things like less AI regulation, might include making it easier for private SMR nuclear power for DCs. Currently I'm unclear on what the regs are around this and MS, Google and AWS have all expressed intent to power DCs with SMRs. After a chat with a friend who works on these for a major engineering firm current regs are fairly unclear on how these could be legally deployed by private companies and where.

Irish power crunch could be prompting AWS to ration compute resources

Dave Null

Re: Irony

this is 100% true for Azure DCs. I suspect the future will be SMR powered DCs and Oracle have just announced their first.

Also when siting DCs you need to take into account latency. All the big players are starting to create new regions due to capacity issues and encouraging customers to go multi region where possible, as well as dissuading new customers from deploying to existing resource-constrained regions.

Dave Null

Re: Irony

When you site a DC, you do a whole lot of worst-case thinking. This includes things like not building near fault lines, taking into account geopolitical potential in the area etc etc. Building next door to a nuclear power station adds a whole lot of potential worst case, whether from accident or military conflict. Not saying it won't happen, but you don't just plonk these things down next to the nearest cheap power if you're a major player.

Public clouds are 'dirty' about VMware's on-prem push, says Broadcom CEO Hock Tan

Dave Null

as someone from a public cloud, we're watching through our fingers...

...as broadcom raise customer prices massively (like 8x in some cases) and customers are coming to us with a "screw VMware, we want off ASAP" attitude. This is a problem entirely of Broadcom's making and they should not be surprised. They publicly said that effectively they're gonna rinse their top customers who will take a while to migrate off whilst letting all the small customers churn off the platform, make out like bandits for a couple of years and then let the product die. It's a damn shame.

Automation needed to fight army of AI content harvesters stalking the web

Dave Null

Removal pain incentive?

If an AI company were to crawl a site's contents against the robots.txt policy, I presume that site could then press legally for the removal of their content from the AI. I suspect this would be non-trivial and expensive for the AI company question. Perhaps it needs a test case to sharpen the issue.

Firms skip security reviews of major app updates about half the time

Dave Null

this aged well...

Great PR, Crowdstrike...

Two cuffed over suspected smishing campaign using 'text message blaster'

Dave Null

Most likely explanation: it's a conventional SIM sending texts

https://www.linkedin.com/pulse/why-homemade-mobile-antennas-cant-evade-operators-sms-paul-walsh-1tgyc/

HR expert says biz leaders scared RTO mandates lead to staff attrition

Dave Null

sceptical...

as a long term MSFT employee (and full time remote for the last 6 years) there has been no RTO, so I suspect they're using non-representative data to produce this report...

Broadcom has willingly dug its VMware hole, says cloud CEO

Dave Null

pump and dump

No idea why everyone's acting surprised. They did this before with Symantec. The investors will make out like bandits for the couple of years that customers take to migrate off this dead platform. VMware will die. Shame that such a good platform has been deliberately killed, but this is the business plan of Broadcom.

All other cloud providers are scrambling to help customers off VMware - for a large org this isn't a quick or easy process though and could easily take a year or two.

Broadcom's stated strategy ignores most VMware customers

Dave Null

nearly unbelievable, if they hadn't done the same with Symantec a few years ago

So from an MSFT side what we're hearing from customers is those top 600 are facing licence increases of 17x in some cases. Moving a LORG off VMware is potentially a 2-3 year project so they're banking on, well, making bank from them for that period, whilst the angry customer offboards to a competitor. They don't care, they know it'll cause the death of VMware, they want a short term profit from those customers who are locked in. Feels almost like piracy.

Lots of customers going to AVS in Azure for easiest migration path then reconsidering their options to go either Azure IaaS or Stack HCI, neither of which are an easy or quick option. I'm sure GCP and AWS are seeing the same.

Plus for those top 600 customers on VMWare you've got to ask what the support is going to be like given all their team are going to be jumping ship at the earliest opportunity and there's obviously going to be no investment in the product going forward.

It was a solid platform, and investment capitalism has killed it and hurt thousands of companies dependent upon them.

Raspberry Pi Pico cracks BitLocker in under a minute

Dave Null

Re: A brilliant testament to analysis

and if you read the linked MS article, that is exactly what they did when they advised customers with an advanced threat profile to use bitlocker plus PIN. Problem is it's a management nightmare especially if you don't use network unlock.

Page: